If you're looking to set up alerting based on netflow my understanding is that you will want to use NTA which is a module of the Orion platform. LEM has some netflow capabilities, but I don't think you can alert or report on them.
Please provide more details about what you're experiencing, your questions about it, and in which product lines you wish assistance.
NTA is a superb resource for Netflow, and if you aren't trying to get the info through CAPWAP tunnels, and if you have NBAR2 enabled on your routers, Netflow and NTA can share a lot of useful information with you team. They can make decisions about what to investigate based on the Netflow data presented through NTA.
