Enum representing different possible actions taken by the product that created the event. Google SecOps classifies: - ALLOW and ALLOW_WITH_MODIFICATION actions as "successful". - BLOCK, QUARANTINE, FAIL, and CHALLENGE actions as "failed". This includes all corresponding metrics (for example, AUTH_ATTEMPTS_FAIL, FILE_EXECUTIONS_FAIL, RESOURCE_READ_FAIL, and so on). - UNKNOWN_ACTION actions as neither "successful" nor "failed", because, for example, logs might not provide information whether a login event occurred but some kind of "unknown" error was issued nonetheless.
| Enums | |
|---|---|
UNKNOWN_ACTION
|
The default action. |
ALLOW
|
Allowed. |
BLOCK
|
Blocked. |
ALLOW_WITH_MODIFICATION
|
Strip, modify something (e.g. File or email was disinfected or rewritten and still forwarded). |
QUARANTINE
|
Put somewhere for later analysis (does NOT imply block). |
FAIL
|
Failed (e.g. the event was allowed but failed). |
CHALLENGE
|
Challenged (e.g. the user was challenged by a Captcha, 2FA). |
