Prerequisites

Ensure that you are running management center 7.2.0 or later and that the managed threat defense is also 7.2.0 or later.

Only enabling elephant flow detection does not generate additional connection events. Elephant flow detection adds the Elephant Flow notation to matching connections that are already being logged to the management center. To log these events, you must enable connection logging in your access control policy. You can do that for specific rules or add a Monitor rule that logs all connections, including elephant flows.