cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2877
Views
5
Helpful
1
Replies

"would be blocked" FireSight event

ibrahim_hassan
Level 1
Level 1

I can see some logs on the FireSight for sourcefire events with action "would be blocked", what is meant by this action and when is it used instead of normal "block"action?

1 Reply 1

Marvin Rhoads
Hall of Fame
Hall of Fame

We can see this when you have told the appliance to trust traffic that would otherwise have met criteria for blocking via Security Intelligence (SI).

 

It can also apply when the appliance is in monitor-only mode (e.g acting as an IDS only).

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: