> For the complete documentation index, see [llms.txt](https://docs.vectra.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.vectra.ai/configuration/response/siem/splunk-siem-vectra-integration-guide-start-here-for-rux.md). # Splunk On-Prem SIEM / Vectra integration guide (start here for RUX) Start here for Splunk integration with Vectra Respond UX, including supported add-ons/apps, install matrix, API client setup, and data inputs. {% hint style="info" %} **Product Name Update:** We have changed the product name from **Vectra XDR** to **Vectra RUX**. {% endhint %} {% hint style="info" %} As stated in the summary, this article only applies to customers using Vectra's Respond UX. If you are using the Quadrant UX please see the [Splunk Integration Guide for Vectra AI.](/configuration/response/siem/splunk-siem-vectra-integration-guide-start-here-for-qux.md) If you are unsure of which UX you are using, please see [Vectra Analyst User Experiences (Respond vs Quadrant)](/deployment/getting-started/analyst-ux-options-rux-vs-qux.md). {% endhint %} ## Integration Overview Vectra AI provides Add-ons and Apps to seamlessly integrate with Splunk and Splunk Enterprise Security. Vectra provides 2 main data sources for Splunk: #### **Vectra RUX** * Vectra RUX uses a patent-pending combination of data science, machine learning and behavioral analysis to reveal the fundamental characteristics of malicious threat behavior. The Vectra platform captures packets and logs across public cloud, SaaS, federated identity and data center networks to surface and prioritize threats. These high-fidelity insights can be pulled via API to integrate seamlessly with your workflows and operations. #### **Network Metadata from Vectra Stream** * Leveraging the same platform, Vectra provides the ability to export network metadata collected by the Vectra Sensors deployed through the environment to Splunk. This data provides an in-depth view of any communication observed in your environment and enables you to perform investigation & threat hunting. A list of protocols supported, and attributes extracted is available [here](https://support.vectra.ai/s/article/KB-VS-1245). ### Vectra RUX Add-On and Apps for Splunk #### Vectra RUX
NameTypeSplunkbase LinkSupported Splunk VersionCIM CompatibilitySplunk CloudVectra PlatformData Structure
Vectra RUX Technology Add-onAdd-onhttps://splunkbase.splunk.com/app/699110.5, 10.4, 10.3, 10.2, 10.1, 10.0, 9.4, 9.3, 9.2, 9.1YesYesVectra Respond UXJSON
Vectra RUX AppApphttps://splunkbase.splunk.com/app/699210.5, 10.4, 10.3, 10.2, 10.1, 10.0, 9.4, 9.3, 9.2, 9.1YesYesVectra Respond UXn/a
#### Vectra Stream
NameTypeSplunkbase LinkSupported Splunk VersionCIM CompatibilitySplunk CloudData structureDependencies
Technology Add-on for Vectra Stream (JSON)Add-onhttps://splunkbase.splunk.com/app/636710.5, 10.4, 10.3, 10.2, 10.1, 10.0, 9.4, 9.3, 9.2, 9.1YesYesJSONN/A
Vectra StreamApphttps://splunkbase.splunk.com/app/473910.5, 10.4, 10.3, 10.2, 10.1, 10.0, 9.4, 9.3, 9.2, 9.1, 9.0YesYesn/a

Treemap

URL Toolbox

### Prerequisites Before configuring the Vectra AI integration with Splunk On-prem Platform, ensure the following requirements are met: * A valid Splunk account with access to Splunkbase to download the required Vectra apps and add-ons. * A supported version of Splunk Cloud Platform or Splunk Enterprise. * All application dependencies listed in the **Add-ons and Apps** table are installed and configured. * The required Splunk index or indexes are created before data ingestion begins. {% hint style="info" icon="triangle-exclamation" %} Vectra recommends using a **dedicated index** for **Vectra RUX** data. If Vectra Stream is also enabled, Vectra recommends creating a separate **dedicated index** for **Vectra Stream** data. {% endhint %} ## Integration of Splunk On-Prem with Vectra RUX Integrating Splunk On-Prem Platform with Vectra RUX involves three main steps: 1. Creating API clients in the Vectra Respond UX for use by the Technology Add-on. 2. Installing and configuring the **Vectra RUX Technology Add-on**. 