For the WLC (wireless) logs are retrieved from various sources like SNMP polling, streaming telemetry, netconf, syslog, netflow and local system logs etc. the good thing is you can use something like a catalyst center to consume these logs and spit out relevant alarms and assurance data, it also has built in wireless intrusion prevention system, which can flag a number of wireless based attacks like deauth flood, honeypot, rouges and many more. I would recommend to start with explore Catalyst center and other logging options listed above, you can also explore wips signatures
-hope this helps-
