The Elisity Microsegmentation platform provides rich policy and traffic telemetry while also offering effective search and filtering functionality for day two operations.
If you are looking for details on the Traffic View within the Policy Matrix, see this article.
Traffic Analytics
Navigate to Traffic Analytics > Traffic Records & Vectors to analyze traffic patterns, communication relationships, and policy enforcement behavior across your Elisity deployment. The dashboard groups traffic, displays key metrics, and provides granular filtering.
View Controls and Grouping Options
View Toggle: Located in the top-left corner, this control switches between visualization modes:
- Traffic Vectors (Sankey diagram icon) displays traffic flows as a visual diagram showing communication paths
- Traffic Records (List icon) presents traffic data in a detailed tabular format
Grouped By: Located immediately to the right of the View Toggle, the Grouped By dropdown determines how traffic data is organized and displayed throughout the dashboard.
| Grouping Option | Description |
|---|---|
| Policy Groups | Organizes traffic by Policy Groups, showing communication patterns between defined groups of devices or users |
| Devices | Displays traffic organized by individual devices, useful for investigating specific device behavior or troubleshooting |
| Distribution Zones | Organizes traffic by Distribution Zone, showing communication patterns between network zones |
Traffic Metrics
Three metric cards display aggregated traffic statistics based on the current grouping and filter selections:
| Metric | Description |
|---|---|
| Total Unique Traffic Vectors | Count of distinct communication paths between the selected source and destination within the time range - only applies to one-to-one mappings between Devices and Policy Groups. |
| Total Bytes | Aggregate data volume transferred, with directional indicators showing upload and download traffic distribution |
| Total Packets | Total packet count across all traffic vectors, with directional indicators showing transmission patterns |
Time Range and Aggregation Controls
Time controls allow administrators to define the analysis period and aggregation granularity:
Time Aggregation: Select Hourly, Daily, Weekly, or Monthly to control how traffic data is grouped over time. This affects both the visualization granularity and the metric calculations. Each preset displays one calendar-aligned window: a clock hour, a day starting at midnight, a week starting on Monday, or a calendar month starting on the 1st. Window boundaries are set in UTC and displayed in the browser's local time.
Top Talkers Limit: The Top 20 Talkers dropdown (or Top 10, Top 30) limits the number of traffic vectors displayed, showing only the highest-volume communications based on the selected metric.
Date Range Navigation Bar: Located at the bottom of the chart, the navigation bar displays the selected window and contains the following controls:
| Control | Description |
|---|---|
| Earliest window | Jumps to the oldest available window. |
| Previous window | Steps back one window. |
| Next window | Steps forward one window. |
| Now | Returns to the current window, which is the period in progress. |
From the current window, the bar steps back up to 48 hours on Hourly, 60 days on Daily, 8 weeks on Weekly, and 2 months on Monthly. Earliest window and Previous window are disabled on the oldest window, and Next window and Now are disabled on the current window, so an enabled Now button indicates a past window. A completed Monthly window shows its length, for example (30 days).
Switching to a coarser preset keeps the selected period in view, and switching to a finer preset returns to the current window. The selected window is saved in the page URL, so it persists across page reloads, and a copied link opens the same number of windows back from the time it is opened. Automatic refresh does not move the view off a past window. The same navigation bar appears in the Traffic Records view, on the Analytics tab in Device Details, and on the Traffic Analytics tab of policy details.
Visualization Controls
Hide Internet Traffic: Located in the button rail at the bottom-right of the chart, this control hides or shows communications with internet destinations.
Full Screen: The full screen button in the same rail expands the Traffic Analytics view to occupy the entire browser window, maximizing visualization space for detailed analysis.
Legend: The info button at the bottom of the rail displays the chart legend.
Filtering Traffic Data
Traffic Analytics provides a powerful filtering system to refine the displayed data. Filters are accessed via the Filters button in the top-right corner of the dashboard. When filters are active, a badge displays the count of applied filters.