3. Installing the **Vectra RUX App**. #### Create API Clients in Vectra Respond UX API clients must be created in the Vectra Respond UX. These API clients are used by the Vectra RUX Technology Add-on for Splunk to authenticate with the Vectra platform and retrieve data. #### Install and Configure the Vectra RUX Technology Add-on The **Vectra RUX Technology Add-on for Splunk** collects data from the Vectra platform, including: * Entity scoring data * Detection data * Audit data * Lockdown data * Health data The Technology Add-on performs CIM mapping for detection and audit data. It also maps entity scoring and detection data fields to the corresponding Vectra Syslog event fields. {% hint style="info" %} **Note:** If you are using a prior version of a Vectra Technology Add-on with an existing Quadrant UX-based Vectra deployment, you can continue to keep that deployment separate. However, the Technology Add-on and App for Vectra RUX using the Respond UX must be installed separately. You cannot upgrade from a prior version to this version. {% endhint %} ## 1. Creating API Clients for Splunk Integration Before configuring the Splunk integration, create separate API clients for each endpoint required by the integration. Creating individual API clients for each endpoint is required to ensure that the Splunk integration can securely and efficiently collect data from Vectra. #### Why Separate API Clients Are Required Separate API clients are required for the following reasons: * Each endpoint used by the Splunk integration is polled individually. * Different endpoints require different permission levels in Vectra. * Using separate API clients helps improve performance and scalability when accessing multiple API endpoints. * Troubleshooting is easier because each API client is associated with a specific endpoint and purpose. * Access can be managed more securely by assigning only the required permissions to each API client. #### API Clients Required for the Integration Create the following API clients for use with the Vectra Splunk integration. | API Client Name | Role | Purpose | | -------------------------- | --------- | ----------------------------------------------------- | | `ro_splunk_entity_scoring` | Read-only | Used by Splunk to poll the `entity_scoring` endpoint. | | `ro_splunk_detections` | Read-only | Used by Splunk to poll the `detections` endpoint. | | `ro_splunk_lockdown` | Read-only | Used by Splunk to poll the `lockdown` endpoint. | | `audit_splunk_audits` | Auditor | Used by Splunk to poll the `audits` endpoint. | | `audit_splunk_health` | Auditor | Used by Splunk to poll the `health` endpoint. | #### Recommended Naming Convention Use clear and descriptive API client names so that each client can be easily identified during configuration, maintenance, and troubleshooting. The recommended naming format is: `_splunk_` For example: `ro_splunk_detections` This naming convention indicates that the API client: * Uses a **read-only** role. * Is intended for **Splunk**. * Is associated with the **detections** endpoint. #### Permission Guidance Assign only the permissions required for each endpoint to follow the principle of least privilege. * Use a **Read-only** role for endpoints that require only read access. * Use an **Auditor** role for endpoints that require audit-level access. * Avoid using overly permissive roles unless they are specifically required. Following these guidelines helps maintain least-privilege access for the Splunk integration and reduces unnecessary permissions. ### RUX API Client Creation To create each of the API clients listed above, follow these steps: 1. Log in to **Vectra Respond UX (RUX)**. 2. Navigate to ***Configuration > API Clients*** under **Access**. 3. Click **Add API Client**.
Enter a name for the API client, select the appropriate role, and optionally provide a description. Once you have entered the required details, click **Generate Credentials**.
