When you provide an Attack Report one would suspect a content. I my environment we use a Cisco FWSM blade firewall and we have about 3.000.000 event per day. Some of these event have to be a part of an attach.
How do you define attack to be presented in your report?
Ex. Would a server port scanning another server thru the firewall be considered an attack.