Searching for Security Intelligence Entities

The global search capability in NSX recognizes Security Intelligence keywords.

You can use the NSX Manager search interface to find entities that are related to Security Intelligence. You must have Security Intelligence activated on NSX 3.0 or later for the Security Intelligence global search feature to be available for your use.

The search results are based on the current state of the NSX configuration and do not expose any historical data from Security Intelligence.

Based on the search criteria, the search results can display information about entities related to Security Intelligence, such as groups, virtual machines, flows, and recommendations. You can filter these results based on one or more related properties of the entities. Navigational links are included in the search results and enable you to view a selected result entity in the Security Intelligence visualization canvas.

The supported Security Intelligence resource types and their properties are listed in the following table.

Supported Resource Type	Properties
recommendations	context group path context physical server display name context physical server id context vm display name context vm external id display name effective physical server display name effecive physical server id effective vm display name effective vm id status ANALYSIS_IN_PROGRESS FAILED PUBLISHED READY_TO_PUBLISH WAITING Search query example: recommendation where status = READY_TO_PUBLISH and context group display name = 'Linux'
flows	active only destination group display name destination physical server display name destination physical server id destination vm display name destination vm external id flow type ALLOWED BLOCKED UNPROTECTED source group display name source physical server display name source physical server id source vm display name source vm external id Search query example: flows where source vm display name = 'Win10' and destination vm display name = 'AD Server'