VMware NSX Intelligence is a distributed analytics platform powered by Druid that can process and visualize network traffic flows, detect anomalous network behaviors, and recommend security policies. We will introduce our data pipeline (Kafka, Spark, Druid), how we ingest and store data with Druid, how we perform different kind of queries to achieve our use cases, and our learnings in the past 3 years.