Getting Data In

Deferred action in Checkpoint

ashishamalviya1
New Member

Hi Team,

we have a lookup table in checkpoint app name checkpoint_actions_te.csv,
in that te_action is mapped against splunk action,

In te_action there are many action taken by checkpoint like deferred (allowed blocked ctl allow prevent monitor askdetect redirect detect drop ) and splunk action column contain (deferred,allowed,blocked)
please find below table

deferred deferred
allowed allowed
blocked blocked
ctl deferred
allow allowed
prevent blocked
monitor deferred
ask deferred
detect deferred
redirect deferred
detect deferred
drop blocked
reject blocked

as per my understanding deferred traffic is also allowed traffic need more clarification,
please share any reference question if already asked,

Thanking

Tags (1)
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!