#### Save the API Client Credentials On the **API Client Created** screen, copy the **Client ID** and **Secret Key** and store them in a secure location for later configuration in Splunk. Then, click **Done**. {% hint style="warning" %} **Important:** The Secret Key is displayed only once and cannot be retrieved later. If you do not copy and securely save the Secret Key at this stage, you must delete the API client and create a new one to obtain a new key. {% endhint %}
Once you have created all five required API clients, your screen should look similar to the following:
#### After Creating the API Clients After all required API clients have been created: 1. **Securely save the client credentials.** Store the Client ID and Secret Key in a secure location for use during the Splunk configuration. 2. **Verify the assigned roles.** Confirm that each API client has been assigned the correct role. 3. **Configure the API clients in Splunk.** Use the API client credentials when configuring accounts in the **Vectra RUX Technology Add-on for Splunk**. 4. **Create the account configurations.** Create one account configuration in the add-on for each API client. 5. **Continue with the Splunk configuration.** Once all API clients are created and verified, proceed with the remaining add-on configuration steps in Splunk. ## 2. Installation and Configuration of "Vectra RUX Technology Add-on" #### Installation of the Vectra RUX Technology Add-on for Splunk This section explains how to install the **Vectra RUX Technology Add-on for Splunk**. The add-on can be installed using one of the following methods: 1. **Recommended:** Install the add-on from **Find More Apps** in Splunk Web. 2. **Alternative:** Install the add-on from a downloaded file using Splunk Web. 3. **Manual Installation:** Install the add-on directly from the Splunk server file system. Use the installation methods in the order listed above. The **Find More Apps** method is recommended because it allows the add-on to be installed directly from Splunk Web with minimal manual steps. #### Recommended Installation Order Install the add-on using the following order of preference: | Priority | Installation Method | When to Use | | -------- | ---------------------------------------- | ----------------------------------------------------------------- | | 1 | Install from **Find More Apps** | Recommended method for most Splunk environments | | 2 | Install from a file using **Splunk Web** | Use when you have already downloaded the add-on package | | 3 | Manual installation from the file system | Use when Splunk Web installation is not available or not suitable | #### Method 1: Install the Add-on from Find More Apps This is the recommended method for installing the **Vectra RUX Technology Add-on for Splunk**. Use this method if the add-on is available from the **Find More Apps** section in Splunk Web. #### Steps 1. Log in to Splunk Web using an administrator account. 2. From the Splunk home dashboard, go to the **Apps** section. 3. Click **Find More Apps**. 4. In the search bar, search for: **Vectra RUX Technology Add-on** 5. Select the **Vectra RUX Technology Add-on** from the search results. 6. Click **Install**. 7. Follow the on-screen instructions to complete the installation. 8. If Splunk prompts you to restart, restart the Splunk instance. 9. After the restart is complete, log back in to Splunk Web. 10. Navigate to: **Apps > Manage Apps** 11. Search for the **Vectra RUX Technology Add-on** and confirm that it is installed and enabled. #### Method 2: Install the Add-on from a File Using Splunk Web Use this method if the add-on package has already been downloaded and you want to upload it through Splunk Web. #### Steps 1. Download the **Vectra RUX Technology Add-on** package from Splunk. 2. Log in to Splunk Web using an administrator account. 3. From the Splunk home page, navigate to: **Apps > Manage Apps** 4. In the upper-right corner of the page, click: **Install app from file** 5. Click **Choose File**. 6. Browse to the location where the **Vectra RUX Technology Add-on** installation file is saved. 7. Select the add-on installation file. 8. Click **Upload**. 9. Follow the on-screen prompts to complete the installation. 10. If Splunk prompts you to restart, restart the Splunk instance. 11. After the restart is complete, verify that the add-on is installed by navigating to: **Apps > Manage Apps** 12. Search for the **Vectra RUX Technology Add-on** and confirm that it appears in the installed apps list. #### Verify the Installation After completing any of the installation methods, verify that the add-on was installed successfully. #### Steps 1. Log in to Splunk Web. 2. Navigate to: **Apps > Manage Apps** 3. Search for: **Vectra RUX Technology Add-on** 4. Confirm that the add-on appears in the list of installed apps. 5. Verify that the add-on status is **Enabled**. 