AV Profile - Alert action

[MauricioPerez]

Hello guys,

I have a question about the alert action in the AV profile.

- When I configure alert in AV action (threat already known), is traffic allowed or blocked?

- When I configure alert on WildFire action, is traffic allowed? or does it depend on the detection I do on the file?

I'm a bit confused, as I have traffic being allowed, when Wildfire's action is alert and it has detected files as malware.

Thank you!

[kiwi]

Hi @MauricioPerez ,

That is correct.  The alert action will log it for you but won't block it

alert — threat or URL detected but not blocked

Check out all the details of the different actions here: threat-log-fields 

Hope this helps !

-Kiwi.

[MauricioPerez]

Thanks for your answer,

But it is not clear to me, if it does not block, alert action: allow traffic and generate an alert?