AI Vectra Stream via Legacy Agent

>**NOTE:** This data connector depends on a parser based on a Kusto Function to work as expected **VectraStream** which is deployed with the Microsoft Sentinel Solution.

1. Install and onboard the agent for Linux

Install the Linux agent on sperate Linux instance. > Logs are collected only from **Linux** agents.

Choose where to install the Linux agent:

Install agent on Azure Linux Virtual Machine

Select the machine to install the agent on and then click **Connect**.

Install agent on a non-Azure Linux Machine

Download the agent on the relevant machine and follow the instructions.

2. Configure the logs to be collected

Follow the configuration steps below to get Vectra Stream metadata into Microsoft Sentinel. The Log Analytics agent is leveraged to send custom JSON into Azure Monitor, enabling the storage of the metadata into a custom table. For more information, refer to the [Azure Monitor Documentation](https://docs.microsoft.com/azure/azure-monitor/agents/data-sources-json). 1. Download config file for the log analytics agent: VectraStream.conf (located in the Connector folder within the Vectra solution: https://aka.ms/sentinel-aivectrastream-conf). 2. Login to the server where you have installed Azure Log Analytics agent. 3. Copy VectraStream.conf to the /etc/opt/microsoft/omsagent/**workspace_id**/conf/omsagent.d/ folder. 4. Edit VectraStream.conf as follows: i. configure an alternate port to send data to, if desired. Default port is 29009. ii. replace **workspace_id** with real value of your Workspace ID. 5. Save changes and restart the Azure Log Analytics agent for Linux service with the following command: sudo /opt/microsoft/omsagent/bin/service_control restart

Workspace ID

3. Configure and connect Vectra AI Stream

Configure Vectra AI Brain to forward Stream metadata in JSON format to your Microsoft Sentinel workspace via the Log Analytics Agent. From the Vectra UI, navigate to Settings > Cognito Stream and Edit the destination configuration: - Select Publisher: RAW JSON - Set the server IP or hostname (which is the host which run the Log Analytics Agent) - Set all the port to **29009** (this port can be modified if required) - Save - Set Log types (Select all log types available) - Click on **Save**