Microsoft Defender XDR Codeless Connector Framework (RUX)

Overview

The Microsoft Defender portal is Microsoft's unified security operations platform, bringing together SIEM, XDR, threat intelligence, and exposure management in a single interface. When Microsoft Sentinel is connected to the Defender portal, all security data — including Vectra AI detections — flows into a unified incident queue, a shared Advanced Hunting environment, and cross-platform workbooks and analytics, eliminating the need to work across separate tools during an investigation.

This document describes how to deploy and configure the Vectra AI RUX Security Data Connector for use within the Microsoft Defender portal. The connector ingests detection, entity, and lockdown telemetry from the Vectra AI platform and makes it immediately available across the full Defender XDR experience: the unified incident queue, Advanced Hunting (where Vectra data can be correlated against Defender endpoint, identity, and cloud signals), workbooks, analytics rules, and SOAR playbooks.

The connector is built on the Vectra AI RUX API and the Microsoft Sentinel Codeless Connector Framework (CCF). It does not require an Azure Function App, virtual machine, or customer-managed compute. Data polling, transformation, and ingestion are handled natively by Microsoft Sentinel through CCF and Data Collection Rules (DCRs), with all results surfaced directly in the Defender portal.

The solution package includes:

• Data Connector
• Parsers
• Custom Log Analytics tables
• Workbook template
• Analytics rule templates
• Playbooks / Logic Apps

Note on the underlying platform: Microsoft Sentinel provides the ingestion infrastructure for this integration. A Sentinel-enabled Log Analytics workspace must be connected to the Defender portal before deploying this connector. This is a one-time setup covered in the Prerequisites section. Once connected, all configuration and day-to-day operation is performed entirely within the Defender portal.

Note on Azure portal retirement: After March 31, 2027, Microsoft Sentinel will no longer be supported in the Azure portal and will be available exclusively in the Microsoft Defender portal. All customers are encouraged to connect their Sentinel workspace to the Defender portal now.

Architecture

Vectra AI (RUX) Platform
        │
        │ < HTTPS polling via Microsoft Sentinel CCF >
        │
Microsoft Sentinel / Log Analytics Workspace
        │
        ├── Custom Tables
        │   ├── Detections_Data_CCF_CL
        │   ├── Entities_Data_CCF_CL
        │   └── Lockdown_Data_CCF_CL
        │
        ├── Parsers
        │   ├── VectraRUXDetections
        │   ├── VectraDetectionsCombined
        │   ├── VectraEntities
        │   └── VectraLockdown
        │
        ├── Workbook Template
        │   └── VectraRUXSecurityDashboard
        │   └── VectraRUXTimelineWorkbook
        │
        ├── Analytics Rule Templates
        │   ├── Account incident rule
        │   └── Host incident rule
        │
        └── Playbooks / Logic Apps

Connector Components

Component	Description
Data Connector	Registers and configures the Vectra RUX connector in Microsoft Sentinel
Data Collection Rules	Define ingestion streams, transformations, and table mappings
Custom Tables	Store detections, entities, and lockdown records
Parsers	Provide normalized KQL functions for querying Vectra data
Workbook Template	Provides the Vectra RUX Security Dashboard and the Detection Timeline investigation workbook
Analytics Rule Templates	Provide incident creation rules for host and account detections
Playbooks / Logic Apps	Provide automation actions for enrichment, tagging, notes, assignments, and response workflows

Prerequisites

1. Microsoft Sentinel Workspace

A Log Analytics workspace with Microsoft Sentinel enabled is required. The connector is deployed into this workspace and its data flows into the custom tables described in this document.

2. Connect Microsoft Sentinel to the Defender Portal

If your Sentinel workspace is not yet connected to the Microsoft Defender portal, complete the following steps before proceeding with connector installation.

Required permissions for onboarding:

• Microsoft Entra ID: Security Administrator role
• Azure: Owner (unconditional role assignment at subscription scope) — or — User Access Administrator + Microsoft Sentinel Contributor

Steps to connect:

1. Go to the Microsoft Defender portal and sign in.
2. In the left navigation, select System > Settings > Microsoft Sentinel.
3. Select Connect a workspace.
4. Select the Log Analytics workspace that has Microsoft Sentinel enabled.
5. Select Next, then designate the Primary workspace.
6. Review the product change summary and select Connect.

After the workspace connects, a Microsoft Sentinel section appears in the left navigation pane and the Defender portal Home page displays Sentinel metrics such as the number of active data connectors and automation rules.

Note: Customers who onboarded to Microsoft Sentinel after July 1, 2025 may already be connected to the Defender portal automatically.

