↳ Source GitHubConnecteur
Vectra RUX Security Data Connector (via Codeless Connector Framework)
Description
The [Vectra RUX](https://www.vectra.ai/) data connector enables you to ingest security data from the Vectra AI platform into Microsoft Sentinel through the REST API using the Codeless Connector Framework (CCF). This connector supports 3 data streams using OAuth2 client credentials:<br>- **Detections**: Security detections, filtered by triaged status.<br>- **Lockdown**: Entity isolation and containment status. Live state captured every 5 minutes.<br>- **Entities**: Host and account entities with scoring, assignment, and enrichment data, incrementally ingested ordered by last modification time.<br><br>The connector is built on the Microsoft Sentinel Codeless Connector Platform and supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview) for optimized query performance.
- Statut déclaré
- 1
- Auteur / éditeur déclaré
- Vectra AI
Sources déclarées
Métadonnées du fichier source. Aucune dépendance déduite du KQL.
Types de données
Permissions déclarées
Read and Write permissions are required.
Workspace
Workspace
Vectra RUX API access
Access to Vectra RUX API with appropriate permissions for each data stream is required.
Instructions du connecteur
Contenu publié dans le dépôt. Consultez le fichier original pour l’ensemble des paramètres.
1. Configure Vectra RUX Connection
Connect to Vectra RUX and select data stream
Add Connection
Add Vectra RUX Data Stream Connection
Base Configuration
Configure your Vectra RUX API connection
Connection Alias
Enter a name to identify this Vectra instance — for example, 'Vectra-Prod' or 'Vectra-Dev'. Use the same alias for all data streams from the same Vectra instance. Use a different alias only when connecting to a separate Vectra instance. Warning: deploying the same stream type with the same alias will overwrite the existing connection for that stream.
Vectra API Base URL
Enter the base URL of your Vectra RUX instance without trailing slash (e.g., https://tenant.region.portal.vectra.ai). **HTTPS is required** — HTTP URLs will transmit credentials in cleartext.
OAuth2 Credentials
Configure OAuth2 credentials for API access
The Vectra RUX connector uses OAuth2 client credentials flow to authenticate with all API endpoints. These credentials provide access to the selected data stream.
**Important**: To avoid API rate limiting (HTTP 429 errors) when requesting OAuth tokens, create a separate API client in Vectra for each data stream connection and wait one minute before attempting to create additional connections. Assign each API client the **Read-Only** role to apply the principle of least privilege. For instructions on creating API clients, see the [Vectra API Client Setup Guide](https://docs.vectra.ai/configuration/access/api-rux/rux-api-postman-quick-start-guide).
Client ID
Client Secret
**Best Practice**: Create dedicated API clients in Vectra RUX for each stream (e.g., 'Sentinel-Detections', 'Sentinel-Entities', 'Sentinel-Lockdown') and assign each the role of **Read-Only** to apply the principle of least privilege.
Data Stream Selection
Select which Vectra RUX data stream to collect
Data Stream
Detections - Security detections
Entities - Host and account entities with scoring and assignment data
Lockdown - Security lockdown and containment actions
**Stream Details:**
- **Detections**: Security detections. Uses checkpoint-based polling (`next_checkpoint` cursor) every 5 minutes.
- **Entities**: Host and account entities with scoring, assignment, and privilege data. Polls every 10 minutes using `last_modified_timestamp_gte` sliding window — each poll requests only entities modified since the previous poll window.
- **Lockdown**: Entity isolation and containment status. Live state captured every 5 minutes.
**Detections Starting Checkpoint — Required for New Installations**
⚠️ **Detections stream only** — Enter 'Vectra' text if you are adding a Lockdown or Entities connection.
If adding a Detections connection, this field is critical. Leaving it empty will cause the poller to start from the oldest available event in your Vectra history, which can take many hours or days to catch up on large deployments and will flood your Log Analytics workspace with historical data.
Before creating a Detections connection, run the following API call against your Vectra instance to obtain the current cursor value:
`GET <vectraApiUrl>/api/v3.5/events/detections?limit=1&ordering=-event_timestamp` → copy the `next_checkpoint` value from the response
**Detections Starting Checkpoint - Required for Upgrading from an existing deployment** Run this query in your Log Analytics workspace to get the current checkpoint and avoid re-ingesting historical data:
`Detections_Data_CL | summarize checkpoint = max(id)` (If this is the first deployment to an existing environment) or `Detections_Data_CCF_CL | summarize checkpoint = max(id)` (if this is a RE-DEPLOYMENT of the CCF connector)
Paste the returned value into the field below. Enter '0' for a fresh install with no existing Detections data.
Detections Starting Checkpoint — Enter 'Vectra' as text for adding Lockdown or Entities data
**Note**: After adding a connection, the Detections stream polls every 5 minutes using a persistent checkpoint cursor (`PersistentToken`) — position-based, not time-based. The cursor survives pod restarts and long pagination runs; no events will be silently skipped due to clock drift or slow pages. **First poll seeding**: Provide the `detectionsStartingCheckpoint` value when creating the connection to start ingestion at your current event position rather than from the beginning of history.
**Troubleshooting Rate Limits (HTTP 429 Errors) when adding connections**:
- **Root Cause**: Vectra RUX limits API requests to prevent abuse
- **Solution**: Create a separate API client in Vectra for each data stream connection
- **Verification**: Check that each connector instance uses different `clientId` credentials
- **Deployment Strategy**: Stagger connection creation by at least one minute when adding multiple streams simultaneously to prevent OAuth2 request collisions
2. Monitor and Validate Data Collection
Monitor data ingestion and validate connectivity
**PersistentToken Checkpoint Mode (Detections)**
The Detections poller uses `PersistentToken` — the `next_checkpoint` value returned by the Vectra API is stored by CCF and passed back as `from=<checkpoint>` on the next poll cycle. This is position-based (monotonic `id`-based), not time-based, so slow pagination or pod restarts cannot cause silent data gaps.
**Cold-start behaviour**: On the very first poll after deployment, CCF sends `from=<detectionsStartingCheckpoint>` as the starting cursor. Ingestion begins at this cursor position, ensuring no historical backlog is ingested. Once the first poll completes, PersistentToken persists the returned `next_checkpoint` and all subsequent polls use the stored value automatically.
Contenus associés
Liens établis à partir des identifiants déclarés et des manifests des solutions.
Traçabilité de la source
GitHubLes valeurs affichées proviennent des fichiers du dépôt Azure/Azure-Sentinel. Elles décrivent le modèle publié, pas la configuration de votre workspace.
- Commit
9800e51↗- Identifiant source
VectraRUXConnector
GSTEP / SUIVI DU CATALOGUE
Ajouté au catalogue : 16 sept. 2026 · 05:49 UTC
Dernier changement observé : 16 sept. 2026 · 05:49 UTC