Tracking Options

These tracking options are available for Threat Prevention.

Threat Prevention Track Options

• None - Do not generate an alert.
• Alert - Generate a log and run a command, such as display a popup window, send an email alert or an SNMP trap alert, or run a user-defined script as defined in the Menu > Global Properties > Log and Alert > Alerts.
• Packet Capture - Adds raw IPS, Anti-Virus, Anti-Bot, and Threat Emulation packet data to the Threat Prevention logs. Only blocked packets are added.
• Forensics - (R80.10 gateways and higher) Adds additional fields to the Threat Prevention logs. The extra information gives you a deeper understanding of an attack.

  These are examples of the additional Forensics fields:

DNS Fields	HTTPS Fields	SMTP Fields	FTP Fields
QR (Flag) Opcode (Flag) AA (flag) Rcode (flag) Query Answer Authority info Additional records	Referrer Location User Agent Content type Host File (Content-disposition) Requested with Via Authorization Server Content-length Method Status md5 size	CC BCC Subject Total Attachments Content type File names User Agent md5 Size	File Names User