Where do we start? I guess the the benefits really happen if you have other cisco products.
For instance, if you are running Cisco Security Agent as well, you'll be able to do some event correlation by setting up the CSAMC to communication with the IPS. This gives a good visual for traffic making it through the IPS. When the agent fires an alert, it communicates that back to the sensor. The sensor then increases a score for the source address. That of course increases the chances of it being blocked.
Anomaly detection is also a big thing. This detects actions between networks, as long as they flow through the IPS, for "suspicious" activity. Things such as scanning or multiple connections. There is a good presentation on this that cisco has done. It explains how the metrics work as well as setting up the learning mode.
What I think is a very nice feature is the possibility of multiple virtual interfaces. You can create a vast array of custom setups to apply in various situations.
You can write a book about all of this, which is why many people just post links. Its easier and a lot more resourceful. But, I hope this assists you. OH, I'm sure I've left items here and there out. But, you get the idea.
