> What are people doing with these things?

With Suricata, or with pfSense?

Suricata is used when you want to block internal clients that do something suspicious (like join a botnet), or to notice something unwanted (like using a banned application, such as dropbox).