So after a bit of digging, it appears I have to use the "Firewall Action" log template (https://www.sonicwall.com/support/technical-documentation/docs/sonicos-7.0.1-device_log/Content/Logs_… (View Post)