It's not impossible, just much harder as it doesn't report that it supports any standard ZigBee Clusters other than 0000 (basic) and 0003 (identity) ..... those two don't do much other than give device information.
FC00 is the manufacturer specific Cluster but unless the device spews out something in the logs then there's nothing to work with (even if it did it would be a slim chance that it matched "something" that looked familiar).
Odd really to choose ZigBee as a protocol and then not use any of the standard Clusters .... their sockets (SP600) are the complete opposite i.e. use totally standard stuff.
You could reach out to the manufacturer and see if they'll divulge the protocol details.
Other than that it would be a case of a ZigBee sniffer and hooking it up to the Salus gateway / devices and decoding the communication to see how it works.
