I don't see how this would provide any higher level of security than having the logs sent to a separate internal machine. I do that log file scanning on a different machine. All of the log information generated by the firewall is sent to another machine in real time where it is analyzed in both real time and batch modes. Sure the intruder gets into the firewall, but the tracks that need to erased are all on another machine. Sure I keep log files on the firewall, but I don't look at them except to see if what the logger machine has jibes with the firewall or other machines in the network.
Buzzwords are like annoying little flies that deserve to be swatted.
Appreciate any feedback. Let's take this into perspective. That rules out vendor bugs, configuration problems and rogue users. That's not the sum of the measure you want to protect against. While my post says essentially the same thing, it's important to at least look at the problem and decide how much additional protection you gain versus the additional risk you accrue.