I am busy working on a view for my security folks. It dawned on me that with NPM and modules like NTA you can get a 10,000 foot view of your network easily and when something looks odd you can zero in on it and pull the details.
With the bevy of information that Orion can give you after watching the right resources for a few days you can easily baseline "normal" operational parameters and know when something out of the ordinary happens.
This might sound trivial but I think with the current capabilities this is one of the most useful ways to use the product.
So ultimately I think if modules were built or features were added with some security thought processes in mind the product could go a long way to helping that end of the spectrum.
Furthermore something I have asked for in the past I think would help here big time. Which would be the ability to click on a node and get everything that belongs to that node like netflows and alerts, syslog, traps etc you could look at a node and get a great look at whats going on in a single glance.
