cool man.....
http://www.cisco.com/c/dam/en/us/products/collateral/security/identity-services-engine/at-a-glance-c45-736068.pdf
Nice feature. Puts it on more even footing vs. ForeScout CounterACT, which was doing botnet monitoring via SPAN ports for a while.
Thanks for the link!