I've actually looked at a couple of solutions including ArcSight and RSA.  They both have similar capabilities, but the downside to both of these is the cost.  I'm currently testing out a vendor named HAWK Security Network Defense which has the same, if not more custom/correlating capabilities.  One of my friends referred me to them.  So far I've been pleased with their proof of concept, and price wise, they're not event half of what the others cost.  Hope this helps.