6. If the add-on does not appear, restart Splunk and check again. #### Configure Accounts in the Vectra RUX Technology Add-on After the **Vectra RUX Technology Add-on for Splunk** is installed, configure the accounts that the add-on will use to authenticate with the Vectra platform. 1. In Splunk Cloud Platform, navigate to **Apps**. 2. Open **Vectra RUX Technology Add-on**. 3. Go to **Configuration > Account**. 4. Click **Add** to create a new account. 5. Add one account for each API client created earlier in the Vectra Respond UX. 6. Enter the required connection details, including the Vectra platform URL and the API client credentials. 7. Save each account configuration. When complete, the **Account** page should include separate account entries for each required API client, similar to the following: | Account Name | Purpose | | ----------------------- | ------------------------------------ | | `splunk_entity_scoring` | Polls the `entity_scoring` endpoint. | | `ro_splunk_detections` | Polls the `detections` endpoint. | | `ro_splunk_lockdown` | Polls the `lockdown` endpoint. | | `audit_splunk_audits` | Polls the `audits` endpoint. | | `audit_splunk_health` | Polls the `health` endpoint. | ![](https://4227135129-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHJ1ltuWFvsArFWtevnRn%2Fuploads%2Fgit-blob-b2863ef2506ef0c58ada50e65c5b5e12157cdebc%2F5cecf742961371a82cd42421c9fdf2109aae5fd7a170c18ab9a217e4322bdfde.jpg?alt=media) *** #### Configure Proxy Settings If your Splunk environment requires a proxy to connect to external services, configure the proxy settings in the add-on. Skip this section if your Splunk environment does not use a proxy. #### Steps 1. Navigate to: **Vectra RUX Technology Add-on > Configuration > Proxy** 2. Enable proxy configuration if required. 3. Enter the required proxy details, such as: * Proxy host * Proxy port * Proxy username, if authentication is required * Proxy password, if authentication is required 4. Save the proxy configuration. **Example Proxy Configuration:** ![](https://4227135129-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHJ1ltuWFvsArFWtevnRn%2Fuploads%2Fgit-blob-26eb1a27eb1e505da76823ec377fb3783829abda%2Fa84570baae6f15f23150e3480dc1b28c0e09fd076791e4caf036fbf8db116d5c.jpg?alt=media) #### Configure Logging Level The logging level controls the amount of detail written to the add-on logs. #### Steps 1. Navigate to: ***Vectra RUX Technology Add-on > Configuration > Logging*** 2. Select the desired logging level. 3. Save the configuration. If you are unsure which logging level to use, Vectra recommends selecting: ``` Info ``` The **Info** logging level provides a balanced amount of operational detail and is suitable for most environments. #### Recommended Logging Level | Logging Level | When to Use | | ------------- | ------------------------------------------------- | | **Info** | Recommended for normal operation. | | **Debug** | Use temporarily when troubleshooting an issue. | | **Error** | Use when you only want to capture error messages. | > **Note:** Debug logging can generate more log data. Use it only when troubleshooting and change the logging level back to **Info** after the issue is resolved. #### Verify the Add-on Configuration After completing the configuration: 1. Confirm that all required accounts are listed under the **Account** tab. 2. Confirm that proxy settings are configured only if required by your Splunk environment. 3. Confirm that the logging level is set to **Info**, unless a different level is needed. 4. Continue to the data input configuration section.
## 2.2 Vectra RUX Technology Add-on: New Installation and Data Input Configuration After installing the Vectra RUX Technology Add-on and configuring the required Vectra account. It explains how to create data inputs that collect data from the selected Vectra endpoints. Create a separate data input for each account and endpoint that you want to ingest into Splunk. {% hint style="info" %} **Note:** This is a new-installation and configuration guide. For an upgrade from v1.1.2 to v2.0.0, use the separate upgrade guide. {% endhint %} #### Add a New Data Input 1. Navigate to **Vectra RUX Technology Add-on**. 2. Open **Inputs**. 3. Select **Create New Input** or **Add Input**, depending on the option available in your Splunk interface. 4. Select the input type and configure the required fields. 