When I first started out in network security, fresh out of college and eager to make my mark, I vividly remember a frantic Monday morning. Our company had just been hit by a seemingly new type of malware, slipping past our aging perimeter defenses. My boss, old-school but sharp as a tack, pointed a finger at me and asked, “Son, what exactly *is* protecting us from these kinds of intrusions? Isn’t our firewall supposed to handle this?” It was a fair question, one that echoed the fundamental confusion many folks have about the evolving roles of security tools. Fast forward to today, and that same question, albeit with more sophisticated tools, often resurfaces. Particularly with a powerhouse like the Palo Alto Networks firewall, a common query I get from fellow engineers and even seasoned CISOs is this: “Is a Palo Alto firewall an Intrusion Prevention System (IPS)?”
Let’s cut right to the chase, so Google can grab this answer clean: Yes, a Palo Alto Networks Next-Generation Firewall (NGFW) absolutely includes robust Intrusion Prevention System (IPS) capabilities, and frankly, it often goes above and beyond what a standalone, traditional IPS might offer. It’s not just a firewall *and* an IPS; it’s an integrated, holistic security platform where IPS functionality is a core, tightly interwoven component of its next-generation architecture. Think of it less as two separate tools bolted together, and more like a high-performance sports car that comes standard with a top-tier anti-lock braking system – it’s built right in, optimized to work seamlessly with everything else.
Understanding the Foundation: Firewalls and IPS – The Old Guard
To truly appreciate what a Palo Alto firewall brings to the table, we ought to take a quick stroll down memory lane and understand the individual roles of firewalls and IPS devices as they traditionally existed. This historical context is vital because it explains *why* the lines got so blurry and why an NGFW is such a game-changer.
What is a Firewall? The Digital Bouncer
At its heart, a firewall is like a digital bouncer at the club entrance, deciding who gets in and who doesn’t. Its primary job has always been to control network traffic based on predefined rules.
* Traditional Firewalls: These were primarily packet filters. They looked at basic network headers—source IP, destination IP, port number, and protocol—and made a “permit” or “deny” decision. They were fantastic at stateful inspection, meaning they could track the state of a connection to ensure that only legitimate return traffic was allowed back in. They were crucial for establishing network segmentation and keeping unwanted external traffic out of internal networks. They built that foundational perimeter defense.
* Limitations: While essential, traditional firewalls were relatively “dumb” about what was *inside* the allowed packets. If port 80 (HTTP) was open, any HTTP traffic, malicious or benign, could flow through. They had no real understanding of applications, users, or the content itself. This led to a significant blind spot as attackers began to exploit legitimate applications and ports.
What is an Intrusion Prevention System (IPS)? The Digital Detective and Enforcer
An IPS, on the other hand, arrived on the scene to address these blind spots. If a firewall is the bouncer, an IPS is more like an undercover detective and a security guard rolled into one. It actively monitors network traffic for malicious activity and, crucially, can *block* or *prevent* that activity in real-time.
* Detection Methods:
- Signature-Based Detection: This is the most common method. The IPS maintains a vast database of known attack signatures—specific patterns of bytes, packet sequences, or traffic flows that indicate an exploit, malware, or vulnerability attempt. When traffic matches a signature, the IPS flags it. Think of it like a mugshot database for known criminals.
- Anomaly-Based Detection: This method involves building a baseline of “normal” network behavior (e.g., typical bandwidth usage, protocol usage, login patterns). Anything deviating significantly from this baseline is flagged as an anomaly. This is effective against zero-day threats (previously unknown attacks) because it doesn’t rely on known signatures. It’s like spotting someone acting suspiciously in a crowd, even if you don’t know their face.
- Policy-Based Detection: This involves enforcing security policies defined by administrators, such as blocking specific applications, protocols, or content types known to be risky.
* Prevention Capabilities: Unlike an Intrusion Detection System (IDS), which only alerts, an IPS sits inline with the traffic flow and can actively:
- Drop malicious packets.
- Reset connections.
- Block source IP addresses.
- Reconfigure other security devices (though less common in basic IPS).
* The “Problem”: While incredibly powerful, standalone IPS devices added complexity, another box to manage, and could sometimes introduce latency or become a single point of failure. Plus, they were often blind to encrypted traffic unless paired with a separate decryption solution.
