Yeah licenses sure can be a main but it was the same with PureSecure I believe.

I havent used all the functionality but I have a host agent on a server I have across country and for example I set it up to look for "failed root logins" in the syslog. I could very easliy change that to whatever I want or the file or the threshold so its very configurable.Maybe even too configurable,it would be nice if there was a policy feature where I could click a button to monitor the basic stuff but it does require you to know your server and put in certain parameters.