Forum Discussion

Naoki's avatar
Naoki
Icon for Making Connections rankMaking Connections
5 months ago

What is the difference between App Control Rule "Allow + Tracking: Event Enable" and "Monitor"?

In the *App & Data Inline* -> *Application Control Policy*, we have configured the rule as follows:

- **Action: Allow**  
- **Tracking: Event** (Enabled)

However, under this configuration, **no events are shown in the Events screen**. Is this the expected behavior?

We are confused because there is also an **Action: Monitor** option, yet "Allow" can also be configured with Tracking enabled or disabled.  
Could you clarify the functional difference between these two actions and how they affect event logging?

 

casb

5 Replies

  • michaelsaw's avatar
    michaelsaw
    Icon for Cato Professional Services rankCato Professional Services
    5 months ago

    Hi Naoki san, 

    "Allow" permits the specified activity without tracking.
    "Monitor" allows tracking and visibility of the permitted activity

    Yes. "Allow" can be configured with Event Tracking, as/when required.
    If "Monitor" with Event Tracking is configured, there may be duplicate events.

    Here is a link for reference: https://support.catonetworks.com/hc/en-us/articles/13314302436253-Managing-the-Application-Control-Policy

    Is this alright?

    Thank you.

    • Naoki's avatar
      Naoki
      Icon for Making Connections rankMaking Connections
      5 months ago

      Hi michaelsaw,

      Thanks for getting back to me.

      In your response, you mentioned:

      "Allow" permits the specified activity without tracking.
      "Monitor" allows tracking and visibility of the permitted activity.

      I just want to make sure I understand correctly.

      When using "Allow," does that mean the activity isn’t tracked at all and won’t show up on the Dashboard?

      Or is the main difference that with "Allow," tracking can be turned on or off, while "Monitor" always has tracking enabled?

      Appreciate your help—thanks in advance!

       

      • michaelsaw's avatar
        michaelsaw
        Icon for Cato Professional Services rankCato Professional Services
        5 months ago

        Hi Naoki san, 

        Appreciate your feedback.

        When using Allow, we have an option to enable or disable "Events", depending on requirements.
        When using Monitor, "Event" is enabled.

        Would this be alright?

        Thank you.