Palo Alto Networks: A Next-Generation Powerhouse
This brings us to Palo Alto Networks, a company that pretty much defined the “Next-Generation Firewall” category. The advent of NGFWs was a direct response to the limitations of traditional firewalls and the challenges of managing disparate security tools. The goal was to converge multiple security functions into a single, high-performance platform.
The Evolution to Next-Generation Firewalls (NGFW)
NGFWs are fundamentally different because they move beyond simply looking at IP addresses and ports. They provide granular control and visibility at the application, user, and content level. This deeper context is what makes their integrated IPS capabilities so potent.
Key Pillars of Palo Alto NGFW
The Palo Alto platform is built on several foundational technologies that enable its advanced capabilities, including its IPS functions:
* App-ID: This is arguably the crown jewel. Instead of just seeing “Port 80,” App-ID can identify thousands of applications, regardless of port, protocol, evasive tactics, or encryption. It can tell you if that “Port 80” traffic is actually Facebook, SharePoint, or even a custom database application. This application awareness is critical for effective IPS.
* User-ID: Security isn’t just about what’s happening, but *who* is doing it. User-ID integrates with directory services (like Active Directory) to identify users and groups, tying network activity directly to individuals rather than just IP addresses. This allows for user-specific security policies, a huge leap forward for IPS effectiveness.
* Content-ID: This component inspects traffic for threats and sensitive data. It’s where the traditional IPS functions truly shine, augmented by the context provided by App-ID and User-ID. It performs antivirus, anti-spyware, vulnerability protection, and even data filtering.
* Threat Prevention: This is the umbrella term for the subscription-based services that power Palo Alto’s advanced security features, including its comprehensive IPS signatures, anti-malware, and more.
Palo Alto’s IPS Capabilities in Detail: Beyond the Basics
When we talk about a Palo Alto firewall being an IPS, we’re not just talking about a watered-down version. We’re discussing a full-fledged, highly effective intrusion prevention system that benefits immensely from its integration into the NGFW platform.
Signature-Based IPS: The Bread and Butter
Just like traditional IPS devices, Palo Alto firewalls leverage extensive signature databases to detect known threats.
* Vulnerability Protection: This is a core IPS function. Palo Alto maintains an enormous and constantly updated database of signatures for known vulnerabilities in operating systems, applications, and network protocols. When an attacker attempts to exploit one of these vulnerabilities (e.g., using a specific sequence of packets to trigger a buffer overflow), the firewall identifies the signature and blocks the attempt. This is crucial for stopping exploits that might otherwise lead to system compromise.
* Anti-Spyware Signatures: While often thought of as an antivirus function, anti-spyware within the Threat Prevention suite acts as an IPS for command-and-control (C2) traffic. It detects and blocks attempts by compromised hosts to communicate with malicious C2 servers, which is a hallmark of spyware, botnets, and other advanced persistent threats.
* DoS and DDoS Protection: Palo Alto firewalls include robust mechanisms to detect and prevent various denial-of-service (DoS) and distributed denial-of-service (DDoS) attacks. These aren’t always signature-based in the traditional sense but rather rely on thresholding and behavioral analysis to identify overwhelming traffic floods or specific attack patterns aimed at disrupting service. This capability prevents intrusions that aim to degrade or take down services.
Anomaly-Based/Behavioral IPS: Catching the Unknown
While signatures are great for known threats, the real world throws new curveballs every day. Palo Alto’s IPS capabilities extend to behavioral analysis to catch threats that don’t yet have a signature.
* WildFire Integration (Zero-day Protection): This is a massive differentiator. WildFire is Palo Alto’s cloud-based threat intelligence and analysis service. When the firewall encounters an unknown file or suspicious stream, it can forward it to WildFire for deep analysis in a virtual sandbox environment. WildFire detonates the sample, observes its behavior (e.g., does it try to modify system files, connect to unusual IPs?), and then quickly generates new signatures if malicious behavior is detected. These new signatures are then pushed out to all Palo Alto firewalls globally, often within minutes. This means Palo Alto’s IPS is constantly learning and protecting against zero-day threats before traditional signature updates from other vendors might even exist. I’ve personally seen WildFire catch brand-new ransomware variants that bypassed other security layers, turning a potential disaster into a mere blip.