3. Vectra API Credentials

Create one dedicated API client in the Vectra AI platform for each data stream. Each client requires a Client ID and Client Secret with read-only scope. Recommended naming:

Stream	Recommended API Client Name
Detections	Defender-Detections (read-only)
Entities	Defender-Entities (read-only)
Lockdown	Defender-Lockdown (read-only)

Deployment

The connector supports two deployment modes depending on certification status.

Preview Deployment

During preview, customers deploy the solution using Deploy a custom template in the Azure portal using a JSON ARM template provided by Vectra. The ARM template includes the full Microsoft Sentinel solution package: Data Connector, Parsers, Custom Log Analytics tables, Workbook template, Analytics rule templates, and Playbooks / Logic Apps.

After ARM template deployment, the connector is configured from the Microsoft Defender portal as described in the Installation & Configuration section.

Content Hub Deployment

After certification, deployment is performed through Microsoft Sentinel Content Hub, accessible from the Defender portal. Customers install the Vectra RUX solution from Content Hub, then configure the connector, enable analytics rule templates, save the workbook template, and configure playbooks.

Data Connector

The connector polls the Vectra RUX API using OAuth2 client credentials. Each connection requires a connection alias, Vectra API base URL, Client ID, Client Secret, and the selected data stream.

A Data Stream is an individual ingestion pipeline within the connector that retrieves a specific category of data from the Vectra RUX API and writes it into a corresponding Log Analytics table. Each stream operates independently and defines the API endpoint being queried, the polling interval, the checkpoint or synchronization method, the target Log Analytics table, and the associated parser and transformation logic.

The three data streams within the Security Operations integration are:

Stream	Official Table	Parser	Checkpoint Method	Poll Interval
Detections	Detections_Data_CCF_CL	VectraRUXDetections	PersistentToken using next_checkpoint	5 minutes
Entities	Entities_Data_CCF_CL	VectraEntities	Sliding window using last_modified_timestamp_gte	10 minutes
Lockdown	Lockdown_Data_CCF_CL	VectraLockdown	Snapshot	5 minutes

Note: The previous Log Ingestion API (package version 3.3.0) uses table names without _CCF (example: Detections_Data_CL). These tables are joined when populating the workbook to provide a better experience during the migration period after deploying this CCF version of the integration.

Detections Stream

The detections stream uses an event-based checkpointing model built around the Vectra /events/detections API endpoint. Each detection event in Vectra is assigned a serialized event ID. As new events occur, the ID increments monotonically.

After each successful polling cycle, events are ingested into Detections_Data_CCF_CL and the highest processed event ID is stored as the checkpoint. The next polling cycle resumes from that checkpoint, ensuring the connector always continues from the exact point where the previous ingestion cycle ended.

Because the checkpoint is ID-based rather than time-based:

• Poll timing does not affect data continuity
• Connector restarts do not cause gaps
• Temporary outages do not lose events
• Clock drift issues are avoided

Even if the connector does not poll again for several minutes, hours, or days, the next poll will continue from the last processed detection event ID.

Detection Polling Example

Initial checkpoint: 105000

Poll #1:
  Retrieves events 105001 → 105250
  Stores checkpoint 105250

Poll #2:
  Retrieves events 105251 → 105400
  Stores checkpoint 105400

Determining the Detections Starting Checkpoint Seed Value

When the connector is initially configured, a starting event ID must be provided. The connector requests all events occurring after that ID. The recommended approach depends on the deployment type.

Term	Meaning
Greenfield Deployment	No prior Vectra integration exists in Sentinel
Migration Deployment	A prior Vectra integration already exists and the customer is transitioning to the CCF connector

Greenfield Deployments — An API call to the Vectra platform is required to determine the seed value:

GET <vectraApiUrl>/api/v3.5/events/detections?limit=1&ordering=-id

Copy the returned next_checkpoint value into the detections starting checkpoint field.

Migration Deployments — When a previous integration exists, the most recent event retrieved from Vectra is available via KQL in Advanced Hunting:

Detections_Data_CL
| summarize checkpoint = max(id)

Note: This query intentionally references the old table name Detections_Data_CL, as the previous integration has already populated data to a known point and the new connector should pick up from there.

Entities Stream

The entities stream uses time-based polling. The connector polls the Vectra entities endpoint every 10 minutes and retrieves entities modified since the previous polling window, using current_time - 10 minutes as the value for last_modified_timestamp_gte.

Example:

Current poll time: 14:00 UTC
Query parameter:   last_modified_timestamp_gte = 13:50 UTC

The entities stream continuously captures entity score changes, priority changes, assignment changes, state changes, tag updates, and entity metadata changes. Both host and account entities are included automatically.

