This is a pretty well-detailed page on Protocol Discovery
https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/qos_nbar/configuration/xe-3s/Enabling_Protocol_Discovery.html
Hi Dave Larkin,
Try this link for categorized use cases:
http://cs.co/StealthwatchValueUseCaseMenu
or
https://cisco.bravais.com/s/lnmF3Eowwg51t7Rj9DtD
Some of the most commonly used usecases are alerting on rogue/unapproved DNS & DHCP servers.