Reading through your article I get the sense that I may need two products. Flow tool to give me "know what and where to query" and PCAP for detailed analysis.

There is a middle ground here with tools that capture metadata from network packets. An example would be a tool that can report on the flow data going between a client and file server but also provides the drilldown to see the names of the files accessed.

The two tool approach can sometimes scare people off as it adds complexity and costs.