Each virtual machine created for Security Analytics needs to have three virtual disks. Without all three, the system cannot capture traffic. This is per the installation instructions.
Virtual Machine on VMware.
Insufficient number of disks created before the VM installation.
The problem can be seen by running as root from the command line, 'fdisk -l' or 'fdisk -l | grep G' to count the number of /dev/sd? devices that the VM can see. This can also be counted from the ESX management screen.
The installation instructions will direct the user to create all three virtual disks before the installation. The instructions are at:
Security Analytics Documentation
If you need further assistance, contact support.