5. Save the input and confirm that it is enabled. #### Data Input Configuration Fields Create a separate input for each Vectra account and endpoint that you want to ingest. Configure the following fields for the selected input type. #### Entity Scoring Input Fields * **Name:** A unique name for the data input. * **Interval:** How often Splunk polls the selected Vectra endpoint, in seconds. * **Index:** The Splunk index where collected events are stored. * **Vectra RUX Account:** The configured Vectra RUX account used to authenticate to the endpoint. * **Historical Data:** When enabled, collects the previous 24 hours of data on the first collection cycle. #### Detection Input Fields * **Name:** A unique name for the data input. * **Interval:** How often Splunk polls the selected Vectra endpoint, in seconds. * **Index:** The Splunk index where collected events are stored. * **Vectra RUX Account:** The configured Vectra RUX account used to authenticate to the endpoint. * **Historical Data:** When enabled, collects the previous 24 hours of data on the first collection cycle. This option is available only for Entity Scoring, Detection, and Audit inputs. * **From Checkpoint ID:** An optional event id from which collection begins on the first run. Use it when you want collection to start after a specific event instead of collecting the previous 24 hours. * **Include Triaged:** Include triaged detections. * **Include Info Category:** Include informational detections. * **Input Start Time:** Select the event timestamp source used for data collection. #### Audit Input Fields * **Name:** A unique name for the data input. * **Interval:** How often Splunk polls the selected Vectra endpoint, in seconds. * **Index:** The Splunk index where collected events are stored. * **Vectra RUX Account:** The configured Vectra RUX account used to authenticate to the endpoint. #### Lockdown Input Fields * **Name:** A unique name for the data input. * **Interval:** How often Splunk polls the selected Vectra endpoint, in seconds. * **Index:** The Splunk index where collected events are stored. * **Vectra RUX Account:** The configured Vectra RUX account used to authenticate to the endpoint. #### Health Input Fields * **Name:** A unique name for the data input. * **Interval:** How often Splunk polls the selected Vectra endpoint, in seconds. Use 900 seconds for the Health input. * **Index:** The Splunk index where collected events are stored. * **Vectra RUX Account:** The configured Vectra RUX account used to authenticate to the endpoint. * **Get Health EDR:** Collect data from the health EDR endpoint. * **Get Health EDR Details:** Collect data from the detailed health EDR endpoint. * **Get Health External Connectors:** Collect data from the health external connectors endpoint. * **Get Health External Connectors Details:** Collect data from the detailed health external connectors endpoint. #### Recommended Input Interval For Entity Scoring, Detection, Audit, and Lockdown inputs, an interval of **60 seconds** is recommended. Splunk checks the configured endpoint every 60 seconds and collects available data. #### Health Input Interval For the Health input, use an interval of **900 seconds**. Health data is refreshed every 15 minutes on the Vectra side, so the longer interval avoids unnecessary polling and aligns Splunk collection with the data refresh cycle. #### Historical Data Option Historical Data is optional. When enabled, the input collects data from the previous 24 hours. This can be useful in smaller environments when verifying that the add-on is working and data is reaching Splunk. {% hint style="info" %} **Important:** Historical Data is not available for Health or Lockdown inputs. {% endhint %} Use **From Checkpoint ID** with the latest event id when you need to resume collection without re-ingesting the previous 24 hours. Do not use detection\_id as the checkpoint value. Use this Splunk search to retrieve the latest event id: ```spl index=vectra_xdr source=detections_input | sort 0 - _time | head 1 | table _time id ``` Copy the id field from the result into **From Checkpoint ID**. Do not use detection\_id. #### Verify Data Input Configuration After creating data inputs: 1. Confirm that each required input appears in the **Inputs** table. 2. Verify that its status is **Enabled**. 3. Confirm that the correct Vectra account and Splunk index are selected. 4. Wait for the configured interval to pass. 5. Verify that data is being ingested by searching the configured index in Splunk Search. ![](https://4227135129-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHJ1ltuWFvsArFWtevnRn%2Fuploads%2Fgit-blob-9d247e6399fb041bac096bfee5579136ceda94bf%2F2af230f52b5c35d774caa1e97aabb0fa9081080594db50bcd2ec2b0fdbf0d8a0.jpg?alt=media) ## 3. Installation of Vectra RUX App for Splunk This section explains how to install, configure, troubleshoot, and uninstall the **Vectra RUX App for Splunk**. The Vectra RUX App provides dashboards and visualizations for data collected by the **Vectra RUX Technology Add-on for Splunk**. Before using the app, ensure that the add-on is installed, configured, and collecting data successfully. #### Installation The **Vectra XDR App for Splunk** can be installed using one of the following methods: 1. **Recommended:** Install the app from **Find More Apps** in Splunk Web. 2. **Alternative:** Install the app from a downloaded file using Splunk Web. #### Method 1: Install from Find More Apps Use this method if the app is available directly from Splunk Web. #### Steps 1. Log in to Splunk Web using an administrator account. 