Traffic vs Threat Logs

[RonaldRichter]

I am searching for the reasons behind the relatively large disparity between traffic logs and threat logs for specified traffic searches in splunk. Redirected sessions cant be a contributed factor when the firewall is set to "log container page only"

[OtakarKlier]

Hello,

The threat logs compliment the traffic logs and have some different fields. Hope that helps.

Regards,

[BPry]

@RonaldRichter,

What exactly are you asking here?

Traffic logs and Threat logs are completely independent of eachother as far as size goes. I might have a single traffic log due to long-running sessions that can generate dozens/hundreds of threats in its lifetime depending on severity. 

[RonaldRichter]

Thanks for the reply. Actually I am seeing the exact opposite, many more traffic logs versus threat.