Hey Tom
Are you knowledgeable on Zeek ??
Noticed that a new Zeek package was available on pfSense, had a browse on their website, if the package is the full blown application then it certainly looks powerful.
Might be an interesting area for a video, though I must admit I need to read up on it.