Using System Logs to Identify Security Risks

I am currently streaming logs onto a syslog server and would like to come up with a series of programmed alerts to identify potential security risks. But it's not always clear how to use the log fields to come up with these alerts. Has anyone done this exercise before and can provide some more info on which fields can be used in which ways to identify potential security risks?

*For example*, the authz-audit.csv log records information about the authorization of already authenticated users within the system. I could check the Decision field to see if someone was DENIED access to a certain uri (Action Target and Action Name fields), but (a) it's hard to understand some of the info within the fields and (b) it's unclear how to distinguish a legitimate denial from a potential security threat. Any ideas would be much appreciated.

FWIW, I'm currently grabbing the Streaming logs and have already looked through the Logging Documenation.