Monitor action

[CheckMates12345]

Hello Everyone,

What's difference between Monitor and Prevent?

I sometimes have the same event duplicate, one with monitor, and one with prevent. Other times I got only monitor, even if CheckPoint sees the targer URL as malicious. Does monitor block traffic too? Thanks.

[Chris_Atkinson]

Which product / blades / version is your query in relation to?

If you configuration is background mode potentially the first attempt could be detect and subsequent attempts prevent.

Anti-bot also has some different protections that might detect/prevent similar URLs.

Specifically in recent versions the logging for DNS trap for Anti-bot was changed to be Prevent where previously it was Detect.

More info (or even screenshots) is required to help guide you. 🙂

[_Val_]

Please provide an example of at least one Monitor/Prevent pair.