Splunk Cloud SIEM / Vectra integration guide (start here for RUX)

Start here for Splunk Cloud integration with Vectra Respond UX, including supported add-ons/apps, install matrix, API client setup, and data inputs.

Product Name Update: We have changed the product name from Vectra XDR to Vectra RUX.

As stated in the summary, this article only applies to customers using Vectra's Respond UX. If you are using the Quadrant UX please see the Splunk Integration Guide for Vectra AI. If you are unsure of which UX you are using, please see Vectra Analyst User Experiences (Respond vs Quadrant).

Integration Overview

Vectra AI provides add-ons and apps that enable seamless integration with Splunk Cloud Platform and Splunk Enterprise Security. These integrations allow security teams to ingest, analyze, and operationalize Vectra data directly within Splunk workflows.

Vectra provides two primary data sources for Splunk:

Vectra RUX

• Vectra RUX uses a patent-pending combination of data science, machine learning and behavioral analysis to reveal the fundamental characteristics of malicious threat behavior. The Vectra platform captures packets and logs across public cloud, SaaS, federated identity and data center networks to surface and prioritize threats. These high-fidelity insights can be pulled via API to integrate seamlessly with your workflows and operations.

Network Metadata from Vectra Stream

• Leveraging the same platform, Vectra provides the ability to export network metadata collected by the Vectra Sensors deployed through the environment to Splunk. This data provides an in-depth view of any communication observed in your environment and enables you to perform investigation & threat hunting. A list of protocols supported, and attributes extracted is available here.

Vectra RUX Add-On and Apps for Splunk

Vectra RUX

Vectra RUX uses a patent-pending combination of data science, machine learning, and behavioral analysis to identify the fundamental characteristics of malicious threat behavior. The Vectra platform collects and analyzes packets and logs across public cloud, SaaS, federated identity, and data center environments to surface and prioritize high-fidelity threat detections.

These insights can be retrieved through the Vectra API and integrated into Splunk to support investigation, alert triage, threat hunting, and security operations workflows.

Name	Type	Splunkbase Link	Supported Splunk Version	CIM Compatibility	Splunk Cloud	Vectra Platform	Data Structure
Vectra RUX Technology Add-on	Add-on	https://splunkbase.splunk.com/app/6991	10.5, 10.4, 10.3, 10.2, 10.1, 10.0, 9.4, 9.3, 9.2, 9.1	Yes	Yes	Vectra Respond UX	JSON
Vectra RUX App	App	https://splunkbase.splunk.com/app/6992	10.5, 10.4, 10.3, 10.2, 10.1, 10.0, 9.4, 9.3, 9.2, 9.1	Yes	Yes	Vectra Respond UX	n/a

Vectra Stream

Vectra Stream enables the export of network metadata collected by Vectra Sensors deployed across the environment. This metadata provides detailed visibility into observed communications, helping security teams perform deeper investigations, threat hunting, and network behavior analysis in Splunk.

Name	Type	Splunkbase Link	Supported Splunk Version	CIM Compatibility	Splunk Cloud	Data structure	Dependencies
Technology Add-on for Vectra Stream (JSON)	Add-on	https://splunkbase.splunk.com/app/6367	10.5, 10.4, 10.3, 10.2, 10.1, 10.0, 9.4, 9.3, 9.2, 9.1	Yes	Yes	JSON	N/A
Vectra Stream	App	https://splunkbase.splunk.com/app/4739	10.5, 10.4, 10.3, 10.2, 10.1, 10.0, 9.4, 9.3, 9.2, 9.1, 9.0	Yes	Yes	n/a	Treemap URL Toolbox

A list of supported protocols and extracted attributes is available here.

Installation Matrix

Splunk Node	What to install	Notes
Search Head	Add-on and App	Both must be installed for distributed or standalone Splunk
Indexer	Add-on only	Do not install on Indexer if using Heavy Forwarders
Heavy Forwarder	Add-on only	Must be installed here if using Heavy Forwarders
Universal Forwarder	None

Please Note!! In the scenario of a standalone Splunk setup (all-in-one), install both the add-on and the app.

Prerequisites

Before configuring the Vectra AI integration with Splunk Cloud Platform, ensure the following requirements are met:

• A valid Splunk account with access to Splunkbase to download the required Vectra apps and add-ons.
• A supported version of Splunk Cloud Platform or Splunk Enterprise.
• All application dependencies listed in the Add-ons and Apps table are installed and configured.
• The required Splunk index or indexes are created before data ingestion begins.

Vectra recommends using a dedicated index for Vectra RUX data. If Vectra Stream is also enabled, Vectra recommends creating a separate dedicated index for Vectra Stream data.

Integration of Splunk Cloud with Vectra RUX

Integrating Splunk Cloud Platform with Vectra RUX involves three main steps:

1. Creating API clients in the Vectra Respond UX for use by the Technology Add-on.
2. Installing and configuring the Vectra RUX Technology Add-on.
3. Installing the Vectra RUX App.

