Abstract: A plurality of flow logs associated with a plurality of computing units are aggregated. For each flow event included in the plurality of flow logs a corresponding namespace with which the flow event is associated is determined including by determining a corresponding intermediary associated with the flow event. A network traffic map that visualizes network traffic between a plurality of namespaces is generated based in part on the determined intermediaries associated with the flow events.