Lately I've had cause to look into methods for doing a deeper analysis of NetFlow and Syslog data. While reports and graphs are good, sometimes you need to do a more exhaustive search than what is available via traditional methods. For instance, what if you suspected you were being attacked from within via some obscure protocol. Now assume that you need to search multiple databases, across several months of time. Being able to conduct a search for both syslog messages and netflow data associated with that port and/or any suspected hosts would be really helpful. There are a couple...