topic Re: AV Profile - Alert action in General Topics

AV Profile - Alert action

MauricioPerez — Fri, 05 Feb 2021 05:56:36 GMT

Hello guys,

I have a question about the alert action in the AV profile.

- When I configure alert in AV action (threat already known), is traffic allowed or blocked?

- When I configure alert on WildFire action, is traffic allowed? or does it depend on the detection I do on the file?

I'm a bit confused, as I have traffic being allowed, when Wildfire's action is alert and it has detected files as malware.

Thank you!

kiwi — Fri, 05 Feb 2021 09:40:32 GMT

That is correct. The alert action will log it for you but won't block it

alert — threat or URL detected but not blocked

Check out all the details of the different actions here: threat-log-fields

Hope this helps !

-Kiwi.

MauricioPerez — Sat, 06 Feb 2021 15:37:48 GMT

Thanks for your answer,

But it is not clear to me, if it does not block, alert action: allow traffic and generate an alert?