Great blog John - glad to hear of the success with Sourcefire! Are you deploying it for inline protection, or passively? Also, would enjoy hearing about economies (labor savings) you derive from correlating events with host vulnerabilities and user identities and automating impact assessment, tuning, and triage.