* Threat Intelligence Feeds: The firewall consumes threat intelligence from various sources, including WildFire, Unit 42 (Palo Alto’s threat research team), and third-party feeds. This intelligence is used to dynamically update its understanding of malicious IP addresses, URLs, and domains, adding another layer of proactive prevention.
Inline vs. Promiscuous Mode: Palo Alto’s Inline Enforcement
Traditional IPS devices sometimes operated in “promiscuous mode” (monitoring only), or “inline mode” (actively blocking). Palo Alto’s NGFW, by design, operates inline. This is a critical distinction. It means that the IPS capabilities are *always* in the path of the traffic, inspecting every packet as it passes through, and capable of immediately preventing detected intrusions. There’s no separate box to plumb in; it’s all part of the firewall’s core function.
Beyond Traditional IPS: The “Next-Gen” Advantage
Where Palo Alto truly shines is how its IPS capabilities are elevated by the other NGFW functions. This contextual awareness makes its prevention far more intelligent and effective than a standalone IPS.
Application-Aware IPS: Understanding Context
Imagine an old-school IPS seeing a port 80 connection and detecting a known web exploit signature. It blocks it. Great! But what if that same exploit was embedded within a legitimate application’s traffic, perhaps over a non-standard port? A traditional IPS might miss it.
Palo Alto, with App-ID, first identifies the *actual application*. Let’s say it’s an exploit targeting a specific version of SQL Server. If App-ID identifies the traffic as Microsoft SQL, and Content-ID (the IPS engine) detects a SQL injection attempt, it’s a direct hit. But if that same exploit signature is seen on a connection identified as Facebook, the firewall understands the context and might treat it differently or simply drop it as nonsensical. This deep application context drastically reduces false positives and improves the accuracy of threat detection. It’s like knowing not just what someone is saying, but *who* they’re saying it to and *in what language*.
User-Aware IPS: Policies Based on Who, Not Just Where
User-ID allows security policies and IPS profiles to be applied based on individual users or groups. This is profound. Instead of applying a blanket IPS policy to an entire IP subnet, you can have more stringent IPS profiles for privileged users or users in high-risk departments, and perhaps slightly more lenient (but still secure) profiles for others. If a specific user account is compromised, the firewall can instantly apply stricter IPS measures to traffic originating from that user, regardless of which device they are on. This adds a crucial layer of granular control to intrusion prevention.
Integrated Threat Intelligence: Global Insights
Palo Alto’s IPS is constantly fed by a global threat intelligence network. Every attack detected by any Palo Alto firewall customer (who opts in, of course) contributes to the collective knowledge base. This means if a new exploit is discovered in Asia, the signatures for it can be pushed out globally, protecting you in America within minutes. This crowdsourced intelligence is a massive advantage over standalone IPS solutions that might rely on slower, less comprehensive updates. It’s like having eyes and ears all over the world, reporting back to your local security guard in real-time.
Single-Pass Architecture: Efficiency and Performance
One of the engineering marvels of Palo Alto firewalls is their single-pass parallel processing (SP3) architecture. In many traditional security stacks, traffic goes through a firewall, then an IPS, then maybe an antivirus scanner – each inspecting the same packet multiple times, leading to latency. Palo Alto’s architecture inspects traffic for all threats (App-ID, User-ID, Content-ID, IPS, Anti-Malware, URL Filtering, etc.) in a single pass, simultaneously. This design dramatically improves performance and reduces latency, making it ideal for high-throughput environments where performance is critical. It means you’re not sacrificing speed for comprehensive security.
Why the Confusion? Distinguishing Roles and Overlap
Given all this, why do people still ask if a Palo Alto firewall is an IPS? I reckon it comes down to a few key points:
* Historical Context: For decades, firewalls and IPS were distinct product categories sold by different vendors. You bought a firewall from Company A and an IPS from Company B. The mental model stuck.
* Vendor Marketing: While Palo Alto calls itself an NGFW, some still view it through the lens of a traditional firewall with “add-on” security features. However, the integration is so deep that “add-on” doesn’t do it justice.
* Licensing Structure: The advanced IPS capabilities often come as part of a “Threat Prevention” subscription, which can sometimes give the impression they are separate modules rather than core, integrated functions. But they are managed and enforced from the same centralized policy engine.
