Search and attributes filter

Use the Enter attributes… field to search and filter by standard attributes (such as Scope, Hostname, Address, Consumer/Provider name) or by custom labels.

Time range selection

Defines the interval for which traffic and flow data are displayed on the Global Visualization Canvas. Changing the time range allows you to analyze communication patterns over different periods, from near real-time activity to longer-term trends.

The following predefined time ranges are available: Last 15 minutes, Last hour, Last 6 hours, Last 12 hours, and Last day. When you select a time range, the canvas automatically refreshes to show only the flows and relationships observed during the specified interval.

Last update timestamp

Monitor the Last update: field in the top right to ensure you are viewing the most recent telemetry data.

Time

The time filter defines the time range for which flow data is displayed. Selecting a time range updates the canvas to show only the traffic observed during the chosen interval.

Flow stats

The flow Stats filter allows you to include or exclude traffic flows based on their enforcement status. This helps isolate specific types of network behavior and policy outcomes.

• Rejected: Displays flows that were blocked by enforcement policies.

• Escaped: Displays flows that bypassed policy enforcement.

• Unprotected: Displays implicit allowed flows where no explicit security policies are currently applied to the agent or workload.

• Permitted: Displays traffic that is explicitly allowed by a defined security policy or a catch-all allow rule.

The flow stats filter follows a defined priority order when multiple flow statuses apply to a workload at the same time. Rejected has the highest priority and is displayed first when a flow is rejected between workloads or scopes. If rejected is not selected, the canvas displays escaped flows; if escaped is also not selected, it displays unprotected flows. This ordering ensures that the most critical flow status is highlighted first.

Vulnerabilities

The vulnerabilities filter allows you to narrow the visualization to workloads with identified security vulnerabilities based on severity.

• Critical: Displays workloads with critical-severity vulnerabilities that require immediate attention.

• High: Displays workloads with high-severity vulnerabilities that pose significant risk.

• Medium: Displays workloads with medium-severity vulnerabilities that should be reviewed and addressed as part of regular security maintenance.

The vulnerabilities filter follows a priority order when multiple severities apply to a workload. Critical has the highest priority, followed by high and medium, ensuring the most severe vulnerabilities are shown first.

When you apply the critical filter, the canvas highlights workloads that have critical vulnerabilities. Selecting one of these workloads opens the workload profile panel with detailed information. In the vulnerabilities section of the panel, the total number of vulnerabilities is displayed by severity (Critical, High, and Medium). These values indicate the current vulnerability count associated with the selected workload.

Clicking any vulnerability count redirects you to the vulnerabilities dashboard, where you can review detailed vulnerability information, including affected packages, CVE details, and remediation insights for that workload.

Interactions

You can interact within the Global Visualization canvas using the following actions:

• Click on a node or flow to show or hide details.

• Double-click a node to expand and view child elements.

• Click and drag to reposition nodes on the canvas.

• Use mouse gestures to zoom in and out.

Structure

The structure section explains how nodes and traffic flows are visually represented on the canvas.

• Scope: Represents a logical grouping of inventory organized in a hierarchical structure. Scopes categorize workloads and other inventory to simplify traffic visualization and analysis.

• Scope name: Displays the name of the scope as defined in Secure Workload.

• Node name: Displays the name of the selected node, such as a workload or scope.

• Traffic flow: Represents the direction of communication between nodes. Arrows indicate the direction of traffic flow between scopes, workloads, or other inventory.

• Flow count: Indicates the total number of observed flows between nodes for the selected time range. For detailed flow information, you can navigate to the Flow Page.

Node types

Nodes represent physical or virtual entities within a cluster where services and workloads are distributed. Below are the node types are displayed on the Global Visualization canvas:

• Scope: A logical container used to organize inventory hierarchically. Scopes display inflow and outflow traffic to and from workloads and other inventory within the selected time range. Each scope displays aggregated flow information, including top provider protocols, ports, and flow counts. In the canvas click on a scope to view the details.

  Each scope will also have Policy workspace. Here you can add policies for the workload.

  

• Workload: Represents a physical or virtual server with an installed Secure Workload agent. Traffic flows within the inventory where workloads provide detailed visibility, including hostname, labels, vulnerability counts, running processes, and vulnerable packages.

  

• Cloud Workload: Represents workloads discovered through cloud integrations. These workloads may be agentless and provide visibility based on cloud metadata and observed traffic.

• Pod: Represents a Kubernetes pod running within a cluster. Pods display traffic flows and relationships with other workloads, services, and scopes.

• Service: Represents a Kubernetes service that exposes workloads or pods and participates in traffic flows within the cluster.

• IPs: Represents individual IP addresses involved in traffic flows. IP nodes help identify communication endpoints when workloads or services are not directly identifiable.

• Internet: Represents external traffic endpoints outside the Secure Workload–managed environment.

• Uncategorized: Represents inventory that belongs to a scope but is not a direct child of that scope. These nodes help identify assets that are associated with a scope but not fully classified.