Threat Emulation policy action "Send"

[imamuzic]

Hi guys,

What policy action of type "Send" means in context of Threat Emulation with ICAP? I have a TP gateway (ICAP server) with remote emulation to local TE appliance. 

Please see the screenshot attached. 

Best Regards,

Igor

[PhoneBoy · Accepted solution]

It would seem to indicate this file was sent for emulation.

[imamuzic]

Great, thanks. That makes sense. I think that "Lggging and Monitoring Admin Guide" under "Using the Action Filter" should be updated to reflect what you wrote above as its current version is a bit misleading about "Send" action:

"User decided to continue transmission after DLP capture. An administrator with full permissions or with the View/Release/Discard DLP messages permission can also decide to continue transmission. Email notification is sent to the user."

[PhoneBoy]

Possible this is used in both situations.
In any case, tagging @Sergei_Shir 

[Ronit_Segal · Accepted solution]

As per RnD:

The logs look like a bug, since “Send” is a feature reserved for DLP.

 ICAP sends 'monitor', 'allow', 'prevent' logs.

Therefore, in this case. it is better to open a support ticket.

[the_rock]

Exactly means what Phoneboy said.

[Ronit_Segal]

According to @Ran :

Not sure why but I think ICAP generate this weird log. TE does generate these kind of logs.

This looks like a bug, not sure why this log is created like this.