> but Suricata on a dedicated firewall box with a PHP interface? What problem is this solving?

Ease of use with out overpaying for the same feature seat. I'm surprised you think there isn't a problem its solving, to be honest.