A system for providing an interactive chord chart illustrating collections of data flows between logical entities, the system comprising: a dataflow monitoring system (120, 118), the dataflow monitoring system configured to record data describing data flows between hosts in two or more subnets, the data describing a first data flow includes a sending host, a receiving host, a sending host subnet, a receiving host subnet, and a policy corresponding to the first data flow; one or more processors; a memory containing instructions that, when executed by the one or more processors, cause the dataflow monitoring system to generate the interactive chord chart by: analyzing the data describing the data flows, determining a grouped portion of the data flows that originate from a first endpoint and terminate at a second endpoint, the first endpoint corresponding to a respective element, the respective element being a respective subnet or a respective cluster of hosts, and the second endpoint corresponding to a respective subnet, a respective cluster of hosts, or a respective individual host, displaying the interactive chord chart to include a chord with the first endpoint and the second endpoint, the chord representing the grouped portion of the data flows that originate from the first endpoint and terminate at the second endpoint; after receiving a selection of the chord or the first endpoint, expanding the grouped portion of the data flows into sub-groupings of data flows and the first endpoint into a set of sub-endpoints, each of the sub-endpoints corresponding to a respective sub-element within the element corresponding to the first endpoint; and updating display of the interactive chord chart to include a set of sub-chords corresponding to at least the set of sub-endpoints, the set of sub-chords representing the sub-groupings of data flows that originate from the set of sub-endpoints, wherein the updated interactive chord chart includes the first endpoint. a dataflow monitoring system (120, 118), the dataflow monitoring system configured to record data describing data flows between hosts in two or more subnets, the data describing a first data flow includes a sending host, a receiving host, a sending host subnet, a receiving host subnet, and a policy corresponding to the first data flow; one or more processors; a memory containing instructions that, when executed by the one or more processors, cause the dataflow monitoring system to generate the interactive chord chart by: analyzing the data describing the data flows, determining a grouped portion of the data flows that originate from a first endpoint and terminate at a second endpoint, the first endpoint corresponding to a respective element, the respective element being a respective subnet or a respective cluster of hosts, and the second endpoint corresponding to a respective subnet, a respective cluster of hosts, or a respective individual host, displaying the interactive chord chart to include a chord with the first endpoint and the second endpoint, the chord representing the grouped portion of the data flows that originate from the first endpoint and terminate at the second endpoint; after receiving a selection of the chord or the first endpoint, expanding the grouped portion of the data flows into sub-groupings of data flows and the first endpoint into a set of sub-endpoints, each of the sub-endpoints corresponding to a respective sub-element within the element corresponding to the first endpoint; and updating display of the interactive chord chart to include a set of sub-chords corresponding to at least the set of sub-endpoints, the set of sub-chords representing the sub-groupings of data flows that originate from the set of sub-endpoints, wherein the updated interactive chord chart includes the first endpoint. analyzing the data describing the data flows, determining a grouped portion of the data flows that originate from a first endpoint and terminate at a second endpoint, the first endpoint corresponding to a respective element, the respective element being a respective subnet or a respective cluster of hosts, and the second endpoint corresponding to a respective subnet, a respective cluster of hosts, or a respective individual host, displaying the interactive chord chart to include a chord with the first endpoint and the second endpoint, the chord representing the grouped portion of the data flows that originate from the first endpoint and terminate at the second endpoint; after receiving a selection of the chord or the first endpoint, expanding the grouped portion of the data flows into sub-groupings of data flows and the first endpoint into a set of sub-endpoints, each of the sub-endpoints corresponding to a respective sub-element within the element corresponding to the first endpoint; and updating display of the interactive chord chart to include a set of sub-chords corresponding to at least the set of sub-endpoints, the set of sub-chords representing the sub-groupings of data flows that originate from the set of sub-endpoints, wherein the updated interactive chord chart includes the first endpoint.