This message was deleted.

You can bind a syslog message action to your rewrite/responder policy.

yeh i used something similar for the CVE-2019-19781 exploit i had a audit message action bound to my responder policy so everytime the responder policy was hit it would log it in syslog with the clients IP who was trying to exploit it "AUDIT_MSG_ACTION_ctx267027 - A request to this server " +CLIENT.IP.DST+ " from " + CLIENT.IP.SRC + " was rejected from Responder Policy ctx267027 "

Ok so I need to add a dummy rewrite or responder policy. Or maybe I move the Listen Policy restriction into a responder and add logging at that Point. I‘ll give it a try.