We are an ISP - we look for specific trending data to help pinpoint new potential virus and malware which can adversley effect transit links or equiptment.

Plain IDS data, or netflow data? (I don't doubt the usefulness of flow data.)