I don't know. All of the demonstrations I've ever seen have been forensic (after the fact) investigations. They spent a bit of time at the last conference tryin

I don't know. All of the demonstrations I've ever seen have been forensic (after the fact) investigations. They spent a bit of time at the last conference trying to build a case for why their government product would be a great network security tool, but I never saw or heard anything that would indicate it could be used as a real-time tool. Their focus recently seems to be on scale, lots of spin on how they can cluster and use billions of records on commodity hardware, link together installs at different sites, etc. etc. They did a demonstration of and investigation into the housing crash by analyzing millions of mortgage applications, then built aggregate bar charts and heat maps they could drill into a bit. It was "ok". I think if they are serious about penetrating the network security market, they'll need all new technology that can be used in real time. But they seem to already be well regarded in financial fraud as a post event investigation tool.