A method, comprising: receiving, by each of a plurality of packet security gateways associated with a security policy management server and from the security policy management server, a dynamic security policy that includes at least one rule specifying packet-identification criteria and a packet transformation function comprising a packet digest logging function to be performed on packets corresponding to the packet-identification criteria; receiving, by a packet security gateway of the plurality of packet security gateways, packets associated with a network protected by the packet security gateway; identifying, by the packet security gateway, from amongst the packets associated with the network protected by the packet security gateway, and on a packet-by-packet basis, one or more packets corresponding to the packet-identification criteria; performing, by the packet security gateway and on a packet-by-packet basis, the packet digest logging function on each of the one or more packets corresponding to the packet-identification criteria; and routing, by the packet security gateway and on a packet-by-packet basis, each of the one or more packets corresponding to the packet-identification criteria to a monitoring device in response to the performing the packet digest logging function, wherein the performing the packet digest logging function on each of the one or more packets corresponding to the packet-identification criteria comprises: identifying a subset of information specified by the packet digest logging function for each of the one or more packets corresponding to the packet-identification criteria; and generating, for each of the one or more packets corresponding to the packet-identification criteria, a record comprising the subset of information specified by the packet digest logging function. receiving, by each of a plurality of packet security gateways associated with a security policy management server and from the security policy management server, a dynamic security policy that includes at least one rule specifying packet-identification criteria and a packet transformation function comprising a packet digest logging function to be performed on packets corresponding to the packet-identification criteria; receiving, by a packet security gateway of the plurality of packet security gateways, packets associated with a network protected by the packet security gateway; identifying, by the packet security gateway, from amongst the packets associated with the network protected by the packet security gateway, and on a packet-by-packet basis, one or more packets corresponding to the packet-identification criteria; performing, by the packet security gateway and on a packet-by-packet basis, the packet digest logging function on each of the one or more packets corresponding to the packet-identification criteria; and routing, by the packet security gateway and on a packet-by-packet basis, each of the one or more packets corresponding to the packet-identification criteria to a monitoring device in response to the performing the packet digest logging function, wherein the performing the packet digest logging function on each of the one or more packets corresponding to the packet-identification criteria comprises: identifying a subset of information specified by the packet digest logging function for each of the one or more packets corresponding to the packet-identification criteria; and generating, for each of the one or more packets corresponding to the packet-identification criteria, a record comprising the subset of information specified by the packet digest logging function. identifying a subset of information specified by the packet digest logging function for each of the one or more packets corresponding to the packet-identification criteria; and generating, for each of the one or more packets corresponding to the packet-identification criteria, a record comprising the subset of information specified by the packet digest logging function.