Re-architecting our spine‑leaf, I need deeper visibility into east‑west traffic without drowning the SOC. Has anyone run ERSPAN from ToRs into Zeek + Suricata with a light NDR layer (Corelight or open Zeek/VAST) and seen clear gains on lateral movement detection versus simply doubling down on EDR and microsegmentation?