Very interesting. Thanks for your input :)

Yeah that’s kind of what I was originally thinking to do too.

Very cool thanks for the recommendation.

Thanks for your helpful answer.

Do you do all of that on a separate log sever? Or on your firewall? I haven’t found a good way to do that on opnsense that doesn’t feel hacky.

Oh yeah that’s a good idea. Thank you.