Because the entities stream is time-window based, it does not maintain a serialized checkpoint and data continuity depends on successful polling intervals. Small overlap windows help reduce the chance of missed updates. This model is appropriate because entities represent continuously changing state (cumulative) rather than immutable event records.

Lockdown Stream

The lockdown stream uses a snapshot polling model. Every 5 minutes, the connector queries the current lockdown state from the Vectra API. If active lockdown records are returned, they are ingested into Lockdown_Data_CCF_CL.

The lockdown stream does not maintain a checkpoint because the API represents current state rather than historical events.

Important behavior: There is intentionally no post-processing deduplication for lockdown records. If an entity remains locked down for an extended period of time, the same lockdown record will be retrieved and ingested during every polling interval while the lockdown remains active.

Time	Result
12:00	Entity locked down
12:05	Same lockdown record ingested
12:10	Same lockdown record ingested
12:15	Same lockdown record ingested

This behavior is intentional. Repeated ingestion provides an operational audit trail showing that the entity remained continuously locked down throughout the observed period, and also allows operators to identify situations where a lockdown was manually removed, temporarily disappeared, or reinstated later. Because the stream represents observed state over time rather than unique events, duplicate records are expected behavior.

When evaluating current lockdown state, filter to recent records using Advanced Hunting:

Lockdown_Data_CCF_CL
| where TimeGenerated > ago(15m)

To analyze historical lockdown continuity, query the full table without deduplication.

Parsers

Use the included parsers for workbooks, analytics rules, hunting, and operational queries rather than querying the raw tables directly.

Parser	Source Table	Purpose
VectraRUXDetections	Detections_Data_CCF_CL	Normalized detection data
VectraDetectionsCombined	Detections_Data_CL Detections_Data_CCF_CL	Normalized detection data combining previous deployments
VectraEntities	Entities_Data_CCF_CL	Normalized entity data
VectraLockdown	Lockdown_Data_CCF_CL	Normalized lockdown data

Recommended:

VectraRUXDetections
| take 10

Deduplication Guidance

Detection records may contain multiple updates for the same detection ID. Use arg_max() to evaluate the latest known state:

VectraRUXDetections
| summarize arg_max(TimeGenerated, *) by ["Detection ID"]

Installation & Configuration

Installing the Connector

Preview Installation (ARM Template)

The ARM template is deployed via the Azure portal. After deployment, all configuration is performed in the Microsoft Defender portal.

1. Open the Azure portal.
2. Search for Deploy a custom template.
3. Select Build your own template in the editor.
4. Paste or upload the provided Vectra RUX ARM template.
5. Select the subscription, resource group, and Sentinel workspace.
6. Deploy the template.
7. Open the Microsoft Defender portal.
8. In the left navigation, go to Microsoft Sentinel > Configuration > Data connectors.
9. Search for Vectra RUX Security Data Connector and open it.
10. Add one connection per data stream: Detections, Entities, Lockdown.

Content Hub Installation

1. Open the Microsoft Defender portal.
2. In the left navigation, go to Microsoft Sentinel > Content management > Content hub.
3. Search for Vectra RUX and select the solution.
4. Select Install.
5. After installation completes, navigate to Microsoft Sentinel > Configuration > Data connectors.
6. Open the Vectra RUX Security Data Connector and configure the connector connections.
7. Enable analytics rule templates (see Analytics Rules).
8. Save the workbook template if required (see Workbooks).
9. Configure playbooks and automation rules as needed (see Playbooks).

Connector Configuration

A separate Vectra API client is recommended for each data stream to avoid OAuth2 rate limiting.

Configuring a connection:

1. In the Defender portal, go to Microsoft Sentinel > Configuration > Data connectors.
2. Search for and open the Vectra RUX Security Data Connector.
3. Select Open connector page.
4. Under Configuration, select Add connection.
5. Enter the following for each data stream:

Field	Value
Connection Alias	A descriptive name (e.g., Vectra-Detections, Vectra-Entities, Vectra-Lockdown)
Vectra API Base URL	Your Vectra platform URL (e.g., https://<your-brain>.portal.vectra.ai)
Client ID	OAuth2 Client ID from the Vectra API client
Client Secret	OAuth2 Client Secret from the Vectra API client
Data Stream	Select: Detections, Entities, or Lockdown
Detections Starting Checkpoint	(Detections stream only) The seed event ID (see checkpoint guidance above)

1. Select Connect.
2. Wait at least one minute before adding the next stream connection to avoid OAuth2 API rate limiting.

Repeat for each of the three streams: Detections, Entities, and Lockdown.

Verifying Data Flow

After 10–15 minutes, verify ingestion using Advanced Hunting.

