This is a great thread
So yes, we do have an appliance in the works targeted more for business/enterprisey type use. ASL is also Like a SEIM which leads to the next thing:
ASL can be a SEIM now, we call that particular project ASLe (enterprise). While centralized management isnt in place yet, every ASL install out there can act as a client talking to other ASL servers, or as a central server doing event & basic rule management, centralized whitelisting, and shared active response (an attack on one is blocked on all). It can also do agentless monitoring of other devices (routers for example), and even do basic HIDS monitoring on windows systems.
I dont know what we'll call the appliance version... ASL in a Box maybe? Maybe we'll do a naming contest with a prize of a skein of yarn made from the fur of Toki the Support Samoyed (he'll be blowing his coat soon!).
Performance, a lot of things effect that. We've been running benchmarks on what actually effects different design changes make on httpd:viewtopic.php?f=1&t=5576