Security intelligence monitoring

Security Intelligence monitoring is a security feature that

  • logs connection events for traffic that would have been blocked by Security Intelligence, but does not block the traffic,

  • enables testing of feeds before implementation, and

  • optimizes performance in passive deployments.

Use cases for security intelligence monitoring

Monitoring is especially useful for:

  • Testing feeds before you implement them.

    Consider a scenario where you want to test a third-party feed before you implement blocking using that feed. When you set the feed to monitor-only, the system allows connections that would have been blocked to be further analyzed by the system, but also logs a record of each of those connections for your evaluation.

  • Passive deployments, to optimize performance.

    Managed devices that are deployed passively cannot affect traffic flow; there is no advantage to configuring the system to block traffic. Additionally, because blocked connections are not actually blocked in passive deployments, the system may report multiple beginning-of-connection events for each blocked connection.

Note

If configured, Secure Firewall Threat Intelligence Director may impact the action taken (Monitor or Block.)

To configure Security Intelligence monitoring:

After you configure Security Intelligence blocking following the instructions in Configuration example: Security intelligence blocking, right-click each applicable object in the Block list and choose Monitor-only. You cannot set system-provided Security Intelligence lists to monitor only.