Abstract: Approaches presented herein relate to visibility into network traffic associated with one or more groups of network resources. Approaches provide for automatic deployment and configuration of one or more visibility pods for individual groups of networked resources. A visibility pod may include at least one virtual compute instance to execute at least one analytical tool or application. A copy of network traffic for the monitored resources can be directed to an endpoint for a respective visibility pod, which can extract information (e.g., specific metadata about the traffic) to be analyzed by the analytical tools or applications. The results of the analysis can be written to a log file and/or data repository, and in some instances may be used to generate security alerts or other such notifications. A visibility pod can be automatically deployed and configured for any group of networked resources from which network traffic can be directed.