Quick Filters (Left Panel)
The left filter panel provides granular control over which traffic is displayed. Filters are organized into collapsible sections, allowing administrators to refine traffic views based on multiple criteria simultaneously:
| Filter Category | Description |
|---|---|
| Policy Action | Filter by policy enforcement action (Allow, Deny) |
| Policy Status | Filters based on traffic with the following Policy Status: All, Active, No Policy, or Simulated |
| Side A | Filter traffic by source entities (Policy Groups, Devices, or Distribution Zones depending on grouping selection) |
| Side B | Filter traffic by destination entities (Policy Groups, Devices, or Distribution Zones depending on grouping selection) |
| Ports | Filter by specific network ports or port ranges |
| Protocols | Filter by network protocol (TCP, UDP, ICMP, etc.) |
| Service Names | Filter by detected application or service names. Service Names include standard protocols such as HTTP, HTTPS, and SSH, as well as custom applications defined under Settings > System > Application. See Manage Custom Application Definitions for configuration details. |
Advanced Filtering
Elisity offers several methods for filtering traffic such as click-through analytics for assets and Policy Group intersections, and manually-created filters.
Click the Filters button in the top-right corner to open the advanced filter modal. This modal provides granular filtering capabilities organized into four tabs:
Side A Tab - Create filters for traffic source (originating) entities. Available filter attributes depend on the current Grouped By selection.
When grouped by Policy Groups, you can filter by Policy Group, Policy Set, IP/Subnet, Site Label, Site Tag, Service Name, Port, or Distribution Zone.
When grouped by Devices, you can filter by Policy Group, Policy Set, IP/Subnet, Device Type, Device Category, Device ID, Hostname, Site Label, Site Tag, User Account Name, Service Name, Port, and Distribution Zone.
Side B Tab - Provides the same filtering capabilities as the Side A tab, but applies filters to traffic destination (receiving) entities. This allows you to create asymmetric filters where source and destination criteria differ.
Additional Filters Tab - Contains specialized filters and the ability to create custom filter combinations.
Traffic Exclusion Filter: A toggle that hides background traffic noise from the view. See Traffic Exclusion Filter.
Below the Traffic Exclusion Filter toggle, you can create custom filters using three-field combinations:
- Search Type: Select the attribute to filter on (Service Names, Ports, etc.)
- Condition: Choose the matching logic (Is Any Of or Is None Of)
- Value: Enter or select the specific values to match against
Multiple custom filters can be added using the Add New Filter button. All filters in this tab are applied using AND logic (traffic must match all specified conditions).
Saved Filters Tab - Provides access to previously saved filter configurations. Click any saved filter to instantly apply its configuration to the current view.
Creating, Saving, and Sharing Custom Filters
Once you've configured your filter criteria across any combination of tabs, use the buttons at the bottom of the filter modal:
- Save Filter: Saves the current filter configuration with a custom name for future reuse
- Import Filter: Imports a previously exported filter configuration file
- Clear Filters: Removes all active filters and returns to the unfiltered view
Saved filters can be exported, shared with other administrators, and imported into different Cloud Control Center environments.
Filter Persistence: Filters remain active as you navigate between Traffic Vectors and Traffic Records views, or switch between Policy Group, Device, and Distribution Zone groupings. This allows you to examine the same filtered dataset from multiple perspectives without reconfiguring filters.
NOTE: For roles restricted to specific sites, the Site Label filter requires the View Site Labels permission under the Site Labels and Distribution Zones privilege section of the role. Without it, users cannot filter Traffic Analytics by Site Label. See the RBAC Privilege Reference for details.
Traffic Exclusion Filter
The Traffic Exclusion Filter hides background noise, such as discovery and broadcast protocols, scans, failed connections, and very small flows, so that analytics show meaningful communication. It changes only what is displayed, never policy or recorded traffic.
The Traffic Exclusion Filter toggle is on the Additional Filters tab of the Filters panel. It is off by default and, like the other filters, applies only to the current view and is saved in the page URL. The same toggle appears on the Analytics tab in Device Details, in the Policy Matrix traffic view, and on the Traffic Analytics tab of policy details.
What the filter excludes is one tenant-wide definition shared by every user and view. Only users with the Analytics Edit privilege see the edit (pencil) icon next to the toggle and can change it.