The truth is, Palo Alto Networks has brilliantly blurred the lines. They haven’t just put an IPS *next to* a firewall; they’ve fundamentally redesigned the firewall to *incorporate* and *enhance* IPS capabilities as an intrinsic part of its operation. It’s not just a firewall *and* an IPS, but rather a firewall that *is* an IPS (among many other things).
Implementing Palo Alto’s IPS Features: A Practical Guide
From my time in the trenches, I can tell you that deploying Palo Alto’s IPS features isn’t just about flipping a switch. It requires a thoughtful approach. Here’s a rundown of how you typically get these powerful prevention capabilities up and running:
1. Licensing and Updates:
* Acquire Threat Prevention License: Ensure your Palo Alto firewall has the active Threat Prevention subscription. This is what unlocks the IPS signatures, anti-spyware, and vulnerability protection.
* Update Threat Signatures: Regularly update the firewall’s threat intelligence and signature databases. This is typically automated, but it’s crucial to verify that updates are pulling down correctly and frequently (daily, or even hourly for WildFire updates).
2. Policy Creation and Application:
* Security Policies: Define your base security policies (e.g., allow web browsing, block peer-to-peer applications). These policies are where you tell the firewall *what traffic to inspect*.
* Threat Prevention Profiles: Create or customize Threat Prevention profiles. These profiles define *how* the IPS engine should react to detected threats.
- Vulnerability Protection Profile: Configure rules to block known exploits. You can set actions like “block,” “reset-client,” “reset-server,” or “alert.” My advice is always to start with “reset-both” or “block” for high-severity threats.
- Anti-Spyware Profile: Define actions for detected command-and-control (C2) traffic. Again, “block” or “reset-both” are your best friends here.
- Anti-Virus Profile: While separate, it complements IPS by scanning for known malware files.
- WildFire Analysis Profile: Ensure files of interest (executables, PDFs, office documents) are forwarded to WildFire for cloud-based sandboxing and zero-day detection.
* Attach Profiles to Security Rules: This is key! You must attach your configured Threat Prevention profiles to your security policy rules. For instance, any “Allow” rule for outbound internet traffic should absolutely have a robust Threat Prevention profile applied. Without this, the traffic won’t be inspected by the IPS engine.
3. Decryption Policy (Crucial for HTTPS/SSL):
* Configure SSL Decryption: A massive amount of modern traffic is encrypted (HTTPS, SSL/TLS). If you don’t decrypt this traffic, your IPS capabilities will be severely hampered, as the firewall can’t see inside the encrypted tunnel. This requires careful planning for certificate deployment and handling privacy concerns. In my experience, skipping decryption is like buying a bulletproof vest but leaving your back exposed.
* Decryption Policy Rules: Define which traffic to decrypt (e.g., most outbound web traffic) and which to exclude (e.g., financial, healthcare, or privacy-sensitive applications).
4. Monitoring and Tuning:
* Log Review: Regularly check your firewall’s threat logs. This is where you’ll see IPS detections, blocked attacks, and any potential false positives.
* Reporting: Leverage Palo Alto’s extensive reporting capabilities to visualize threat trends and IPS effectiveness.
* Tuning: Be prepared to tune your IPS profiles. Sometimes, legitimate applications might trigger a false positive, especially with new signatures or custom software. You might need to create exceptions or adjust signature thresholds, but always with extreme caution. Start with aggressive blocking for high-severity threats and temper it only if necessary.
5. Integration with Other Security Tools:
* Consider integrating the firewall with your Security Information and Event Management (SIEM) system for centralized logging and correlation of security events. This extends the value of your IPS detections.
Benefits of an Integrated Solution like Palo Alto
From a practical perspective, having a Palo Alto firewall that inherently *is* an IPS offers a slew of advantages:
* Simplified Management: One console, one policy engine, one set of rules. No more juggling different interfaces, update schedules, or configurations for separate firewall and IPS devices. This frees up precious time for my team, letting them focus on actual threats rather than tool maintenance.
* Improved Performance: As discussed with the SP3 architecture, inspecting everything in a single pass means less latency and better throughput, crucial for modern, high-bandwidth networks.
* Enhanced Security Posture: The contextual awareness from App-ID and User-ID, combined with WildFire’s zero-day protection, means a more intelligent, accurate, and proactive defense against a broader range of threats. You’re not just blocking known bad stuff; you’re *preventing* unknown bad stuff too.
