I think this would be a tough sell in enterprise environments because the analysis of log data takes time and analysts are likely to say they have enough data f

I think this would be a tough sell in enterprise environments because the analysis of log data takes time and analysts are likely to say they have enough data from their own logs. They would also get stuck on the differences between the honeypot environment and their own network. That said, it would be valuable if I wanted to blacklist certain IP addresses. You may also consider a data sharing service that would provide access to anonymized log data shared among subscribers, this would allow subscribers to get data from real systems. Some vendors market similar services (such as RSA's eFraud Network).