Edit Exclusion Filters
| Control | Description |
|---|---|
| Minimum Traffic Volume Threshold | A Value and Unit (B, KB, MB, GB, TB, or PB). Hides every traffic vector or record whose combined bytes in both directions fall below the threshold for the selected time window. Applies to all traffic, not only the chosen ports and protocols. The default, 0 MB, applies no threshold. |
| Exclude Low-Volume TCP Flows | Selected by default. Treats flows that look like port scans, incomplete handshakes, or connection probes as noise: TCP flows that carried no data in one direction, and flows that transferred less than 80 bytes in each direction. |
| Ports and Protocols | Available Filters (left, searchable) lists the port, protocol, and service combinations seen on the tenant, with a Last Update time. Entries in Chosen Filters (right) are always excluded, whatever their volume. Move entries with >, >>, <, and <<. At least one chosen filter is required to save. The defaults are ICMP, TCP 7680 (Windows Update Delivery Optimization), UDP 5355 (LLMNR), UDP 5353 (mDNS), UDP 137, 138, and 139 (NetBIOS), and UDP 3702 (WS-Discovery). |
Save Changes is enabled only after a change. Restore Default Filter resets all three controls to the defaults above, which you must then save. Cancel closes the drawer without saving.
NOTE: Changes to Ports and Protocols and Exclude Low-Volume TCP Flows apply to traffic recorded after you save; traffic already recorded keeps its earlier classification. The Minimum Traffic Volume Threshold is evaluated when the view loads, so it applies immediately to all time windows.
Editing the Exclusion Filter
Step 1. Click Filters, select the Additional Filters tab, and click the edit (pencil) icon next to the Traffic Exclusion Filter toggle.
Step 2. Set the controls and click Save Changes.
Step 3. Turn on the Traffic Exclusion Filter toggle to apply the filter to the current view.
Traffic Vectors View
The Traffic Vectors visualization provides an interactive way to understand traffic movement within your network. The interface uses a Sankey diagram to represent source and destination traffic, along with the protocols and ports involved.
Interacting with Traffic Vectors
The following interactions apply across all Grouped By options. When grouped by Policy Group, Side A and Side B display Policy Group names. When grouped by Device, they display device names or IP addresses. When grouped by Distribution Zone, they display zone names.
-
Hovering over a name: Displays a tooltip with contextual details. For Policy Groups, the tooltip shows the full name and asset count. For devices, it shows:
- Policy Group — The Policy Group assigned to the asset. Selecting the Policy Group name opens Policy Group Details. Selecting the filter icon opens the Devices view pre-filtered to that group.
- Device Category — The classification of the asset (endpoint, server, infrastructure device, etc.).
- Site Label — The site label associated with the asset. Selecting it opens the Devices view pre-filtered to that site.
- Asset Type — The type of device (physical asset, virtual machine, etc.).
- IP Address — The management or observed IP address of the asset.
- Clicking a name: Opens the details page for that entity in a new window. For Policy Groups, this opens Policy Group Details. For devices, this opens Device Details. For workloads, this opens Workload Details.
-
Clicking the colored bar adjacent to a name: Automatically creates a Side A or Side B filter based on the side of the chart clicked. This refines the view to show a detailed breakdown of the ports and protocols associated with that entity.
-
Clicking a flow segment: Generates filters for both the Side A and Side B entities, revealing the ports and protocols involved in the traffic between them.
- Clicking a port or service name: Automatically applies a filter for the selected port or service.
When grouped by Device, hovering over a flow shows its connection, bytes, packets, and first and last observed times, and clicking the flow applies a Device ID filter to both Side A and Side B.
Workloads in Traffic Analytics
Traffic Analytics attributes a side of a flow to a cloud workload when the address belongs to one of the workload's interfaces. The workload's enforcement IP address is matched first, followed by its discovered private IP address. When a device and a workload share an address, the flow is attributed to the device.
Workload traffic appears where an on-premises Virtual Edge observes it, such as traffic between on-premises devices and cloud workloads. Traffic between workloads inside the cloud provider is not shown.
- Grouped by Device — The workload is shown by its workload name instead of an IP address. Clicking the name opens Workload Details in a new window. This link requires the Workloads feature and permission to view devices; otherwise, the name is shown as plain text.
- Grouped by Policy Group — Workload Policy Groups appear like any other Policy Group and can be selected in the Side A and Side B filters.
