Security Explorer(Security Ingelligence) Flow Details Grid Displays "No Record found" When Applying Certain Auto-Complete Filter Values

Products

• VMware vDefend Firewall with Advanced Threat Prevention
• VMware vDefend Firewall

Issue/Introduction

Symptoms / Introduction

When reviewing network flow logs within the Flow Details grid view in VMware vDefend Security Services Platform (SSP), users can utilize an auto-complete drop-down menu to filter entries (e.g., by Destination Port, Protocol, or Rule Name).

However, the following behavior may be observed:

• The auto-complete dropdown suggests port numbers, application IDs, or rule configurations that appear valid.

• Upon selecting a specific suggested value and clicking Apply, the UI table view updates to display "No Record found".

• Running raw backend queries directly on the Druid database via dsql confirms that the records for that specific port or attribute are active and healthy within the system, but they do not show up in the active UI context.
  
  
  
  
  
  

Environment

 

• Product: VMware vDefend Security Services Platform (SSP)

• Versions: SSP 5.0, SSP 5.1, SSP 5.1.1

 

Cause

The auto-completion logic for filters in the Flow Details is not context-aware. The drop-downs retrieve and display all distinct values present across the entire system, rather than filtering the list based on the specific entity or dialog currently being viewed.

Example (Destination Ports): If a user is filtering by destination port, a port that has flows in one VM (e.g., Port 80 in VM-1) will still appear as a selectable option for a different VM (e.g., VM-2) even if VM-2 has no flows on that port. Selecting Port 80 while viewing the flow-details of VM-2 will yield zero results.

 

 

Resolution

This limitation requires a foundational modification to the global filtering architecture to efficiently pass context element keys (such as flow.* attributes) down to the autocomplete API without sacrificing system performance.

This enhancement is being tracked as a Feature/Epic under Internal ID 3592723.

Workaround Actions

To filter and isolate destination traffic accurately without encountering the "No Record found" state:

Utilize the Main Graph Topology View:

Instead of attempting to filter flows inside a localized sub-grid or modal popup, apply the required filter parameters directly onto the Security Explorer's main graph view. The main topology view natively supports broad multi-element keys, ensuring that configurations suggested and selected dynamically match the visible graph elements without rendering empty results.

Verify Results: Flow properties (For example, destination port and protocol) suggested and selected on the main graph view are contextually accurate and will not return empty results. However, configurations (For example, firewall rule name) may still return empty results if no flows are related to those configurations.