The default view that is shown in the NSX Intelligence home page is the Groups view. This Groups view is filtered to display all the groups that had unprotected traffic flow in the last 24 hours.

Nodes and Arrows in a Groups View

A node in a Groups view represents NSX objects, such as VMs, IP sets, and so on, in your NSX-T Data Center environment. The following screenshot is a sample of a Groups view.

The following table lists the types of Group nodes you might see in the Groups view.
Type of Group Node Icon Description
Regular Group

A Regular Group node in NSX Intelligence represents any collection of NSX objects in your NSX-T Data Center environment. For this release, those NSX objects are VMs only and so NSX Intelligence supports Regular Groups with only VM member types. An NSX object can belong to more than one Group and so a VM can appear in more than one Group node.

Uncategorized Group

An Uncategorized Group node represents a collection of VMs that do not belong to any Group.
Unknown Group

An Unknown Group node represents a set of miscellaneous objects that were not found in your NSX-T Data Center inventory. However, these objects are communicating to one or more NSX objects in your NSX-T Data Center environment.
Public IPs Group

A Public IPs Group node represents a collection of public IP addresses (IPv4 or IPv6) that are communicating to NSX objects in your NSX-T Data Center.

The size of a node in the Groups view is based on the number of NSX objects, such as VMs, that belong to that group. The bigger the group's node, the more VMs belong to that group, for example. The name of the group and the total number of member VMs it has are displayed above the node.

The arrows between the group nodes represent the traffic flows that have occurred between the VMs in those connected group nodes, during the selected time period. A self-referencing arrow on a group node indicates that at least one VM was communicating with another VM within that same group. See Working with Traffic Flows for more information.

A node with a red-hued border indicates that at least one unprotected flow occurred with a VM in the group, regardless of how many blocked or allowed flows were detected during the selected time period. A blue-hued border on a node means that no unprotected traffic flows were detected, but at least one blocked flow was detected, regardless of how many allowed flows were detected during the selected time period. A node with a green-hued border indicates that there were no unprotected or blocked flows detected during the selected time period, and at least one allowed flow was detected. A node with a gray-hued border means that there were no traffic flows detected for the VMs belonging to that group during the selected time period.

If you are not seeing the Groups view, click the down arrow next to VMs in the Security view selection area and select Groups. In the selection drop list displayed, you can select All Groups or specific groups from the list, and then click Apply. Use the Search text box to filter the selection list. If you click away from the selection drop list without making any selection or if you select All Groups in the drop list, the All Groups option is applied to the Groups view.

Node Selection in Groups View

When you point to a group's node, information about that group is displayed, as shown in the following example for the group G-Win. The number and types of flows detected during the selected time period are also listed. If the group was added during the selected time period, the New badge icon and the details of when the group was created are also displayed.

When you click a group's node, a dashed circle marks the selection as a pinned group node. The other groups that are connected to the selected group node are also made more prominent in the view. All other nodes become dimmed. For example, in the following screenshot, the node UBUNTUVM5_Group is selected and other groups that shared a traffic flow with UBUNTUVM5_Group during the selected time period are also highlighted. All the other groups that did not communicate with UBUNTUVM5_Group are faded out in the view.

To clear the pinned selection, click in any empty area of the Groups view.

If you zoom out of the Groups view and the details on the nodes are no longer visible, point to any visible part of a node and its details are displayed.

Available Actions in the Groups View

A contextual menu of available actions is displayed when you right-click a group's node, as illustrated in the following image.

  • Selecting Deep Dive:Group_Name surrounds the selected group's node with a dashed circle to mark it as the pinned group node or the current group in focus. The VMs that belong to the group are shown inside the group's node. All the groups that had traffic flows with the VMs in the pinned group during the selected time period are also placed in the Groups view. In the following example, group G2 is the pinned group and the other groups are in the view because their VM members had traffic flows with rhelvm2 in group G2 during the selected time period.

  • When you select Filter By, the current group is added to the visualization filter that is used for the current Groups view.
  • Selecting VMs displays a table of all the VMs that belonged to the current group during the selected time period. From that View VMs table, you can see the details about the VMs that belong to the selected group and the other groups to which each VM also belongs. To add the VM to the current visualization filter, click the filter icon.
  • When you select Flow Details, the Flow Details table for the currently selected group is displayed, as shown in the following screenshot. It shows the details about the flows that have occurred and are currently active with the VMs that belong to the current group during the selected time period. The details include the flow type, the flow's source and destination groups, start and end time of the flow, and the services that were used. You can click some of the details to obtain more information. See Working with Traffic Flows for more information.