How is Cisco Umbrella configured to log only security events?

In Cisco Umbrella, logging options, including the ability to log only security events, are configured per policy. This allows administrators to apply different logging levels and types to various identities (e.g., networks, roaming users, internal networks) by associating them with specific policies that define these logging settings.

Reporting settings primarily deal with how collected log data is displayed, aggregated, or exported, rather than defining which specific types of events are logged in the first place.

The Security Settings section defines the actual security protections applied (e.g., blocking malware, phishing detection), but the logging of events triggered by these settings is managed within the policy's logging configuration, not directly in the security settings themselves.

The Deployments section is used to configure and register networks with Umbrella, but the detailed logging preferences for those networks are typically inherited from or specified within the security policies applied to them, not directly on the network object.