Traffic Records View
Traffic Records presents traffic analytics in a categorical, real-time table aimed at providing critical details about traffic. All of the same filtering capabilities available in Traffic Vectors view are available in Records view using the Grouped By (Policy Groups, Devices, Distribution Zones), Policy Action (Allow/Deny), Policy Status, and Advanced Filtering functions.
Exporting Traffic Records
Admins in Cloud Control Center can export traffic records from the Traffic Records pane by clicking the Export Data button (download icon) at the top right of the table. Options are available for exporting all traffic records or exporting records using the currently applied filter. A maximum of 50,000 records can be exported per CSV file.
Export is available for all three Grouped By options with the following granularity:
- Policy Groups — Daily and Hourly export
- Devices — Daily and Hourly export
- Distribution Zones — Daily export only
DNS Domain Name Visibility
Traffic Analytics can surface the DNS domain names that devices query, giving administrators additional insight into device behavior and the destinations that devices reach on the network. During day two behavioral analysis, seeing the domains a device contacts helps confirm what an asset is and how it communicates.
For DNS traffic, the records identify:
- Querying device — the client that initiated the DNS query.
- DNS server — the server the query was sent to (for example, 8.8.8.8).
- Domain names — the domain names the client queried.
The value shown is the domain name the client queried, not the resolved destination IP address.
NOTE: This queried-domain-name field is captured via Cisco Application Visibility and Control (AVC), which relies on Cisco Network Based Application Recognition (NBAR), and is available only on supported Cisco Catalyst 9000-series switches (9200, 9300, 9400, 9500, and 9600) where AVC DNS collection is enabled for the Virtual Edge Node. It is separate from Cloud Control Center's existing reverse-DNS-based device hostname resolution, which works across all Virtual Edge Node platforms.
Traffic Analytics from Device Details
Navigate to IdentityGraph > Devices and click a device to open Device Details. Select the Analytics tab to access per-device traffic analysis. Four buttons in the top-left corner switch between views: Traffic Vectors, Traffic Timeline, DNS, and Records. The DNS button is shown only when DNS Analytics is enabled for the tenant. Records lists the traffic records for the device in a table.
Traffic Vectors (Sankey View)
The default view displays a Sankey chart showing which assets the device has communicated with on the network, including traffic direction, protocols, and volume. Summary cards at the top display Total Unique Traffic Vectors, Total Bytes (with directional breakdown), and Total Packets (with directional breakdown).
Click Traffic Analytics in the top-right corner to open the full Traffic Analytics dashboard with the device filter pre-applied.
Filtering Traffic Flows
The Policy Action and Policy Status quick filters and the Filters panel, including the Traffic Exclusion Filter, work as described in Filtering Traffic Data and Traffic Exclusion Filter.
DNS
Select DNS to open the DNS Analytics view, which summarizes the DNS requests the device sent to DNS servers. DNS Analytics captures DNS requests on Virtual Edge Node uplink ports and is labeled Tech Preview. To enable DNS Analytics, contact your Elisity Customer Experience (CX) solution consultant.
In this view, the time range dropdown offers rolling ranges such as Last Month, and the Traffic Analytics button and traffic summary cards are hidden.
| Element | Description |
|---|---|
| Total DNS Requests | Number of DNS requests the device sent in the selected time range. |
| Unique Domains | Number of distinct domains the device queried. |
| DNS Servers | Number of DNS servers the device queried. Select the card to list the internal and public DNS servers. |
| Requests / Day (Avg) | Average number of DNS requests per day. |
| DNS-Derived Classification | The category and type that DNS activity suggests, with a confidence level. Click Show Details to compare Category and Type across DNS, Core Effective, and Elisity Intelligence Prediction, and to see the matched domains under Why DNS suggests this. If no domains match, the suggestion is Unclassified. The card does not change the device's classification. |
| DNS Activity Over Time | Requests and unique domains over time. |
| DNS Identity Signal | The share of queried domains that carry an identity signal. |
| Top Queried Domains | The domains the device queried most often. Only forward lookups are counted. |
| Domain Classification | The classification of the domains the device queried. |
A table below the cards lists each queried domain with its Category, Requests, DNS Servers, Signals, and Last seen (UTC) values and supports CSV download. Selecting a domain opens a drawer with its activity over time, DNS servers used, DNS statistics, and matched rule.
