It can make a disruptive change to a user, block access to an application, or disconnect critical systems from the network.

It is equivalent to running an IPS in monitor-only mode — watches but does not block.

External threats or attacks detected by FortiSIEM will need user interaction to take action on an already overworked SOC team.

Threat behaviors occurring during the night could take hours to respond to.