What is a SEM? I've seen Cisco MARS at a demonstration, but it just strikes me as pricey particularly when I know we will not be able to fully leverage its capabilities. I just need something that will analyze firewall logs for now. Will Cisco MARS allow incremental license purchases as needed?

SEM = Security Event Management

SIM = Security Incident Management

STM = Security Threat Management (Cisco Marketing Word)

Cisco MARS is licensed on an EPS basis. EPS means Events per second. You can just go for the smallest model available. It is worth the price IMHO.

In ASA version 8.x there is a feature called threat detection, that might also help you in this regard.

Regards

Farrukh