Following a review of firewall logs for traffic generated by malicious activity, how can an administrator confirm that WildFire has identified a virus?

`Traffic logs` show general connection information and would not specifically confirm a WildFire virus detection with the provided filter.

While `Threat logs` are the correct place, the filter `(subtype eq virus)` is less precise than `(subtype eq wildfire-virus)` for confirming a WildFire-specific detection.

WildFire detections of malicious files, specifically viruses, are logged in the `Threat logs` with the specific `subtype` of `wildfire-virus`. Filtering the Threat logs for this subtype provides a direct and accurate method to confirm WildFire's identification of a virus.

`WildFire Submissions logs` show information about files submitted to WildFire, not the actual detection results or confirmations of a virus; those are found in Threat logs.