@FPAddict ,

Believe it or not, it's currently not possible for us mere end customers.

I've been told it's available in MSP mode (network managed by 3rd party) and that TP-Link is looking at expanding support...

  @EricPerl really? I would consider that one of the most basic capabilities of a router/firewall. 

  @FPAddict ,

You and me both... See:

Logging & Monitoring of ACL rules - Business Community (tp-link.com)

Some of the attack/defense built-in rules generate log entries.

All of but one kind as information about the source...

You get: Router detected TCP SYN-and-FIN packets attack and dropped 1 packets.

The one that contains source information is a "Ping attack" so I now know that I'm attacked by my Ring Camera on the LAN side (LOL).

  @EricPerl What is "MSP mode" that you mentioned?

  @FPAddict ,

Per Controller documentation:

MSP (Managed Service Provider) mode allows you to know the status of your customers at a glance, and manage customers in the Omada platform.

As I understand it, it applies to cases where a 3rd party manages your network.

You can't even enable it with a HW controller. I guess the controller is somewhere in the cloud in that case.