Abstract: Information associated with a data packet sent to or from a network interface associated with a cluster node is obtained. The information associated with the data packet is correlated to a particular computing unit associated with the cluster node. The information associated with the data packet and information associated with the particular computing unit is aggregated across processes running on the particular computing unit. The aggregated information associated with the particular computing unit is provided to a flow log analyzer.

Abstract: A plurality of flow logs associated with a plurality of computing units are aggregated. For each flow event included in the plurality of flow logs a corresponding namespace with which the flow event is associated is determined including by determining a corresponding intermediary associated with the flow event. A network traffic map that visualizes network traffic between a plurality of namespaces is generated based in part on the determined intermediaries associated with the flow events.

Abstract: Access is provided to a plurality of virtual logical hosts and a decoy resource. Each virtual logical host comprises comprising one or more virtualized containers. A communication sent to the decoy resource is detected. Network communication data with respect to the decoy resource is collected based at least in part on detecting the communication sent to the decoy resource. The network communication data includes metadata used to provide said access via network communications to the decoy resource.