One good thing about an IDS that I like. The fingerprinting so to speak of the perpertrator. If the firewall just logged the attack well you may have an IP. So what, we all know thats useless...