* Cost Savings: While the initial investment might seem higher than a basic firewall, considering the cost of a separate, high-end IPS, plus the management overhead, power, and rack space, an integrated NGFW often proves to be more cost-effective in the long run.
* Better Visibility: All security events are correlated within the same platform, providing a clearer picture of your overall security landscape. This helps immensely during incident response.
Potential Challenges and Considerations
No technology is a silver bullet, and while Palo Alto’s integrated IPS is phenomenal, there are considerations to keep in mind:
* Complexity: While simplified *relative* to managing separate devices, a Palo Alto NGFW is a sophisticated piece of kit. Harnessing its full power requires deep understanding and proper configuration. It’s not a “set it and forget it” solution.
* Resource Requirements: Enabling all the advanced features, especially decryption and WildFire forwarding, requires significant processing power. Ensure you size your appliance correctly for your network’s throughput and expected load. Undersizing can lead to performance bottlenecks.
* Subscription Costs: The advanced threat prevention features, including the robust IPS signatures and WildFire, are subscription-based. These recurring costs need to be factored into the budget, but in my opinion, they are well worth the investment given the protection they provide.
* Tuning and False Positives: While Palo Alto’s IPS is highly accurate, any intrusion prevention system can generate false positives, especially in unique network environments or with custom applications. Careful tuning and monitoring are essential to minimize disruption while maintaining strong security.
* Decryption Overhead: SSL decryption is vital for deep inspection, but it adds processing overhead and requires careful management of certificates and policy exceptions. It’s a non-negotiable step for comprehensive IPS, but it’s not without its challenges.
Conclusion
So, back to that initial question, “Is a Palo Alto firewall an IPS?” The unequivocal answer is: Yes, and it’s a remarkably advanced one, seamlessly integrated into a next-generation firewall platform that provides unparalleled context and prevention capabilities. It’s not just passively detecting; it’s actively stopping threats at multiple layers, leveraging application and user awareness, deep content inspection, and real-time global threat intelligence. For any organization serious about robust, holistic cybersecurity, understanding this integrated approach is paramount. It’s the difference between having separate locks and alarms on your doors and windows, and having a smart home security system that actively monitors, identifies, and neutralizes threats before they even get a foot in the door. From where I stand, having worked with countless security products over the years, the Palo Alto NGFW stands as a testament to converged security done right.
Frequently Asked Questions
Is a Palo Alto firewall enough to replace a dedicated IPS?
In most modern enterprise scenarios, yes, a Palo Alto Networks NGFW with the Threat Prevention subscription is more than capable of replacing a dedicated, standalone IPS. In fact, it often provides superior protection due to its deep integration with App-ID, User-ID, and WildFire.
Traditional IPS devices, while effective at their specific task, typically lack the application, user, and content context that an NGFW brings. The Palo Alto firewall can inspect traffic with a far greater understanding of what is actually happening on the network, leading to more accurate threat detection and fewer false positives. Consolidating these functions into a single platform also simplifies management, reduces latency, and often results in a lower total cost of ownership compared to deploying and managing separate appliances.
How does Palo Alto handle zero-day threats compared to a traditional IPS?
Palo Alto’s approach to zero-day threats is significantly more robust than most traditional IPS solutions, primarily through its WildFire cloud-based threat intelligence service. While a traditional IPS relies heavily on signature updates for known threats, WildFire excels at identifying and preventing entirely new, unknown malware and exploits.
When the Palo Alto firewall encounters a suspicious, unknown file or object, it can be automatically submitted to WildFire. WildFire executes these samples in a secure, virtualized environment (a sandbox), observes their behavior (e.g., does it try to encrypt files, contact suspicious IPs, modify system settings?), and quickly determines if they are malicious. If a threat is confirmed, WildFire immediately generates new signatures and pushes them out globally to all subscribed Palo Alto firewalls, often within minutes. This proactive, behavioral-based detection and rapid signature deployment capability provides a critical defense against zero-day attacks that traditional signature-based IPS devices would initially miss.
What’s the difference between a Palo Alto firewall’s IPS features and its Antivirus profiles?
While both IPS features (part of Threat Prevention) and Antivirus profiles aim to prevent malicious activity, they target different types of threats and operate at slightly different levels of inspection within the Palo Alto framework. They are complementary, not redundant.