1. In the Defender portal, go to Investigation & response > Hunting > Advanced hunting.
2. Run the following queries to confirm data is arriving.

Raw table verification:

Detections_Data_CCF_CL | take 10
Entities_Data_CCF_CL   | take 10
Lockdown_Data_CCF_CL   | take 10

Parser validation:

VectraRUXDetections      | take 10
VectraDetectionsCombined | take 10
VectraEntities           | take 10
VectraLockdown           | take 10

Monitoring Connector Health

Microsoft Sentinel connector health is written to the SentinelHealth table when auditing and health monitoring is enabled.

Note: The CCF-based connector does not use Azure Function Apps and therefore does not generate Function App telemetry or Application Insights exceptions. Connector health should be monitored using Microsoft Sentinel's native connector health capabilities.

Enabling Health Monitoring

1. In the Defender portal, go to System > Settings > Microsoft Sentinel.
2. Select Settings.
3. Select Auditing and health monitoring.
4. Select one of the following options:

Option	Description
Enable	Enables auditing and health monitoring for all supported Sentinel resource types
Configure diagnostic settings	Allows granular selection of monitored resource categories and destinations

For most deployments, selecting Enable is recommended. Microsoft Sentinel automatically creates the required diagnostic settings and begins sending health telemetry to the Log Analytics workspace.

Note: The SentinelHealth table is created automatically after the first health event is generated. This can take up to 30 minutes.

Verify the table is available using Advanced Hunting:

SentinelHealth | take 20

Recommended Connector Health Query

Returns the latest health state for the Vectra connector streams, filtered to failures only. Run this in Advanced Hunting for ad-hoc troubleshooting:

SentinelHealth
| where TimeGenerated > ago(24h)
| where SentinelResourceType == "Data connector"
| extend DestinationTable = tostring(ExtendedProperties.DestinationTable)
| extend StreamName = tostring(ExtendedProperties.StreamName)
| where DestinationTable in (
    "Detections_Data_CCF_CL",
    "Entities_Data_CCF_CL",
    "Lockdown_Data_CCF_CL"
  )
  or StreamName has_any (
    "Detections_Data_CCF_CL",
    "Entities_Data_CCF_CL",
    "Lockdown_Data_CCF_CL"
  )
| summarize arg_max(TimeGenerated, *) by DestinationTable
| project
    TimeGenerated,
    SentinelResourceName,
    DestinationTable,
    StreamName,
    Status,
    Description,
    Reason
| where Status != "Success"
| order by TimeGenerated desc

No results means there are no errors. Comment out the Status != "Success" line to review successful events as well.

Recommended Health Monitoring Alert Rule

Create a Scheduled Analytics Rule in Microsoft Sentinel to alert on connector failures.

1. In the Defender portal, go to Microsoft Sentinel > Configuration > Analytics.
2. Select Create > Scheduled query rule.
3. Configure using the following settings:

Setting	Recommended Value
Rule Type	Scheduled
Query Frequency	15 minutes
Query Period	30 minutes
Trigger Threshold	Greater than 0
Severity	Medium
Incident Creation	Enabled

SentinelHealth
| where TimeGenerated > ago(30m)
| where SentinelResourceType == "Data connector"
| extend DestinationTable = tostring(ExtendedProperties.DestinationTable)
| where DestinationTable in (
    "Detections_Data_CCF_CL",
    "Entities_Data_CCF_CL",
    "Lockdown_Data_CCF_CL"
  )
| where Status != "Success"

Microsoft also provides the Data collection health monitoring workbook through Content Hub, which visualizes connector ingestion trends, anomalies, and connector health state over time. Install it from: Microsoft Sentinel > Content management > Content hub > search Data collection health monitoring.

Advanced Hunting

Advanced Hunting in the Defender portal provides a unified KQL query interface across both Microsoft Sentinel tables and Defender XDR data. Vectra detection, entity, and lockdown data is immediately available alongside native Defender XDR telemetry — enabling cross-platform correlation without context switching.

Accessing Advanced Hunting:

1. In the Defender portal, go to Investigation & response > Hunting > Advanced hunting.

Example: Surface prioritized Vectra detections with Defender XDR device context

VectraRUXDetections
| summarize arg_max(TimeGenerated, *) by ["Detection ID"]
| where ["Unresolved Priority"] == true
| join kind=leftouter (
    DeviceInfo
    | project DeviceName, OSPlatform, PublicIP
  ) on $left.["Source IP"] == $right.PublicIP
| project
    ["Detection ID"],
    ["D Type Vname"],
    ["Detection Category"],
    ["Entity Name"],
    ["Source IP"],
    DeviceName,
    OSPlatform,
    ["Investigation Status"],
    TimeGenerated

