Monitor - Use a SPAN or TAP configuration to duplicate network traffic. The files are then sent
directly to Threat Emulation and the computer in the internal network. If Threat Emulation
discovers that a file contains malware, the applicable log action is done. Monitor deployments
support only the Detect action.