Getting Data In

Deferred action in Checkpoint


Hi Team,

we have a lookup table in checkpoint app name checkpoint_actions_te.csv,
in that te_action is mapped against splunk action,

In te_action there are many action taken by checkpoint like deferred (allowed blocked ctl allow prevent monitor askdetect redirect detect drop ) and splunk action column contain (deferred,allowed,blocked)
please find below table

deferred deferred
allowed allowed
blocked blocked
ctl deferred
allow allowed
prevent blocked
monitor deferred
ask deferred
detect deferred
redirect deferred
detect deferred
drop blocked
reject blocked

as per my understanding deferred traffic is also allowed traffic need more clarification,
please share any reference question if already asked,


Tags (1)
0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...