Log Types

• Traffic—Traffic logs display an entry for the start and end of each session. See Cloud NGFW for Azure Traffic Log Fields for more information.
• Threat—Threat logs display entries when traffic matches one of the Security Profiles attached to a security rule on the firewall. Each entry includes the following information: date and time; type of threat (such as malware or spyware); threat description or URL (Name column); alarm action (such as allow or block); and severity level.
  See Cloud NGFW for Azure Threat Log Fields for more information.

  Severity	Description
  Critical	Serious threats, such as those that affect default installations of widely deployed software, result in root compromise of servers, and the exploit code is widely available to attackers. The attacker usually does not need any special authentication credentials or knowledge about the individual victims and the target does not need to be manipulated into performing any special functions.
  High	Threats that have the ability to become critical but have mitigating factors; for example, they may be difficult to exploit, don’t result in elevated privileges, or don’t have a large victim pool.
  Medium	Minor threats in which impact is minimized, such as DoS attacks that don’t compromise the target or exploits that require an attacker to reside on the same LAN as the victim, affect only nonstandard configurations or obscure applications, or provide very limited access.
  Low	Warning-level threats that have very little impact on an organization's infrastructure. They usually require local or physical system access and may often result in victim privacy or DoS issues and information leakage.
  Informational	Suspicious events that don’t pose an immediate threat, but that are reported to call attention to deeper problems that could possibly exist. URL Filtering log entries are logged as Informational. Log entries with any verdict and an action set to block are logged as Informational.

• Decryption—decryption logs display entries for unsuccessful TLS handshakes by default and can display entries for successful TLS handshakes if you enable them in the decryption policy. If you enable entries for successful handshakes, ensure that you have the system resources (log space) for the logs. See Cloud NGFW for Azure Decryption Log Fields for more information.