Netflow

i feel MARS is excellent at correlating events to find the culprits with less digging.

-kuperstock

They really aren't competing products.  MARS is a security product and uses NetFlow as one part of gathering information.  MARS is more about gathering info from different systems and correlating events and data so that action can be taken - potentially automated action at that.

NTA is going to give you a view into what's going on with your network, but you're right that NetFlow alone is often not enough as it often takes more intelligence for the tool to understand certain types of traffic to be a specific application.  The best tools I've seen for this are actually in the QoS/Bandwidth Optimization space.  Tools such as Packeteer's Packetshaper do a great job of identifying and quantifying application traffic.

We have Cisco Mars implemented in our environment and frequently root out peer to peer and other spyware type activity. While the product is a powerful correlation tool, something its not is... user friendly..

I have both devices, the MARS box we use for security and high level eval of our network, but what we have found over time is that it does not offer some of the finer details we wanted to see. The Netflow does that with a considerably less cost than the MARS box, both are great tools if used correctly.