Connection was allowed because background classification mode was set

[Priyal_Chavada]

Hello Team,

I have came across some logs from New anti virus and in that i see message field contain the value "Connection was allowed because background classification mode was set. See sk74120 for more information.".

Can you please share some idea for this.

Device Action : Detect

[PhoneBoy · Accepted solution]

It means the connection finished before the traffic was classified and, because you have "background" mode set (which is the default), the connection was allowed.
This is explained (and can be remediated by following the steps) in https://support.checkpoint.com/results/sk/sk74120 

[the_rock]

What @PhoneBoy gave you is indeed how it works.

Andy