Send Agent/Appliance events to syslog when they equal or exceed the following severity level: Log Inspection Rules have a severity level. This setting determines which Events triggered by those rules get sent to the syslog server (if syslog is enabled.) (To enable syslog, go to Administration > System Settings > SIEM .)
Store events at the Agent/Appliance for later retrieval by DSM when they equal or exceed the following severity level: This setting determines which Log Inspection Events are kept in the database and displayed in the Log Inspection Events page.