Using Security Copilot in Advanced Hunting

The Defender portal includes Security Copilot embedded in Advanced Hunting. Analysts can describe what they want to find in natural language and Security Copilot will generate a KQL query. For Vectra data, this works best with specific prompts such as:

• "Show me all Vectra detections with unresolved priority from the last 24 hours"
• "Find Vectra entity records where urgency score is above 50 and the entity is prioritized"
• "Show Vectra lockdown events from the last hour"

Workbooks

VectraRUXSecurityDashboard

The solution includes the VectraRUXSecurityDashboard workbook template, which provides visibility into entity scoring and prioritization, detection activity, escalated and prioritized detections, MITRE ATT&CK mappings, data source classification, lockdown state, entity-to-detection drilldowns, and deep links into Vectra.

Workbook Tabs & Filters

Tab	Description
Entity	Entity priority, urgency, scoring, assignment, and drilldown views
Detections	Detection investigation, category counts, MITRE filtering, and selected detection details
Lockdown	Lockdown status by entity, lock timestamp, unlock timestamp, and locking user

The workbook includes filters for time range, prioritized status, entity type, data source type, detection category, detection behavior, MITRE technique, and lockdown status. Supported data source categories include AWS, Azure, Entra ID/M365, and Network.

Detection Timeline Workbook

The solution also includes the VectraDetectionTimeline workbook, a SOC-focused investigation workbook that shows the full event lifecycle of an individual Vectra detection — from initial creation through every evidence addition (append), context change (adjust), investigation status update, and eventual closure.

The workbook is designed to be used alongside the Vectra RUX Security Dashboard. Once an incident is opened in the Defender portal, analysts use the Detection Timeline to trace the complete history of the underlying detection and review how evidence evolved over time.

Panel	Description
Detection Summary	Pivot table showing all detections in the selected time range. Columns include entity, category, priority, first seen, latest update, event counts, assignment, and a direct Vectra link. Click any row to scope all lower panels to that detection.
Full Timeline	Chronological event log across all change types for the selected detection.
New Detection	Details for the initial detection event, including source/destination host and account names, destination domain, and expandable summary and detail views.
Evidence Appends	Details for each subsequent evidence addition, with the same field set as the New Detection panel.
Context Adjustments	Records of context-only changes such as tag updates, assignment changes, and external reference updates.
Investigation Status	Log of investigation status transitions.
State / Close	State and closure events with closure reason.
Triage	Triage activity records.
Linked Incidents	Sentinel incidents linked to the selected detection (visible when a Detection ID is selected).

Filters: Time Range, Detection ID (text or click-to-set), Entity ID, and Change Type (multi-select; applies to Detection Summary and Full Timeline panels).

Integration with VectraRUX-DetectionTimeline-Link playbook — A companion playbook automatically posts a comment on each new Sentinel incident containing the detection ID and a direct link to the Detection Timeline workbook, allowing analysts to navigate into the pre-filtered view without manual lookup.

Opening and Saving Workbooks

To view the workbook:

1. In the Defender portal, go to Microsoft Sentinel > Threat management > Workbooks.
2. Select the Templates tab.
3. Search for VectraRUXSecurityDashboard or VectraRUXTimelineWorkbook.
4. Select the workbook and choose View template.

To save the workbook to My workbooks:

1. Open the workbook from Templates.
2. Select Save.
3. Choose the subscription, resource group, and region.
4. Save the workbook.

Analytics Rules

The solution includes two Scheduled analytics rule templates — both rules should be enabled. These analytic rules create incidents for any detection that is prioritized (unresolved_priority = true) or has been manually escalated, regardless of priority. Two separate rules are required to ensure accurate entity mapping within Sentinel: hosts map to hostname, accounts map to username.

Incidents created by these rules appear in the unified incident queue at Investigation & response > Incidents & alerts > Incidents, alongside all other Defender XDR incidents.

Rule Template	Purpose
Vectra RUX - Create Incident for Escalated Host Detection or Unresolved Priority Host	Creates incidents for host detections that are escalated or unresolved priority
Vectra RUX - Create Incident for Escalated Account Detection or Unresolved Priority Account	Creates incidents for account detections that are escalated or unresolved priority

Rule Logic & Queries

Trigger condition — An incident is created when either condition is true:

Investigation Status == "escalated"
OR
Unresolved Priority == true

Shared rule configuration:

Setting	Value
Rule type	Scheduled
Enabled by default	No
Severity	High
Query frequency	10 minutes
Query period	10 minutes
Trigger operator	Greater than
Trigger threshold	0
Event grouping	One alert per result
Incident creation	Enabled
Incident grouping lookback	7 days
Reopen closed incidents	False

