You can use the NSX IDS/IPS feature to detect malicious traffic patterns in the north-south traffic, and use the NSX Malware Prevention feature to detect malicious files in the north-south traffic.

Important: In NSX-T Data Center 3.2.0, NSX IDS/IPS on Gateway Firewall was available in tech preview mode only. Starting with NSX-T Data Center 3.2.1, this feature is available for production environments and has full support. For more information, see the NSX-T Data Center Release Notes.