A responder decides to set a specific Custom IOA to the ' Monitor ' action.

The sensor will block the activity and alert the user with a pop-up.

The sensor will create detections with ' Informational ' severity but will not block the activity.

The sensor will log the activity in the audit logs but will not generate a detection.

The sensor will automatically isolate the host from the network.