Before you can start using the NSX Suspicious Traffic feature, your NSX environment and the NSX Intelligence feature must meet the specific license and software requirements.

License Requirements

You must have one of the following licenses in effect during your NSX Manager session. The following lists the various NSX licenses that support the NSX Suspicious Traffic feature.
Base SKU License Add-on SKU License
NSX-T Evaluation None required
NSX Data Center Evaluation None required
NSX Advanced Threat Prevention

(Only applicable for customers who have previously purchased the license.)

 None required
One of the following:
  • NSX Distributed Firewall with Threat Prevention
  • NSX Distributed Firewall
  • NSX Advanced
  • NSX Enterprise Plus
 NSX Advanced Threat Prevention for Distributed Firewall
NSX Distributed Firewall with Advanced Threat Prevention None required
NSX Gateway Firewall with Advanced Threat Prevention None required

One of the following:

  • NSX Gateway Firewall with Threat Prevention
  • NSX Gateway Firewall
 NSX Advanced Threat Prevention for Gateway Firewall
NSX Advanced with Advanced Threat Prevention None required
NSX Enterprise Plus with Advanced Threat Prevention None required

Software Requirements

You must meet the following software requirements before you can start using the NSX Suspicious Traffic feature.

  • Install NSX 3.2 or later.

  • Deploy the VMware NSX® Application Platform using an Advanced form factor.

  • Activate the NSX Intelligence 3.2 or later feature on the NSX Application Platform.

  • Configure the NSX Intelligence 3.2 or later feature to only collect network traffic data for the specific standalone hosts or clusters of hosts that you want to be monitored. The NSX Suspicious Traffic feature is only supported on standalone hosts or clusters of hosts that have traffic data collection activated. For information about configuring the settings for the NSX Intelligence 3.2 or later feature, see the Activating and Upgrading VMware NSX Intelligence document.

  • Activate the NSX Network Detection and Response feature if you are going to work with campaigns to obtain deeper analysis of the detected suspicious traffic events using the VMware NSX® Advanced Threat Prevention cloud service. See the feature activation information in the NSX Network Detection and Response section of the Security chapter of the NSX Administration Guide document. The NSX Administration Guide document is delivered with the VMware NSX Documentation set.

    Important:

    To provide the functionalities for deeper analysis of the detected malicious or anomalous events, the NSX Network Detection and Response feature requires that your NSX 3.2 or later environment be connected to the Internet.

    The NSX Network Detection and Response feature is not supported in air-gapped environments when there is no outbound Internet access from the Kubernetes cluster pods and the NSX Unified Appliance.