Monitor asa firewall logs for deny statements

[tfgroup]

Hello,
Is there a way to monitor firewall logs and report if there is more than 20 deny statements within 30 seconds? This is to respond to DDOS attacks.
Thanks!

[sreinhardt]

You could look at traps that your asa supports, depending on license level last I checked. Another option that would be better suited than XI is to use log server to collect your ASA logs and alert to XI based on that. Enabling the specific firewall logs or all logs should provide this information for you.