1. SCI: Which logs are you specifically referring to? SCI retains AP, user, client and traffic data. Te retention period can be set from 1 month to 5 years. It does not retain syslog information. You'd need to set up an external syslog server and configure the SZ/APs to send syslog information to that.
2. SCI: In the 'Data Explorer' you can view rogue AP historical/current data.
3. SZ: SZ contains a Rogue AP Detection feature. It is not a full-blown IDS/IPS, but classifies Rogues and generates reports. See the User Guides' section 'Rogue Access Points' for more information.
Regards
James