IPS Features (Vulnerability Protection, Anti-Spyware): These primarily focus on preventing exploitation attempts against vulnerabilities (Vulnerability Protection) and blocking command-and-control (C2) communication from already compromised hosts (Anti-Spyware). IPS operates by looking for specific patterns (signatures) in network traffic that indicate an attack or exploit payload, or malicious communication attempts. It’s about stopping the *attack itself* or the *exfiltration/control* of an infected machine.
Antivirus Profiles: These are specifically designed to detect and block known malware files (viruses, worms, Trojans, ransomware executables) as they traverse the network, typically when they are being downloaded or transferred. Antivirus inspects file content for known malware signatures or heuristics. It’s about stopping the *malware file itself* from entering or spreading within your network. While IPS might block the exploit that *delivers* a virus, Antivirus would block the *virus file* if it gets through.
Can Palo Alto’s IPS detect encrypted threats?
Yes, absolutely, but with a critical caveat: only if SSL/TLS decryption is enabled and properly configured. A vast majority of internet traffic today is encrypted (HTTPS, SMTPS, etc.), which means that without decryption, any security device, including an IPS, is essentially blind to the content within those encrypted tunnels.
When SSL/TLS decryption is enabled on a Palo Alto firewall, it acts as a man-in-the-middle, decrypting the traffic, performing deep inspection with its IPS and other threat prevention engines, and then re-encrypting it before sending it to its destination. This allows the IPS to inspect the actual payload for exploits, malware, and C2 communications that would otherwise be hidden. Without decryption, the IPS can only see the encrypted handshake and metadata, severely limiting its ability to detect threats within the encrypted stream. Therefore, for comprehensive IPS protection, implementing a robust decryption policy is non-negotiable.
How does WildFire contribute to Palo Alto’s IPS capabilities?
WildFire is a cornerstone of Palo Alto’s advanced IPS capabilities, especially in defending against zero-day threats. It significantly enhances the IPS by providing real-time, dynamic threat intelligence and new signature generation.
When the firewall’s IPS engine (or other components) identifies a suspicious file or unknown piece of code in network traffic, it can automatically submit that sample to the WildFire cloud. WildFire then detonates the sample in a virtual sandboxing environment, observes its behavior, and extracts indicators of compromise (IOCs). If the sample is deemed malicious, WildFire rapidly generates new threat signatures (for IPS, antivirus, anti-spyware, etc.) and propagates them globally to all subscribed Palo Alto firewalls, often within minutes. This means that your IPS gains protection against brand-new, previously unknown threats almost immediately, without waiting for traditional, scheduled signature updates. This proactive, community-driven threat intelligence makes Palo Alto’s IPS far more agile and effective against evolving cyber threats.
Is an IPS profile always active on a Palo Alto firewall?
No, an IPS profile (specifically, a Threat Prevention profile which includes vulnerability protection and anti-spyware) is not *always* active by default on all traffic flowing through a Palo Alto firewall. Its activation is explicitly controlled by the security policies you configure.
To enable the IPS features, you must create or select a Threat Prevention profile and then attach that profile to specific Security Policy rules. Only the traffic that matches those specific security rules will then be subjected to the inspection defined in the attached Threat Prevention profile. This granular control allows administrators to apply different levels of IPS scrutiny to different types of traffic, users, or applications. For example, outbound web traffic might have a highly aggressive IPS profile, while internal server-to-server communication might have a more tailored one. So, while the *capability* is always present, the *enforcement* is policy-driven.
Does Palo Alto offer both passive and active IPS capabilities?
Palo Alto Networks firewalls are primarily designed for active (inline) IPS capabilities. This means they sit directly in the path of network traffic and actively prevent intrusions by blocking, dropping, or resetting malicious connections in real-time. This is their core strength and how they achieve true prevention.
While their primary mode is active, they do incorporate elements that could be considered ‘passive’ in the sense of ‘detection and logging’ without immediate blocking if explicitly configured. For instance, you can configure IPS signatures to simply ‘alert’ rather than ‘block’ for certain lower-severity threats, effectively making it function more like an IDS (Intrusion Detection System) for those specific patterns. However, the architecture is fundamentally built for inline prevention. Furthermore, the logging and reporting features allow for extensive passive monitoring of network activity and detected threats, providing a comprehensive audit trail even for actions that were actively prevented. So, while the default and recommended operation is active prevention, the granularity of control allows for more passive detection where desired.
