topic Correlation log subtype action always allowed? in General Topics

Correlation log subtype action always allowed?

MikeSangray2019 — Thu, 10 Sep 2020 16:14:33 GMT

Is the correlation log_subtype action always allowed? It creates a bit of confusion when the action on the actual event was blocked, but the correlation action shows allowed. Just looking for clarification.

Re: Correlation log subtype action always allowed?

S.Cantwell — Fri, 11 Sep 2020 02:14:59 GMT

Are you looking at the Panorama logs?

Can you upload screen captures from devices, so we can visually see what you are explaining to us?

Re: Correlation log subtype action always allowed?

MikeSangray2019 — Fri, 11 Sep 2020 15:43:52 GMT

No, actually the PA logs don't display Action for the correlation events like you see for Traffic, Threats, etc. I'm seeing the Action as 'allowed' in Splunk logs. So all correlation events have the action 'allowed'. Just ends up being misleading when reading reports.