The facility named "Security (13) - Security-related Events or Errors," as referenced in Table 1 in the below article, captures events and errors directly linked to security. However, specific details or documentation describing this facility are currently unavailable.

https://www.juniper.net/documentation/us/en/software/junos/network-mgmt/topics/topic-map/system-logging.html

The customer configured the following syslog settings on the SRX device, but no logs are being generated:

set system syslog file security-log security any
set system syslog file security-log explicit-priority

Facility security is not used in SRX, and no logs are present in this facility. This unused facility will be removed from the external documentation.

We can generate security logs related to both “the security of the device itself” and “the security functionality that the device offers.” I believe your device can generate logs such as RT_FLOW, Screen etc, which are part of the security functionalities that SRX provides. These logs fall under the facilities LOG_USER and LOG_PFE.

root@SRX> help syslog facility LOG_USER | grep screen 
PFE_SCREEN_MT_CFG_ERROR     LOG_USER             screen config failure
PFE_SCREEN_MT_CFG_EVENT     LOG_USER             screen config
PFE_SCREEN_MT_ZONE_BINDING_ERROR LOG_USER             screen config failure
RT_SCREEN_ICMP          LOG_USER             ICMP attack
RT_SCREEN_ICMP_LS        LOG_USER             ICMP attack
RT_SCREEN_IP           LOG_USER             IP attack
RT_SCREEN_IP_LS         LOG_USER             IP attack
RT_SCREEN_SESSION_LIMIT     LOG_USER             Session limit
RT_SCREEN_SESSION_LIMIT_LS    LOG_USER             Session limit

For logs related to the security of the device itself, such as instances when a user attempts management access via SSH, Telnet, or console and provides incorrect credentials, these are categorized under the LOG_AUTH facility.

In summary, there is no dedicated facility specifically for security-related events in Junos; instead, they are divided across various facilities.

root@SRX> help syslog facility LOG_AUTH | grep login   
LOGIN_ABORTED          LOG_AUTH             Login attempt was cancelled
LOGIN_ATTEMPTS_THRESHOLD     LOG_AUTH             Threshold for unsuccessful authentication attempts reached
LOGIN_FAILED           LOG_AUTH             Login attempt failed
LOGIN_FAILED_LIMIT        LOG_AUTH             Login attempts failed over configured auditable threshold
LOGIN_FAILED_SET_CONTEXT     LOG_AUTH             login could not set context for user
LOGIN_FAILED_SET_LOGIN      LOG_AUTH             login could not set login ID
LOGIN_HOSTNAME_UNRESOLVED    LOG_AUTH             login could not resolve remote hostname
LOGIN_INFORMATION        LOG_AUTH             User was authenticated and logged in
LOGIN_MALFORMED_USER       LOG_AUTH             Username was invalid
LOGIN_PAM_AUTHENTICATION_ERROR  LOG_AUTH             PAM authentication attempt failed