Threat logs contain entries for when network traffic matches one of the security profiles attached to a next-generation firewall security rule.

As network traffic passes through the firewall, it inspects the content contained in the traffic. Whenever this content matches a threat pattern (that is, it presents a pattern suggesting the content is a virus, or spyware, or a known vulnerability in a legitimate application), the firewall will create a Threat log.

The frequency of this pattern matching within a network session is unpredictable. Most often you should see sessions with no Threat logs, followed by sessions with a single Threat log. But it is also possible for sessions to require many Threat logs. Remember that a network session can include multiple messages sent and received between two communicating endpoints. If these messages contain content that matches the firewall's threat patterns, they will cause the firewall to generate multiple threat logs.

See the following for information related to supported log formats: