Detection Engineering best practices

Detection Engineering lets you build, tune, and manage custom detections for your Vectra AI Platform (RUX) deployment.

Detection engineering is available for both cloud detections based on flow and DNS logs and for network detections based on packet level metadata gathered from network Sensors.

This feature is only available in Respond UX (RUX deployments). If you are unsure of your deployment type, please see Analyst UX options (RUX vs QUX).

Custom Models are also available for QUX deployments but the mechanism for creating them is different. Please see Recall custom models - how to create detections (QUX) for details.

Please Note:

Detection Engineering is currently in Private Preview. If the feature is not available in your tenant and you wish to participate in the Private Preview, please reach out to your Vectra account team to discuss.

Please see either page below for details:

• Detection Engineering Cloud

  • Enable and edit available flow log-based detections.
• Detection Engineering Network

  • Create and manage network metadata-based detections.