Create API Clients in Vectra Respond UX

API clients must be created in the Vectra Respond UX. These API clients are used by the Vectra RUX Technology Add-on for Splunk to authenticate with the Vectra platform and retrieve data.

Install and Configure the Vectra RUX Technology Add-on

The Vectra RUX Technology Add-on for Splunk collects data from the Vectra platform, including:

• Entity scoring data
• Detection data
• Audit data
• Lockdown data
• Health data

The Technology Add-on performs CIM mapping for detection and audit data. It also maps entity scoring and detection data fields to the corresponding Vectra Syslog event fields.

Note: If you are using a prior version of a Vectra Technology Add-on with an existing Quadrant UX-based Vectra deployment, you can continue to keep that deployment separate. However, the Technology Add-on and App for Vectra RUX using the Respond UX must be installed separately. You cannot upgrade from a prior version to this version.

1. Creating API Clients for Splunk Integration

Before configuring the Splunk integration, create separate API clients for each endpoint required by the integration.

Creating individual API clients for each endpoint is required to ensure that the Splunk integration can securely and efficiently collect data from Vectra.

Why Separate API Clients Are Required

Separate API clients are required for the following reasons:

• Each endpoint used by the Splunk integration is polled individually.
• Different endpoints require different permission levels in Vectra.
• Using separate API clients helps improve performance and scalability when accessing multiple API endpoints.
• Troubleshooting is easier because each API client is associated with a specific endpoint and purpose.
• Access can be managed more securely by assigning only the required permissions to each API client.

API Clients Required for the Integration

Create the following API clients for use with the Vectra Splunk integration.

API Client Name	Role	Purpose
ro_splunk_entity_scoring	Read-only	Used by Splunk to poll the entity_scoring endpoint.
ro_splunk_detections	Read-only	Used by Splunk to poll the detections endpoint.
ro_splunk_lockdown	Read-only	Used by Splunk to poll the lockdown endpoint.
audit_splunk_audits	Auditor	Used by Splunk to poll the audits endpoint.
audit_splunk_health	Auditor	Used by Splunk to poll the health endpoint.

Recommended Naming Convention

Use clear and descriptive API client names so that each client can be easily identified during configuration, maintenance, and troubleshooting.

The recommended naming format is:

<role>_splunk_<endpoint>

For example:

ro_splunk_detections

This naming convention indicates that the API client:

• Uses a read-only role.
• Is intended for Splunk.
• Is associated with the detections endpoint.

Permission Guidance

Assign only the permissions required for each endpoint to follow the principle of least privilege.

• Use a Read-only role for endpoints that require only read access.
• Use an Auditor role for endpoints that require audit-level access.
• Avoid using overly permissive roles unless they are specifically required.

Following these guidelines helps maintain least-privilege access for the Splunk integration and reduces unnecessary permissions.

RUX API Client Creation

To create each of the API clients listed above, follow these steps:

1. Log in to Vectra Respond UX (RUX).
2. Navigate to Configuration > API Clients under Access.
3. Click Add API Client.

Enter a name for the API client, select the appropriate role, and optionally provide a description. Once you have entered the required details, click Generate Credentials.

Save the API Client Credentials

On the API Client Created screen, copy the Client ID and Secret Key and store them in a secure location for later configuration in Splunk. Then, click Done.

Important: The Secret Key is displayed only once and cannot be retrieved later. If you do not copy and securely save the Secret Key at this stage, you must delete the API client and create a new one to obtain a new key.

Once you have created all five required API clients, your screen should look similar to the following:

After Creating the API Clients

After all required API clients have been created:

1. Securely save the client credentials. Store the Client ID and Secret Key in a secure location for use during the Splunk configuration.
2. Verify the assigned roles. Confirm that each API client has been assigned the correct role.
3. Configure the API clients in Splunk. Use the API client credentials when configuring accounts in the Vectra RUX Technology Add-on for Splunk.
4. Create the account configurations. Create one account configuration in the add-on for each API client.
5. Continue with the Splunk configuration. Once all API clients are created and verified, proceed with the remaining add-on configuration steps in Splunk.

2. Install and Configure the Vectra RUX Technology Add-on

Install the Add-on in Splunk Cloud

Install the Vectra RUX Technology Add-on for Splunk in your Splunk Cloud Platform environment using one of the supported Splunk Cloud installation methods.

Option 1: Install from Splunkbase in Splunk Cloud (Recommended)

1. Log in to Splunk Cloud Platform with an account that has the required administrative permissions.
2. From the Splunk Home page, navigate to Apps > Find More Apps.
3. Search for Vectra RUX Technology Add-on.
4. Select the add-on and click Install.
5. When prompted, enter your Splunk.com credentials and accept the license terms.
6. After installation completes, verify that the add-on appears under Apps > Manage Apps.

