RUAG was hacked over a year ago an didn't notice until recently when the intelligence agency informed them. It's a huge scandal here.<p><a href="http://www.swissinfo.ch/eng/ruag-affair_sensitive-personal-information-likely-hacked/42140796" rel="nofollow">http://www.swissinfo.ch/eng/ruag-affair_sensitive-personal-i...</a><p><a href="http://www.blick.ch/news/wirtschaft/beunruhigender-hack-wie-schlimm-war-der-russen-angriff-auf-ruag-id4996353.html" rel="nofollow">http://www.blick.ch/news/wirtschaft/beunruhigender-hack-wie-...</a>
Kentik (<a href="http://www.kentik.com" rel="nofollow">http://www.kentik.com</a>) is doing something very similar, as a cloud-based service or on-prem cluster. Accepts standard flow formats (netflow, sflow, IPFIX) from routers and switches, and also "augmented" flow from nprobe running on hosts or sensors.
fastnetmon is another solution for this
<a href="https://github.com/pavel-odintsov/fastnetmon" rel="nofollow">https://github.com/pavel-odintsov/fastnetmon</a>