This Quick Start deploys Darktrace vSensor virtual threat detection on the Amazon Web Services (AWS) Cloud. Darktrace analyzes raw data from mirrored virtual private cloud (VPC) traffic to identify threats. 

Amazon VPC traffic mirroring copies traffic from Amazon Elastic Compute Cloud (Amazon EC2) instances you want to monitor. A Network Load Balancer distributes mirrored traffic to Darktrace vSensor probes deployed in private subnets. Darktrace vSensors extract metadata from the mirrored traffic and store it in an Amazon Simple Storage Service (Amazon S3) bucket. Your existing Darktrace deployment analyzes the metadata using Darktrace's Enterprise Immune System to build metrics for identifying threats.

In addition, vSensor probes integrate with Darktrace osSensors. You can configure osSensors after deployment to capture data from virtual machines, containerized applications, and legacy Amazon EC2 instance types that do not support traffic mirroring.

https://aws.amazon.com/quickstart/architecture/darktrace-vsensor/