NSX Suspicious Traffic System Requirements

Before you can start using the NSX Suspicious Traffic feature, your NSX environment and the NSX Intelligence application must meet the specific license and software requirements.

License Requirements and Expiration

You must have one of the listed licenses in the feature entitlement documentation in effect during your NSX Manager session. The various NSX licenses that support the NSX Suspicious Traffic feature are available in the NSX Feature and Edition Guide.

If the assigned license expires or becomes invalid, the suspicious traffic capabilities are inaccessible. For information on NSX licensing and adding a new license key in NSX Manager. See the License Enforcement topic in the NSX Administration Guide.

Software Requirements

You must meet the following software requirements before you can start using the NSX Suspicious Traffic feature.

• Install NSX 3.2 or later.

• Deploy the VMware NSX^® Application Platform using an Advanced form factor.

• Activate the NSX Intelligence 3.2 or later feature on the NSX Application Platform.

• Configure the NSX Intelligence 3.2 or later feature to only collect network traffic data for the specific standalone hosts or clusters of hosts that you want to be monitored. The NSX Suspicious Traffic feature is only supported on standalone hosts or clusters of hosts that have traffic data collection activated. For information about configuring the settings for the NSX Intelligence 3.2 or later feature, see the Activating and Upgrading VMware NSX Intelligence document.

• Activate the NSX Network Detection and Response feature if you are going to work with campaigns to obtain deeper analysis of the detected suspicious traffic events using the VMware NSX^® Advanced Threat Prevention cloud service. See the feature activation information in the NSX Network Detection and Response section of the Security chapter of the NSX Administration Guide document. The NSX Administration Guide document is delivered with the VMware NSX Documentation set.

  Important:

  To provide the functionalities for deeper analysis of the detected malicious or anomalous events, the NSX Network Detection and Response feature requires that your NSX 3.2 or later environment be connected to the Internet.

  The NSX Network Detection and Response feature is not supported in air-gapped environments when there is no outbound Internet access from the Kubernetes cluster pods and the NSX Unified Appliance.