Host Rule Query:

VectraRUXDetections
| where ["Entity Type"] == "host"
| summarize arg_max(TimeGenerated, *) by ["Detection ID"]
| where ["Investigation Status"] == "escalated" or ["Unresolved Priority"] == true
| extend
    detection_name       = ["D Type Vname"],
    detection_category   = ["Detection Category"],
    entity_url           = replace_string(replace_string(URL, "api/v3.4/", ""), "api/v3.5/", ""),
    mitre_techniques     = tostring(Mitre),
    detection_tags       = tostring(Tags),
    assigned_to          = ["Assigned To"],
    entity_name          = ["Entity Name"],
    entity_uid           = ["Entity UID"],
    entity_id            = ["Entity ID"],
    detection_id         = ["Detection ID"],
    external_reference   = ["External Reference"],
    investigation_status = ["Investigation Status"],
    entity_type          = ["Entity Type"]

Account Rule Query:

VectraRUXDetections
| where ["Entity Type"] == "account"
| summarize arg_max(TimeGenerated, *) by ["Detection ID"]
| where ["Investigation Status"] == "escalated" or ["Unresolved Priority"] == true
| extend
    detection_name       = ["D Type Vname"],
    detection_category   = ["Detection Category"],
    entity_url           = replace_string(replace_string(URL, "api/v3.4/", ""), "api/v3.5/", ""),
    mitre_techniques     = tostring(Mitre),
    detection_tags       = tostring(Tags),
    assigned_to          = ["Assigned To"],
    entity_name          = ["Entity Name"],
    entity_uid           = ["Entity UID"],
    entity_id            = ["Entity ID"],
    detection_id         = ["Detection ID"],
    external_reference   = ["External Reference"],
    investigation_status = ["Investigation Status"],
    entity_type          = ["Entity Type"]

Entity Mapping:

Rule	Sentinel Entity Type	Mapping
Host rule	Host	HostName → entity_name
Account rule	Account	Name → entity_name, UPNSuffix → entity_uid

Custom Alert Details — Each alert includes the following details extracted from Vectra: Detection ID, Detection Name, Detection Category, Entity ID, Entity UID, Entity URL, Entity Type, Tags, Assigned To, Investigation Status, External Reference, and MITRE Techniques.

Enabling Analytics Rules

1. In the Defender portal, go to Microsoft Sentinel > Configuration > Analytics.
2. Select the Rule templates tab.
3. Search for Vectra RUX.
4. Select each Vectra RUX rule template.
5. Select Create rule, review the configuration, and enable the rule.

Viewing Incidents

Incidents generated by the Vectra analytics rules appear in the unified incident queue alongside Defender XDR incidents.

1. In the Defender portal, go to Investigation & response > Incidents & alerts > Incidents.
2. Use the filter options to narrow by source, severity, or status.
3. Vectra incidents include all custom alert details (Detection ID, Entity URL, MITRE Techniques, etc.) and are linked to host or account entity pages for further investigation.

When the VectraRUX-DetectionTimeline-Link playbook is configured and attached via an automation rule, each Vectra incident will include a comment with a direct link to the Detection Timeline workbook pre-filtered to the relevant detection.

Playbooks

The Vectra RUX solution includes several Microsoft Sentinel playbooks implemented as Azure Logic Apps. These playbooks extend SOAR capabilities, allowing analysts and automation workflows to interact directly with the Vectra AI platform for detection triage, entity management, assignment workflows, tagging, timeline synchronization, and PCAP evidence collection. The playbooks are connector-agnostic and work whether detections are ingested via the CCF connector or the legacy Function App connector.

Playbook Categories

Category	Purpose
Authentication	Generate and manage OAuth tokens
Detection Operations	Close, reopen, remediate, and tag detections
Entity Operations	Add notes, tags, assignments, and group membership
Incident Enrichment	Decorate incidents and synchronize timelines
Assignment and Triage	Assign ownership and resolve Vectra assignments
Notifications	Send Teams notifications and escalation prompts
Evidence Collection	Download PCAP files
Extensibility	Provide starter workflows for customization