2. From the Splunk Home dashboard, go to the **Apps** section. 3. Click **Find More Apps**. 4. Search for: **Vectra RUX App for Splunk** 5. Select the app from the search results. 6. Click **Install**. 7. Follow the on-screen instructions to complete the installation. 8. Restart Splunk if prompted. 9. After installation, verify that the app is available from the Splunk Apps menu. #### Method 2: Install from a File Using Splunk Web Use this method if you have already downloaded the app package. #### Steps 1. Download the **Vectra RUX App for Splunk** package from Splunk. 2. Log in to Splunk Web using an administrator account. 3. Navigate to: **Apps > Manage Apps** 4. In the upper-right corner, click: **Install app from file** 5. Click **Choose File**. 6. Select the downloaded **Vectra RUX App** package. 7. Click **Upload**. 8. Follow the on-screen prompts to complete the installation. 9. Restart Splunk if prompted. 10. After installation, confirm that the app appears in the Splunk Apps menu. #### Configuration No additional configuration is required if the data collected by the add-on is stored in the default Splunk index: ``` main ``` However, if you configured the data inputs to send data to an index other than `main`, you must update the app macro so that the dashboards search the correct index. {% hint style="danger" %} **Important:** Updating the `vectra_xdr_index_macro` is required for the **Vectra RUX App for Splunk** to display data correctly when a custom index is used. If this macro is not updated, the dashboards may not show Vectra data because the app will continue searching the default `main` index. {% endhint %} #### Configure the App Index In the new Vectra RUX App for Splunk, you do not need to update the `vectra_xdr_index_macro` manually. 1. Log in to Splunk Web. 2. Open **Vectra RUX App for Splunk**. 3. Go to the **Configuration** section. 4. Select the index where the Vectra RUX Technology Add-on stores data from the **Index** drop-down. 5. Click **Save**. 6. Open the dashboards and confirm that data is displayed. The app uses the selected index for its dashboard searches. ## Uninstall and Clean Up Steps Use the following steps to uninstall the **Vectra RUX Technology Add-on for Splunk** and remove related log files from the Splunk instance. {% hint style="info" %} **Note:** Before removing files, ensure that you have the required permissions on the Splunk server. If needed, take a backup of the add-on configuration before uninstalling. {% endhint %} #### Remove the Add-on Directory Remove the add-on directory from the Splunk apps folder: ```bash $SPLUNK_HOME/etc/apps/TA-Vectra-XDR ``` This removes the installed add-on files from the Splunk instance. #### Remove Add-on Log Files Remove the log files generated by the add-on from the Splunk log directory: ```bash $SPLUNK_HOME/var/log/Splunk/ta_vectra_xdr_*.log ``` These log files are created by the add-on during configuration, data collection, and troubleshooting activities. #### Restart Splunk After removing the add-on directory and related log files, restart the Splunk Enterprise instance. Restarting Splunk ensures that the cleanup changes are reflected in the Splunk Web UI. ```bash $SPLUNK_HOME/bin/splunk restart ``` After the restart is complete, verify that the add-on no longer appears under: ``` Apps > Manage Apps ``` *** ## Troubleshooting This section provides basic troubleshooting steps for the **Vectra RUX Technology Add-on for Splunk**. Use these checks if the add-on is not working as expected, data is not being collected, or logs need to be reviewed. #### General Checks To troubleshoot the add-on, review the add-on log files located in the Splunk log directory: ```bash $SPLUNK_HOME/var/log/Splunk/ ``` All log files generated by this add-on are stored in this directory and use the following naming pattern: ```bash ta_vectra_xdr*.log ``` You can also review the logs directly from Splunk Web using the following search query: ```spl index="_internal" source=*ta_vectra_xdr*.log ``` This query displays all log messages generated by the add-on. To view only error messages, use the following query: ```spl index="_internal" source=*ta_vectra_xdr*.log ERROR ``` Review the error messages to identify configuration issues, authentication failures, connectivity problems, or data collection errors. #### Add-on Icons Are Not Showing The add-on does not require a Splunk restart immediately after installation for its core functionality to work. However, the add-on icons may not appear in Splunk Web until Splunk is restarted once after installation. If the icons are not visible: 1. Restart the Splunk Enterprise instance. ```bash $SPLUNK_HOME/bin/splunk restart ``` 2. Log back in to Splunk Web. 3. Navigate to the Apps menu and verify that the add-on icons are displayed. #### Data Collection Issues If data collection is not working, verify the following: 1. Confirm that the Splunk server has internet connectivity. 