The bottom portion of the Hosts page of the NSX Network Detection and Response UI displays a list of hosts that meet the criteria of the selected filters. If no filters have been selected, all hosts in your network are displayed.

Search

The Quick search text box in the upper-left section of the list widget provides a quick as-you-enter search feature. The system filters the rows in the list, displaying only those rows that have text, in any column, that matches the query string.

Note:

If the list is long, the Quick search only scans the first 1,000 entries and can return incomplete results. The total number of search results returned is displayed in the upper-right corner of the list widget.

Selection

Use the SELECT drop-down menu for a fine-tuned selection. The available selection options are All visible, All pages, or Clear selection. To select all visible hosts, you can also click check mark icon in the row for column names.

Host List

You can customize the number of rows that are displayed in the Host list. The default is 20 entries. To navigate through multiple pages, use the left arrowhead icon and right arrowhead icon.

Each row provides an information summary for a host. To select a host row, click the check mark icon icon. To access more information about a host, click anywhere in an entry row and the Host Summary sidebar panel displays. See Host Summary Sidebar for details.

The list includes the following columns.
Column Name Description
IMPACT

Active threats on the host are denoted with the active threat icon icon.

The impact value indicates the critical level of the detected threat and ranges from 1–100:

  • A threat value that is 70 or higher is considered to be critical. The number is displayed in red.
  • A threat value that is between 30–69 is considered to be medium-risk. The number is displayed in yellow.
  • A threat value that is between 1–29 is considered to be benign. The number is displayed in blue.
HOST IP The IP address of the host. Click the IP address link to display the Host profile page for the host.
THREATS Displays the name of the top detected security risk and the number of threats detected on the host. If the name has a tag icon icon, click it and a pop-up window displays the description of the threat.
THREAT ACTIVITY Timestamps from when the first event and last event comprising this incident was seen.
CAMPAIGNS The campaign icon icon indicates the number of campaigns to which the host belongs.

Host Summary Sidebar

Click anywhere in an entry row for a host in the Host list and the Host Summary sidebar appears on the right side of the Hosts page.

The following describes what you see in the Host Summary sidebar.

Top Section

The following items are displayed at the top of the panel.
  • To close the sidebar, click the close icon icon.
  • The impact value and IP address of the selected host is displayed.
  • Point to the impact value and Threat status is displayed.
  • To go to the Host profile page, click View Profile.
  • The number of campaigns, threats, applications, and services are displayed.

Details Section

The following details about the host are displayed:

  • The Host Name section lists all known host names for the host.
  • The Host Label section lists any labels assigned to the host. You can edit the label.

Active Campaigns

The Active campaigns section lists the campaigns associated with this host during the current time frame, if any. Each entry is a summary of a campaign and includes the following information.

Threats

The Threats section lists the threat incidents associated with the selected host during the current time frame. Each entry is a summary of a threat:

  • Impact value of the threat.
  • The name of the threat. Hovering over the name displays a pop-up with further information about the threat.
  • The threat activity time range.

Click the View threats link to view the details on the Host profile > Threats tab.