Richard Bejtlich, from taosecurity, posted two interesting blog entries, where he mentions some ossec alerts.
He says that he got some ossec log alerts, but lacked more information regarding what do you with them. I agree with his assessment, where he used Sguil to get more network-based details to see what happened during that time. However, in addition of using a network sensor, he could have setup a log server, where he would be able to do a great deal of analysis with his log data (without ever touching the affected system).
Using firewall logs, for example, he would be able to see all connections during that time from that IP address. Looking at authentication messages from all his systems, he would be able to see if that IP was ever able to connect remotely, or if it ever accessed any other service (like http or his mail server, etc).
What am I trying to say here? Well, as I said before, I just want to point that Network Security Monitoring (NSM) along with log analysis can provide much more visibility than any of this two alone.