Abstract: Approaches presented herein relate to visibility into network traffic associated with one or more groups of network resources. Approaches provide for automatic deployment and configuration of one or more visibility pods for individual groups of networked resources. A visibility pod may include at least one virtual compute instance to execute at least one analytical tool or application. A copy of network traffic for the monitored resources can be directed to an endpoint for a respective visibility pod, which can extract information (e.g., specific metadata about the traffic) to be analyzed by the analytical tools or applications. The results of the analysis can be written to a log file and/or data repository, and in some instances may be used to generate security alerts or other such notifications. A visibility pod can be automatically deployed and configured for any group of networked resources from which network traffic can be directed.

Abstract: A data security server or system may be installed or placed into network to perform data security and network monitoring and analysis functions. The data security server may operate an isolated computing instance or engine, such as a software container engine. A computing resource service provider may send commands to the data security server to provision a variety of data security and monitoring applications in isolated software containers of the data security server. The data security server, via the data security and monitoring applications, may obtain copies of traffic going into and out of the network, and analyze the traffic to produce security data. The security data may be uploaded to the service provider for storage and retrieval.