You can use the following modes to view NDR events nested in aggregate events in the table of network traffic events:
Flat mode. In this mode, the table of NDR events displays all events without regard to event nesting.
Tree mode. In this mode, aggregate events are displayed as trees that can be collapsed and expanded using the and buttons next to the titles of aggregate events.