Dragon Vs. Sourcefire NIDS

[crayola () optonline net]

I have narrowed down my IDS choices to one of these 
two after an exhaustive search of all the major ids players (9 in total). 

I am really on the fence between them both and I am looking for some
insight from people who have these products in their companies. 
I am totally ignoring the cost at this point of each product since I need
the best technical solution (not the cheapest).

Why do you love/hate your sourcefire or dragon IDS at your company? 

Thanks, 
Mike

------------------------------------------------------------------------------------
In my personal opinion their strengths and weaknesses are as follows. 

Dragons strengths: Excellent GUI, very powerful (tons of configuration options), 
supposedly the best detection engine out there, ability to incorporate syslog, firewall logs, etc into the console via 
a HIDS running on a syslog server, decent reporting - especially for execs. 

Dragon Weaknesses: No scheduled reporting, can be very complex to configure. 

Sourcefire Strengths: Builds on open source snort which has an excellent rep and get signatures from the opensource 
community, Scheduled reporting, excellent reporting, Pretty easy to configure, Ability to incorporate Network 
reconsisence info into console via RNA to provide relavence to IDS events. 

Sourcefire weaknesses: Gui is good but not as good as dragons, not as configurable as dragon. 



---------------------------------------------------------------------------

---------------------------------------------------------------------------