Option 2: Install from an App Package

1. Download the Vectra RUX Technology Add-on package from Splunkbase.
2. Log in to Splunk Cloud Platform with the required administrative permissions.
3. Navigate to Apps > Manage Apps.
4. Select Install app from file or Upload App, depending on your Splunk Cloud experience.
5. Click Choose file and select the downloaded add-on package.
6. Click Upload and follow the prompts.
7. Wait for Splunk Cloud to validate the app package.
8. After the package is approved, click Install.
9. Confirm that the add-on appears under Apps > Manage Apps.

Note: If self-service installation is not available for your Splunk Cloud deployment or the add-on requires manual review, contact Splunk Support to request installation.

Configure Accounts in the Vectra RUX Technology Add-on

After the Vectra RUX Technology Add-on for Splunk is installed, configure the accounts that the add-on will use to authenticate with the Vectra platform.

1. In Splunk Cloud Platform, navigate to Apps.
2. Open Vectra RUX Technology Add-on.
3. Go to Configuration > Account.
4. Click Add to create a new account.
5. Add one account for each API client created earlier in the Vectra Respond UX.
6. Enter the required connection details, including the Vectra platform URL and the API client credentials.
7. Save each account configuration.

When complete, the Account page should include separate account entries for each required API client, similar to the following:

Account Name	Purpose
splunk_entity_scoring	Polls the entity_scoring endpoint.
ro_splunk_detections	Polls the detections endpoint.
ro_splunk_lockdown	Polls the lockdown endpoint.
audit_splunk_audits	Polls the audits endpoint.
audit_splunk_health	Polls the health endpoint.

If a proxy is required in your Splunk environment, configure this in the Proxy tab of the Add-on Configuration.

Choose a desired Logging level (If unsure, Vectra recommends "Info").

2.2 Vectra RUX Technology Add-on: New Installation and Data Input Configuration

After installing the Vectra RUX Technology Add-on and configuring the required Vectra account. It explains how to create data inputs that collect data from the selected Vectra endpoints. Create a separate data input for each account and endpoint that you want to ingest into Splunk.

Note: This is a new-installation and configuration guide. For an upgrade from v1.1.2 to v2.0.0, use the separate upgrade guide.

Add a New Data Input

1. Navigate to Vectra RUX Technology Add-on.
2. Open Inputs.
3. Select Create New Input or Add Input, depending on the option available in your Splunk interface.
4. Select the input type and configure the required fields.
5. Save the input and confirm that it is enabled.

Data Input Configuration Fields

Create a separate input for each Vectra account and endpoint that you want to ingest. Configure the following fields for the selected input type.

Entity Scoring Input Fields

• Name: A unique name for the data input.
• Interval: How often Splunk polls the selected Vectra endpoint, in seconds.
• Index: The Splunk index where collected events are stored.
• Vectra RUX Account: The configured Vectra RUX account used to authenticate to the endpoint.
• Historical Data: When enabled, collects the previous 24 hours of data on the first collection cycle.

Detection Input Fields

• Name: A unique name for the data input.
• Interval: How often Splunk polls the selected Vectra endpoint, in seconds.
• Index: The Splunk index where collected events are stored.
• Vectra RUX Account: The configured Vectra RUX account used to authenticate to the endpoint.
• Historical Data: When enabled, collects the previous 24 hours of data on the first collection cycle. This option is available only for Entity Scoring, Detection, and Audit inputs.
• From Checkpoint ID: An optional event id from which collection begins on the first run. Use it when you want collection to start after a specific event instead of collecting the previous 24 hours.
• Include Triaged: Include triaged detections.
• Include Info Category: Include informational detections.
• Input Start Time: Select the event timestamp source used for data collection.

Audit Input Fields

• Name: A unique name for the data input.
• Interval: How often Splunk polls the selected Vectra endpoint, in seconds.
• Index: The Splunk index where collected events are stored.
• Vectra RUX Account: The configured Vectra RUX account used to authenticate to the endpoint.

Lockdown Input Fields

• Name: A unique name for the data input.
• Interval: How often Splunk polls the selected Vectra endpoint, in seconds.
• Index: The Splunk index where collected events are stored.
• Vectra RUX Account: The configured Vectra RUX account used to authenticate to the endpoint.

Health Input Fields

• Name: A unique name for the data input.
• Interval: How often Splunk polls the selected Vectra endpoint, in seconds. Use 900 seconds for the Health input.
• Index: The Splunk index where collected events are stored.
• Vectra RUX Account: The configured Vectra RUX account used to authenticate to the endpoint.
• Get Health EDR: Collect data from the health EDR endpoint.
• Get Health EDR Details: Collect data from the detailed health EDR endpoint.
• Get Health External Connectors: Collect data from the health external connectors endpoint.
• Get Health External Connectors Details: Collect data from the detailed health external connectors endpoint.

