Sguil is a great network security tool for permiter or internal network security analysis and reporting. SIM/ESM tools can take in sources outside of tradition network security devices and provide correlation for the enterprise not just the network. The greatest NSM approach weakness is in the need to have a *very skilled analyst* to run the constituent tools. Without properly trained staff, solid process and procedure it doesn’t matter if you have sguil, arcsight, netforensics or smoke signals in your toolbelt.”]
Source: https://taosecurity.blogspot.com/2006/01/in-defense-of-david-bianco-id-like-to.html