Forum Discussion

Naoki's avatar
Naoki
Meteor
30 days ago

What is the difference between App Control Rule "Allow + Tracking: Event Enable" and "Monitor"?

In the *App & Data Inline* -> *Application Control Policy*, we have configured the rule as follows:

- **Action: Allow**  
- **Tracking: Event** (Enabled)

However, under this configuration, **no events are shown in the Events screen**. Is this the expected behavior?

We are confused because there is also an **Action: Monitor** option, yet "Allow" can also be configured with Tracking enabled or disabled.  
Could you clarify the functional difference between these two actions and how they affect event logging?

 

casb

5 Replies

Sort By
    • Naoki's avatar
      Naoki
      Meteor
      23 days ago

      Hi michaelsaw,

      Thanks for getting back to me.

      In your response, you mentioned:

      "Allow" permits the specified activity without tracking.
      "Monitor" allows tracking and visibility of the permitted activity.

      I just want to make sure I understand correctly.

      When using "Allow," does that mean the activity isn’t tracked at all and won’t show up on the Dashboard?

      Or is the main difference that with "Allow," tracking can be turned on or off, while "Monitor" always has tracking enabled?

      Appreciate your help—thanks in advance!

       

      • michaelsaw's avatar
        michaelsaw
        Icon for Cato Employee rankCato Employee
        20 days ago

        Hi Naoki san, 

        Appreciate your feedback.

        When using Allow, we have an option to enable or disable "Events", depending on requirements.
        When using Monitor, "Event" is enabled.

        Would this be alright?

        Thank you.