The NSX Intelligence visualization is composed of the groups or compute entities, and the network traffic flows that occurred with those groups or compute entities during the selected time period.

The NSX Intelligence 3.2 or later feature that is activated using NSX-T Data Center 3.2 or later, supports groups with member types that is either a VM, physical server, IP address, or a combination of those compute entities.


The visualization shown for a specific time period represents all the network traffic flows and workload activities that occurred in your NSX-T Data Center during that time period. These activities include the addition, removal, or movement of compute entities (VMs, physical servers, IP address sets) and groups. It is possible that a VM appears more than once in the visualization. For example, if a VM was attached to an ESXi host that was originally unmanaged and the host becomes managed by a VMware vCenter Server™ during the selected time period, the VM appears twice in the Computes view. Similarly, if an ESXi host is disconnected from vCenter Server and added back during the same selected time period, the VMs attached to the host appear as both deleted and new during the selected time period. In Groups view, if a VM was in the Uncategorized group and added in a group during the same selected time period, the VM appears in both the uncategorized group and in its new group.

The NSX Intelligence feature supports groups with VMs, physical servers, or IP addresses only. If groups have any other member types, the Groups view might show only the correlated traffic flows between the groups with supported member types, instead of the actual groups in the security rule.

The visualization graph that is in display is refreshed as the security posture changes in your NSX-T Data Center. For example, if a new group is added, a new group node is displayed on the visualization canvas without you needing to refresh your web browser. The Refresh status section in the upper right section of the virtualization canvas shows when the view was last refreshed.

Use the information in this section to learn more about working with the Groups view, Computes view, and the different types of traffic flows.