Security Intelligence Monitoring
Monitoring logs connection events for traffic that would have been blocked by Security Intelligence, but does not block the traffic. Monitoring is especially useful for:
-
Testing feeds before you implement them.
Consider a scenario where you want to test a third-party feed before you implement blocking using that feed. When you set the feed to monitor-only, the system allows connections that would have been blocked to be further analyzed by the system, but also logs a record of each of those connections for your evaluation.
-
Passive deployments, to optimize performance.
Managed devices that are deployed passively cannot affect traffic flow; there is no advantage to configuring the system to block traffic. Additionally, because blocked connections are not actually blocked in passive deployments, the system may report multiple beginning-of-connection events for each blocked connection.
|
If configured, Secure Firewall Threat Intelligence Director may impact the action taken (Monitor or Block.) |
To Configure Security Intelligence Monitoring:
After you configure Security Intelligence blocking following the instructions in Configuration Example: Security Intelligence Blocking, right-click each applicable object in the Block list and choose Monitor-only. You cannot set system-provided Security Intelligence lists to monitor only.