If unifi supports syslog, then yes (I think it does but I don’t have it set up personally)

Splunk. The search tool is great, but has a bit of a learning curve to get it set up right. Watch some vids and you’ll be fine.

I only point a few devices at it and have been able to slide by with the free version for awhile now.

You’ll probably want to do it by dns name

This for personal accounts right? Or are they thinking of workspace accounts as well?

Yes, but also [email protected] has a tonnnnn of activity

Yeah, I’ve sent one to like, limestone network maybe? Or some other similar host. They responded within a few hours and the scans stopped from their IPs for a long time. Just provide logs of whatever you see. The NOC will be able to confirm or deny pretty quickly and take appropriate action.