Enum SecurityResult.Types.Action
Enum representing different possible actions taken by the product that created the event. Google SecOps classifies:
- ALLOW and ALLOW_WITH_MODIFICATION actions as "successful".
- BLOCK, QUARANTINE, FAIL, and CHALLENGE actions as "failed". This includes all corresponding metrics (for example, AUTH_ATTEMPTS_FAIL, FILE_EXECUTIONS_FAIL, RESOURCE_READ_FAIL, and so on).
- UNKNOWN_ACTION actions as neither "successful" nor "failed", because, for example, logs might not provide information whether a login event occurred but some kind of "unknown" error was issued nonetheless.
Namespace: Google.Backstory
Assembly: Google.Backstory.dll
Syntax
public enum SecurityResult.Types.ActionFields
| Name | Description |
|---|---|
| Allow | Allowed. |
| AllowWithModification | Strip, modify something (e.g. File or email was disinfected or rewritten and still forwarded). |
| Block | Blocked. |
| Challenge | Challenged (e.g. the user was challenged by a Captcha, 2FA). |
| Fail | Failed (e.g. the event was allowed but failed). |
| Quarantine | Put somewhere for later analysis (does NOT imply block). |
| UnknownAction | The default action. |