topic Deferred action in Checkpoint in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Deferred-action-in-Checkpoint/m-p/493503#M84322 <P>Hi Team,</P> <P>we have a lookup table in checkpoint app name checkpoint_actions_te.csv,<BR /> in that te_action is mapped against splunk action,</P> <P>In te_action there are many action taken by checkpoint like deferred (allowed blocked ctl allow prevent monitor askdetect redirect detect drop ) and splunk action column contain (deferred,allowed,blocked)<BR /> please find below table</P> <P>deferred deferred<BR /> allowed allowed<BR /> blocked blocked<BR /> ctl deferred<BR /> allow allowed<BR /> prevent blocked<BR /> monitor deferred<BR /> ask deferred<BR /> detect deferred<BR /> redirect deferred<BR /> detect deferred<BR /> drop blocked<BR /> reject blocked</P> <P>as per my understanding deferred traffic is also allowed traffic need more clarification,<BR /> please share any reference question if already asked,</P> <P>Thanking</P> Wed, 30 Sep 2020 02:23:57 GMT ashishamalviya1 2020-09-30T02:23:57Z Deferred action in Checkpoint https://community.splunk.com/t5/Getting-Data-In/Deferred-action-in-Checkpoint/m-p/493503#M84322 <P>Hi Team,</P> <P>we have a lookup table in checkpoint app name checkpoint_actions_te.csv,<BR /> in that te_action is mapped against splunk action,</P> <P>In te_action there are many action taken by checkpoint like deferred (allowed blocked ctl allow prevent monitor askdetect redirect detect drop ) and splunk action column contain (deferred,allowed,blocked)<BR /> please find below table</P> <P>deferred deferred<BR /> allowed allowed<BR /> blocked blocked<BR /> ctl deferred<BR /> allow allowed<BR /> prevent blocked<BR /> monitor deferred<BR /> ask deferred<BR /> detect deferred<BR /> redirect deferred<BR /> detect deferred<BR /> drop blocked<BR /> reject blocked</P> <P>as per my understanding deferred traffic is also allowed traffic need more clarification,<BR /> please share any reference question if already asked,</P> <P>Thanking</P> Wed, 30 Sep 2020 02:23:57 GMT https://community.splunk.com/t5/Getting-Data-In/Deferred-action-in-Checkpoint/m-p/493503#M84322 ashishamalviya1 2020-09-30T02:23:57Z