Warning: long, philosophical post ahead. TLDR: have another look at the existing solutions that are available.
I understand the appeal of rolling a custom solution, and I don't mean to be glib in saying this, but: if you are deploying in a production environment, developing any meaningfully-complex piece of infrastructure for which reasonable analogues already exist is a Bad Idea™, most especially in the realm of security.
Doing a really great job of designing an intrusion detection system (or configuration management system, or package distribution system, or high-level scripting language) requires a huge investment in domain-specific knowledge. If you have that knowledge, you're probably already involved with one of the many projects out there that's filling the particular niche you're interested in; if you don't, you're going to spend a lot of your employer's time and your own effort to develop version 1 of your own solution, which can't help but be mediocre compared to mature, community-supported solutions that have been refined over the course of years by motivated specialists.
It is the natural province of sysadmins to look at a problem and instantly begin designing a solution for it in our heads: we are typically both creatively talented and professionally motivated, and we love to fix problems, especially the big meta-problems that tend to inspire this kind of ambition. The cost-benefit equation just tends not to work out in favour of solving those problems from scratch, especially when you can probably get better bang for your buck by contributing to a well-managed existing project.
Sorry to have gone on so long; I hope I've managed to contribute something useful to your consideration of the issue.