Application-aware and protocol-aware syslogs

Application-aware and protocol-aware syslogs are a logging mechanism that

generate logs that include application-specific and protocol-specific traffic data,
provide enhanced network visibility through comprehensive data collection, and
use the Snort 3 engine's deep packet inspection capabilities to extract protocol data.

Advanced logging protocols

The Firewall Threat Defense device generates these logs alongside existing connection, intrusion, file, and malware events. As syslogs, you can send these logs to external event management solutions for analysis. When enabled, advanced logging provides a configurable solution for sending these logs from the Firewall Threat Defense device to destination such as Splunk or a syslog alert server.

Advanced logging supports these protocols.

Protocols supported by advanced logging
Protocol	Description
CONN	Logs the data collected from end-of-connection events, including the transport protocol, service protocol, and session duration.
DNS	Logs the data collected from responses to TCP and UDP DNS sessions, including commands, their arguments, response codes, and response messages.
FTP	Logs the commands and data exchanged during an FTP session, including the command and its arguments, response codes, and response messages.
HTTP	Logs the data collected from the HTTP responses, including the HTTP method, header, and status code.
NOTICE	Logs the data collected for intrusion events, including the GID:SID pair, rule messages, and associated references.
WEIRD	Logs the data about anomalies detected in traffic flow.

For more information about application log fields, refer to Advanced Logging Syslog Fields.