For the domain names recorded in Traffic Analytics records, see DNS Domain Name Visibility.
Traffic Timeline
Select Traffic Timeline to track device traffic activity and Policy Group association by hour. The view is fixed to the Monthly time range and shows one calendar month at a time.
The view displays a row for each day (labeled by day of week and date) with hourly columns from 12AM to 11PM. Each cell represents a one-hour interval and shows the outbound traffic observed during that period. An inline Policy Group chip marks the Policy Group the device was associated with, and hovering over a cell reveals the Policy Group the device was classified into during that interval:
- Allowed (green) — Allowed outbound traffic was observed during this hour.
- Denied (red) — Denied outbound traffic was observed during this hour.
- Mixed (striped) — Both allowed and denied outbound traffic were observed during this hour.
- No Outbound Traffic (empty) — No outbound traffic was observed during this hour.
Adjusting the Zoom Level
A floating button rail on the right edge of the heatmap provides Refresh, Zoom Options, and Legend controls. Click Zoom Options (the magnifier icon) to expand the Zoom In and Zoom Out buttons. Zooming changes only how the grid is rendered — no traffic data is added or removed.
Four zoom levels let you trade detail for breadth as you move across the month:
| Zoom Level | Description |
|---|---|
| Detailed (default) | Largest cells, with full day-of-week and date row labels (for example, Mon 06/01), every hour from 12AM to 11PM labeled, and the inline Policy Group chip shown on the row. Best for inspecting a single day hour by hour. Zoom In is disabled at this level. |
| Compact | An intermediate step that shrinks the cells slightly to bring more days into view while keeping the hourly columns easy to read. |
| Condensed | Smaller cells with abbreviated row labels and thinned hour labels, fitting a larger portion of the month on screen. |
| Overview (most condensed) | Smallest cells, with date-only row labels (for example, 06/01) and only every sixth hour labeled (12AM, 6AM, 12PM, 6PM). The inline Policy Group chips are hidden. Best for spotting broad activity patterns across the full period. Zoom Out is disabled at this level. |
Keyboard shortcuts: With the heatmap in focus, press + or = to zoom in, - or _ to zoom out, and Esc to close the Zoom Options menu.
This view enables administrators to identify when a device is active on the network, detect Policy Group reclassification events, and correlate traffic patterns with policy changes over time.
From the Policy Matrix
When viewing traffic from the Policy Matrix, click a policy intersection to view traffic details for that specific Policy Group-to-Policy Group relationship. Click Traffic Analytics in the top-right to view the same data in the full Traffic Analytics dashboard.
NOTE: The Traffic Exclusion Filter toggle is also available in the Policy Matrix traffic view.
Behavior for "Unknown", "Unassigned", and "Elisity Edge Infrastructure" Policy Groups in Analytics
Traffic in Analytics is categorized based on the following behavior:
Unassigned Policy Group:
- Includes only devices discovered within the Elisity framework that cannot be matched to any Policy Group.
- Appears in both the Policy Matrix and Analytics views.
Unknown:
- Represents traffic destined to or originating from devices outside the Elisity framework that do not fall into any static (network-based) Policy Group.
- Only visible in the Analytics view under the Unknown filter.
- Does not appear in the Policy Matrix as Unknown is not a Policy Group in the system, but rather a logical grouping for analytics purposes.
Elisity Edge Infrastructure:
- Represents traffic to, from, or between Elisity Virtual Edges and Virtual Edge Nodes.
- Hovering over the name displays: Reserved for traffic between Elisity appliances and the devices they manage. Not configurable in Policy. The same explanation appears in Traffic Records and in the Traffic Timeline view in Device Details.
- Selecting it does not apply a filter or open Policy Group Details, and it is not offered in the Policy Group filter.
- Does not appear in the Policy Matrix and cannot be used in policy.
- Is separate from Unknown. Traffic whose Policy Group cannot be resolved still appears as Unknown.
This differentiation ensures better visibility into traffic patterns and simplifies the identification of unmanaged or external assets within the Traffic Vectors view.