This is a pretty well-detailed page on Protocol Discovery https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/qos_nbar/configuration/xe-3s/Enabling_Protocol_Discovery.html

Hi Dave Larkin,   Try this link for categorized use cases: http://cs.co/StealthwatchValueUseCaseMenu or https://cisco.bravais.com/s/lnmF3Eowwg51t7Rj9DtD   Some of the most commonly used usecases are alerting on rogue/unapproved DNS & DHCP servers.