2. If your environment uses a proxy, confirm that the proxy is enabled and configured correctly in the add-on. 3. Confirm that the configured account credentials are correct. 4. Verify that the data inputs are enabled. 5. Confirm that the selected index exists and is searchable. 6. Review the relevant input log files for error messages. #### Input-Specific Log Files Each data input writes logs to a specific log file. Use the log file that matches the input type you are troubleshooting. | Input Type | Log File | | -------------- | ----------------------------------------------------- | | Entity Scoring | `ta_vectra_xdr_entity_scoring_input_.log` | | Detections | `ta_vectra_xdr_detections_input_.log` | | Audits | `ta_vectra_xdr_audits_input_.log` | | Lockdown | `ta_vectra_xdr_lockdown_input_.log` | | Health | `ta_vectra_xdr_health_input_.log` | Replace `` with the name of the data input configured in Splunk. #### Example Troubleshooting Searches Use the following Splunk searches to review add-on activity. #### View All Add-on Logs ```spl index="_internal" source=*ta_vectra_xdr*.log ``` #### View Add-on Errors ```spl index="_internal" source=*ta_vectra_xdr*.log ERROR ``` #### View Logs for a Specific Input ```spl index="_internal" source=*ta_vectra_xdr**.log ``` Replace `` with the name of the input you want to troubleshoot. #### Recommended Troubleshooting Flow Use the following order when troubleshooting data collection issues: 1. Confirm that the data input is enabled. 2. Confirm that the account configuration is correct. 3. Confirm that the index is configured correctly. 4. Check network connectivity from the Splunk server. 5. Verify proxy configuration, if a proxy is required. 6. Review the add-on logs in: ```bash $SPLUNK_HOME/var/log/Splunk/ ``` 7. Search the `_internal` index for add-on errors. 8. Resolve any errors found in the logs and restart Splunk if required. ## Troubleshooting Dashboards Use this section if dashboards are not displaying data or if you need to verify that Vectra data is available in Splunk. #### Verify Data in the Configured Index To confirm that data is being collected, run a search using the index configured for the add-on. Example: ```spl index= sourcetype IN ("vectralockdown", "vectraaudits", "vectradetections", "vectraentity:scoring", "vectrahealth") ``` Replace `` with the index used in your data input configuration. *** #### Search by Individual Sourcetype You can also search each sourcetype individually. #### Lockdown Events ```spl index= sourcetype="vectralockdown" ``` #### Audit Events ```spl index= sourcetype="vectraaudits" ``` #### Detection Events ```spl index= sourcetype="vectradetections" ``` #### Entity Scoring Events ```spl index= sourcetype="vectraentity:scoring" ``` #### Health Events ```spl index= sourcetype="vectrahealth" ``` #### Review Add-on Logs The Vectra RUX App uses data collected by the Vectra RUX Technology Add-on. If data is not available, review the add-on logs. The add-on log files are located in: ```bash $SPLUNK_HOME/var/log/splunk/ ``` Check log files that match the following pattern: ```bash ta_vectra_xdr_*.log ``` You can also search the logs from Splunk Web: ```spl index="_internal" source=*ta_vectra_xdr*.log ``` To view only error messages, use: ```spl index="_internal" source=*ta_vectra_xdr*.log ERROR ``` #### Dashboard Is Not Populating If the Vectra RUX App dashboards are not displaying data, verify the following: 1. Confirm that the Vectra RUX Technology Add-on is installed and collecting data. 2. Confirm that the data inputs are enabled. 3. Confirm that data exists in the configured index. 4. Confirm that the expected sourcetypes are available in Splunk. 5. If you are using a custom index, confirm that the `vectra_xdr_index_macro` macro is updated correctly. 6. Refresh the dashboard after updating the macro. 7. If required, restart Splunk and check the dashboard again. ## Integration of Splunk with Vectra Stream There are 3 main steps required to integrate Splunk with Vectra Stream: 1. Installation and configuration of "[Technology Add-on for Vectra Stream (JSON)](https://splunkbase.splunk.com/app/6367) ". 2. Installation of "[Vectra Stream](https://splunkbase.splunk.com/app/4739) " App. 3. Configuring Vectra Stream to send metadata to Splunk using Publisher of "Raw JSON" using Protocol of "TCP" to the server IP/Hostname and port number of your choice where Splunk will be listening. For details please see the [Splunk Integration Guide for Vectra AI](/deployment/stream/publisher-specific-guidance/splunk-integration.md) . --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.vectra.ai/configuration/response/siem/splunk-siem-vectra-integration-guide-start-here-for-rux.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.