I was recently asked to advise on a product. The project lead showed me how his tool could take an alert, find the relevant data, and make investigative decisions based on what it found. I gave the tool a Suricata alert to work through. It wasted a lot of effort, sent the analyst down rabbit holes, and failed to resolve the questions that mattered most.