What is the difference between App Control Rule "Allow + Tracking: Event Enable" and "Monitor"?

Question

In the *App &amp; Data Inline* -&gt; *Application Control Policy*, we have configured the rule as follows:- **Action: Allow** &nbsp;- **Tracking: Event** (Enabled)However, under this configuration, **no events are shown in the Events screen**. Is this the expected behavior?We are confused because there is also an **Action: Monitor** option, yet "Allow" can also be configured with Tracking enabled or disabled. &nbsp;Could you clarify the functional difference between these two actions and how they affect event logging?&nbsp;

michaelsaw · Answer

Hi Naoki san,&nbsp;
"Allow" permits the specified activity without tracking."Monitor" allows tracking and visibility of the permitted activity
Yes. "Allow" can be configured with Event Tracking, as/when required.If "Monitor" with Event Tracking is configured, there may be duplicate events.Here is a link for reference: https://support.catonetworks.com/hc/en-us/articles/13314302436253-Managing-the-Application-Control-PolicyIs this alright?Thank you.

naoki · Answer

Hi michaelsaw,Thanks for getting back to me.In your response, you mentioned:"Allow" permits the specified activity without tracking."Monitor" allows tracking and visibility of the permitted activity.I just want to make sure I understand correctly.When using "Allow," does that mean the activity isn’t tracked at all and won’t show up on the Dashboard?Or is the main difference that with "Allow," tracking can be turned on or off, while "Monitor" always has tracking enabled?Appreciate your help—thanks in advance!&nbsp;

Forum Discussion

What is the difference between App Control Rule "Allow + Tracking: Event Enable" and "Monitor"?

Recent Discussions