Which Stealthwatch component is a physical or virtual appliance that aggrages and normalizes NetFlow data?

Investigate is the user-facing interface for threat hunting and analysis of collected flow data, not the component responsible for aggregating and normalizing raw NetFlow exports.

The Stealthwatch Management Center is the central console used for policy configuration, reporting, and correlation of data from multiple Flow Collectors - it does not itself ingest or normalize raw NetFlow data.

The Flow Collector is the dedicated Stealthwatch component that receives NetFlow, IPFIX, and other flow data from routers, switches, and other exporters, then normalizes and deduplicates that data before sending it to the Stealthwatch Management Center. It is available as both a physical and virtual appliance, matching the question's description exactly.

UOP Director is not a recognized component of the Cisco Stealthwatch (Secure Network Analytics) product line and does not exist in the official architecture.