Included Playbooks

Playbook	Purpose
VectraGenerateAccessToken	Generates OAuth access tokens for dependent playbooks
VectraCloseDetections	Closes one or more detections with a specified closure reason
VectraOpenClosedDetections	Reopens previously closed detections
VectraSetDetectionStatus	Acknowledges or closes detections based on Sentinel incident status
VectraAddNoteToEntity	Adds notes to Vectra entities
VectraAddNoteToDetections	Adds notes to individual Vectra detections
VectraAddTagToEntity	Adds tags to Vectra entities
VectraAddTagToDetections	Adds tags to individual Vectra detections
VectraAddTagToSelectedDetections	Adds tags to analyst-selected detections
VectraAddTagToEntityAllDetections	Adds tags to all detections associated with an entity
VectraAssignDynamicUserToEntity	Allows analysts to dynamically select and assign a Vectra user
VectraAssignStaticUserToEntity	Assigns a predefined Vectra user to an entity
VectraStaticAssignMemberToGroup	Adds entities to a predefined group
VectraDynamicAssignMemberToGroup	Allows dynamic group selection and entity assignment
VectraIncidentTimelineUpdate	Synchronizes and deduplicates Sentinel incident timeline data
VectraDownloadPcapFileToStorage	Retrieves PCAP evidence from Vectra to Azure Storage

Managing Playbooks in the Defender Portal

Playbooks are configured and managed from the automation section of Microsoft Sentinel.

1. In the Defender portal, go to Microsoft Sentinel > Configuration > Automation.
2. Select the Playbooks tab to view and manage all deployed Logic Apps.
3. To attach a playbook to an automation rule, select Automation rules and create or edit a rule.
4. In the automation rule, select Run playbook as the action and select the desired playbook.

Complete documentation for each playbook is provided in the Vectra RUX Playbooks for Microsoft Sentinel guide. That document includes the deployment, usage, and automation instructions for each playbook.

Best Practices & Operations

Operational best practices for the Vectra RUX integration are covered in the Vectra RUX Best Practices for Microsoft Sentinel guide. That document includes recommendations for data queries, parser usage, analytics rule configuration, connector operations, and SOC workflow guidance — including how to use automation rules and playbooks across the full incident lifecycle to accurately capture Vectra's MTTI and MTTR metrics.

The same guidance applies when operating this integration from the Microsoft Defender portal. The primary difference is navigation: all Microsoft Sentinel configuration, workbook, and analytics rule pages are accessed under the Microsoft Sentinel section of the Defender portal left navigation pane, and the unified incident queue is accessed at Investigation & response > Incidents & alerts > Incidents.

Appendix: Defender Portal Navigation Reference

The following table summarizes the navigation paths for all key tasks within this integration.

Task	Defender Portal Path
Connect Sentinel workspace	System > Settings > Microsoft Sentinel > Connect a workspace
Data connectors	Microsoft Sentinel > Configuration > Data connectors
Content Hub	Microsoft Sentinel > Content management > Content hub
Analytics rules	Microsoft Sentinel > Configuration > Analytics
Automation & playbooks	Microsoft Sentinel > Configuration > Automation
Workbooks	Microsoft Sentinel > Threat management > Workbooks
Advanced hunting (KQL)	Investigation & response > Hunting > Advanced hunting
Incidents queue	Investigation & response > Incidents & alerts > Incidents
Sentinel settings	System > Settings > Microsoft Sentinel
Threat hunting	Microsoft Sentinel > Threat management > Hunting

