Configuration of PHP Expose (PHPIDS) - php

Question

I was looking for a PHP Intrusion Detection System and it seems like
Exposed was a good candidate. The latest
documentation is here.
I am having some problems understanding the installing of Exposed, so here is my question.
Say I want to add this layer of security on a file called users.php, I have read the documentation and my file would then look like this:
<?php
// <EXSPOSED_SNIPPET_LOGIC>
// Enable loader, mocklogger
require 'vendor/autoload.php';
// Initiate Monolog
use Monolog\Logger;
use Monolog\Handler\FirePHPHandler;
ini_set('display_errors', 0);
// The data to filter
$data = array(
'GET' => $_GET,
'POST' => $_POST,
'COOKIE' => $_COOKIE
);
// Load filters
$filters = new \Expose\FilterCollection();
$filters->load();
// Initiate logger
$logger = new Logger('my_logger');
$logger->pushHandler(new StreamHandler(__DIR__.'/__exposed.log', Logger::DEBUG));
$logger->pushHandler(new FirePHPHandler());
// Run tests
$manager = new \Expose\Manager($filters, $logger);
$manager->run($data);
// Define a threatlevel to act upon
$threatlevel = 12;
if( $manager->getImpact() >= $threatlevel ){
// **001**
// We are most likely under attack or atleast we should pay attention
// What do we log here, how do we log it and do we send email to alert?
$reports = $manager->getReports();
print_r($reports);
} else {
// **002**
// Assuming there is normal activity
// Should we log anything here, and if so what?
}
// </EXSPOSED_SNIPPET_LOGIC>
// Here comes the original code belonging to users.php
/* ... */
?>
The code will now write all request to a logfile from the line:
$logger->pushHandler(new StreamHandler(__DIR__.'/__exposed.log', Logger::DEBUG));
Is this needed, this will be a huge amount of data in a short while and can I even use the log for any purposa at a later time?
I also wonder on the Monolog Handler, this line:
use Monolog\Handler\FirePHPHandler;
...
$logger->pushHandler(new FirePHPHandler());
What does this code even do? I cannot see any difference in output to screen with or without it, the logfile also seems identical with or without this.
My main questions are on the lines ** 001 ** AND ** 002 ** in comments, that is, if I have understood the concept correctly hopefully my questions are not missing the target here.
It seems to me that checking the input and when a certain level is triggered, a certrain logging part and tracking should be enabled. Maby this is not part of Exposed? If you have some input on finalizing this integration code I would be very greatful.
Thank you in advance