Idea:
Link IPS and Malware events in reports to a online database with a description of the event if available.

Reason:
It's always a lot of work to find out the reason of IPS events as "SHELLCODE x86 inc ecx NOOP" or to find a description of a Virus like "HTML/Infected.WebPage.Gen"

Benefit:
It would easen administrators life to easily find out, which behaviour the security events triggered or what they even mean.