Abstract: Some embodiments provide a method for defining security groups in a network. In a user interface, the method displays (i) a set of existing security groups and (ii) a set of recommend security groups based on monitored network flows in the network. Each existing security group and recommended security group includes at least one data compute node (DCN). The method provides a user interface tool for (i) accepting recommended security groups to be part of the set of existing security groups and (ii) adding DCNs from the recommended security groups to the existing security groups. Security rules are defined and implemented in the network for DCNs belonging to existing security groups.

Abstract: Described herein are systems, methods, and software to manage usage statistics associated with firewall rules in a computing network. In one implementation, a method of operating a firewall summary service includes identifying a sequence of firewall rules for a computing environment and monitoring usage associated with each of the firewall rules. The method further includes generating, for display, a summary to indicate the sequence of the firewall rules with the usage associated with each of the firewall rules.

Abstract: Some embodiments provide a method for visualizing network flows between multiple security groups in a network. Each security group includes a set of one or more data computer nodes (DCNs). The method receives data regarding network flows between the DCNs of the security groups. In a scalable user interface visualization, the method displays the network flows by aggregating the network flows between DCNs in pairs of security groups. The method provides a filtering tool to enable visualization in the user interface of specific flows between the DCNs of the plurality of security groups.

Abstract: Some embodiments provide a method for defining security groups in a network. In a user interface, the method displays (i) a set of existing security groups and (ii) a set of recommend security groups based on monitored network flows in the network. Each existing security group and recommended security group includes at least one data compute node (DCN). The method provides a user interface tool for (i) accepting recommended security groups to be part of the set of existing security groups and (ii) adding DCNs from the recommended security groups to the existing security groups. Security rules are defined and implemented in the network for DCNs belonging to existing security groups.