Appendix: Data Schema

Detections_Data_CCF_CL

Column	Type	Description
TimeGenerated	datetime	Time the record was ingested or derived from the detection event timestamp
Type	string	Azure Log Analytics table type
TenantId	string	Azure tenant identifier
_ResourceId	string	Azure resource identifier
id	real	Autoincrementing event ID used for checkpointing
detection_id	real	Vectra detection ID
change_type	string	Detection event change type
event_timestamp	datetime	Timestamp of the detection event in Vectra
event_type	string	Vectra event type
category	string	Detection category
threat	real	Threat score
certainty	real	Certainty score
severity	real	Severity score
d_type_vname	string	Human-readable detection type name
triaged	bool	Whether the detection has been triaged
detail	dynamic	Raw detection detail payload
d_detection_details	dynamic	Detection details object
detection_href	string	Direct link to the detection
detection_type	string	Internal detection type identifier
entity_id	real	Associated entity ID
entity_uid	string	Associated entity unique identifier
entity_name	string	Associated entity name
entity_type	string	Associated entity type
url	string	Direct link to associated entity
mitre	dynamic	MITRE ATT&CK mappings
is_prioritized	bool	Whether the detection is prioritized
is_targeting_key_asset	string	Whether the detection targets a key asset
unresolved_priority	bool	Whether the detection is an unresolved priority
investigation_status	string	Vectra investigation status
reason	string	Reason or status context
src_host	dynamic	Source host object
src_host_id	long	Source host ID
src_host_ip	string	Source host IP address
src_ip	string	Source IP alias
src_host_name	string	Source host name
src_host_url	string	Source host URL
src_host_certainty	real	Source host certainty score
src_host_threat	real	Source host threat score
src_host_is_key_asset	bool	Whether source host is a key asset
src_host_groups	dynamic	Source host group memberships
src_account	dynamic	Source account object
src_account_id	long	Source account ID
src_account_name	string	Source account name
src_account_url	string	Source account URL
src_account_groups	dynamic	Source account group memberships
dst_host	dynamic	Destination host object
dst_host_id	long	Destination host ID
dst_host_ip	string	Destination host IP address
dst_host_name	string	Destination host name
dst_host_url	string	Destination host URL
dst_host_session_luid	string	Destination host session LUID
dst_host_groups	dynamic	Destination host group memberships
dst_account	dynamic	Destination account object
dst_account_id	long	Destination account ID
dst_account_name	string	Destination account name
dst_account_uid	string	Destination account UID
dst_account_url	string	Destination account URL
dst_account_groups	dynamic	Destination account group memberships
dst_domain	dynamic	Destination domain object
dst_domain_dns	string	Destination domain DNS value
dst_domain_domain	string	Destination domain name
dst_domain_external_target	string	Destination external target
src_external_host	dynamic	External source host object
src_external_host_ip	string	External source host IP
src_external_host_name	string	External source host name
data_source	dynamic	Data source object
data_source_sensor_id	string	Sensor ID
data_source_sensor_name	string	Sensor name
data_source_type	string	Data source type
filters	dynamic	Filter metadata
filters_filtered_by_ai	bool	Whether filtered by AI
filters_filtered_by_rule	bool	Whether filtered by rule
filters_filtered_by_user	bool	Whether filtered by user
filters_is_custom_model	bool	Whether custom model filtering applied
filters_triaged	bool	Filter triage state
assignment	dynamic	Assignment object
assignment_id	long	Assignment ID
assignment_assigned_by	dynamic	Assigned-by user object
assignment_assigned_by_id	long	Assigned-by user ID
assignment_assigned_by_username	string	Assigned-by username
assignment_assigned_to	dynamic	Assigned-to user object
assignment_assigned_to_id	long	Assigned-to user ID
assignment_assigned_to_username	string	Assigned-to username
assignment_date_assigned	datetime	Assignment date
summary	dynamic	Detection summary
grouped_details	dynamic	Grouped detection details
tags	dynamic	Detection tags
normal_domains	dynamic	Normal domain context
external_reference_id	string	External ticket or case reference ID
process_context_data	dynamic	EDR or process context data

Entities_Data_CCF_CL

Column	Type	Description
TimeGenerated	datetime	Time the record was ingested or derived from last modified timestamp
Type	string	Azure Log Analytics table type
TenantId	string	Azure tenant identifier
_ResourceId	string	Azure resource identifier
id	real	Vectra entity ID
name	string	Entity name
breadth_contrib	real	Breadth contribution to urgency
importance	real	Entity importance score
entity_type	string	Entity type
is_prioritized	bool	Whether the entity is prioritized
severity	string	Entity severity
urgency_score	real	Urgency score
velocity_contrib	real	Velocity contribution
detection_set	dynamic	Associated detection set
last_detection_timestamp	datetime	Timestamp of latest detection
last_modified_timestamp	datetime	Last entity modification timestamp
notes	dynamic	Entity notes
attack_rating	real	Attack rating
privilege_level	real	Privilege level
privilege_category	string	Privilege category
attack_profile	string	Attack profile
sensors	dynamic	Associated sensors
state	string	Entity state
tags	dynamic	Entity tags
url	string	Entity URL
host_type	dynamic	Host type details
account_type	dynamic	Account type details
ip	string	IP address
assignment	dynamic	Raw assignment object
assignment_id	real	Assignment ID
assignment_assigned_by	dynamic	Assigned-by user object
assignment_assigned_by_id	real	Assigned-by user ID
assignment_assigned_by_username	string	Assigned-by username
assignment_date_assigned	datetime	Assignment date
assignment_assigned_to	dynamic	Assigned-to user object
assignment_assigned_to_id	real	Assigned-to user ID
assignment_assigned_to_username	string	Assigned-to username

Lockdown_Data_CCF_CL

Column	Type	Description
TimeGenerated	datetime	Time the record was ingested or derived from lock event timestamp
Type	string	Azure Log Analytics table type
TenantId	string	Azure tenant identifier
_ResourceId	string	Azure resource identifier
id	real	Lockdown record ID
lock_event_timestamp	datetime	Time lockdown was applied
locked_by	string	User who initiated lockdown
unlock_event_timestamp	datetime	Time lockdown expires or was removed
entity_id	real	Locked entity ID
entity_name	string	Locked entity name
entity_type	string	Locked entity type
certainty	real	Certainty score retained for backward compatibility