Recommended Input Interval

For Entity Scoring, Detection, Audit, and Lockdown inputs, an interval of 60 seconds is recommended. Splunk checks the configured endpoint every 60 seconds and collects available data.

Health Input Interval

For the Health input, use an interval of 900 seconds. Health data is refreshed every 15 minutes on the Vectra side, so the longer interval avoids unnecessary polling and aligns Splunk collection with the data refresh cycle.

Historical Data Option

Historical Data is optional. When enabled, the input collects data from the previous 24 hours. This can be useful in smaller environments when verifying that the add-on is working and data is reaching Splunk.

Important: Historical Data is not available for Health or Lockdown inputs.

Use From Checkpoint ID with the latest event id when you need to resume collection without re-ingesting the previous 24 hours. Do not use detection_id as the checkpoint value.

Use this Splunk search to retrieve the latest event id:

index=vectra_xdr source=detections_input
| sort 0 - _time
| head 1
| table _time id

Copy the id field from the result into From Checkpoint ID. Do not use detection_id.

Verify Data Input Configuration

After creating data inputs:

1. Confirm that each required input appears in the Inputs table.
2. Verify that its status is Enabled.
3. Confirm that the correct Vectra account and Splunk index are selected.
4. Wait for the configured interval to pass.
5. Verify that data is being ingested by searching the configured index in Splunk Search.

3. Install the Vectra RUX App

The Vectra RUX App for Splunk provides dashboards and visualizations using the data collected by the Vectra RUX Technology Add-on for Splunk. Install this app after the Technology Add-on has been installed and configured.

Install the App in Splunk Cloud

Install the Vectra RUX App in Splunk Cloud Platform using one of the supported installation methods.

Option 1: Install from Splunkbase in Splunk Cloud (Recommended)

1. Log in to Splunk Cloud Platform with an account that has the required administrative permissions.
2. From the Splunk Home page, navigate to Apps > Find More Apps.
3. Search for Vectra RUX App.
4. Select the app and click Install.
5. When prompted, enter your Splunk.com credentials and accept the license terms.
6. After installation completes, verify that the app appears under Apps > Manage Apps.

Option 2: Install from an App Package

1. Download the Vectra RUX App package from Splunkbase.
2. Log in to Splunk Cloud Platform with the required administrative permissions.
3. Navigate to Apps > Manage Apps.
4. Select Install app from file or Upload App, depending on your Splunk Cloud experience.
5. Click Choose File and select the downloaded app package.
6. Click Upload and follow the prompts.
7. Wait for Splunk Cloud to validate the app package.
8. After installation completes, confirm that the app appears under Apps > Manage Apps.

Note: Depending on your Splunk Cloud deployment and permissions, app package uploads may require validation or assistance from Splunk Support.

After the app is installed, dashboards will begin populating once the Vectra RUX Technology Add-on successfully ingests data into the configured index.

Configuration

No additional configuration is required if the data collected by the add-on is stored in the default Splunk index:

main

However, if you configured the data inputs to send data to an index other than main, you must update the app macro so that the dashboards search the correct index.

Important: Updating the vectra_xdr_index_macro is required for the Vectra RUX App for Splunk to display data correctly when a custom index is used. If this macro is not updated, the dashboards may not show Vectra data because the app will continue searching the default main index.

Configure the App Index

In the new Vectra RUX App for Splunk, you do not need to update the vectra_xdr_index_macro manually.

1. Log in to Splunk Web.
2. Open Vectra RUX App for Splunk.
3. Go to the Configuration section.
4. Select the index where the Vectra RUX Technology Add-on stores data from the Index drop-down.
5. Click Save.
6. Open the dashboards and confirm that data is displayed.

The app uses the selected index for its dashboard searches.

Uninstall and Cleanup Steps

To remove the Vectra RUX Splunk integration from Splunk Cloud Platform, complete the following steps.

Disable Data Inputs

1. In Splunk Cloud Platform, open the Vectra RUX Technology Add-on.
2. Navigate to Inputs.
3. Disable each configured Vectra data input.
4. Confirm that data ingestion has stopped before continuing with the uninstall process.

Remove Account Configurations

1. Navigate to Vectra RUX Technology Add-on > Configuration > Account.
2. Delete the Vectra SaaS account entries associated with the configured API clients.
3. Confirm that all Vectra account configurations have been removed.

Uninstall the Vectra RUX App and Technology Add-on

1. In Splunk Cloud Platform, navigate to Apps > Manage Apps.
2. Locate the Vectra RUX App.
3. Select Uninstall and follow the prompts.
4. Locate the Vectra RUX Technology Add-on.
5. Select Uninstall and follow the prompts.

Note: If the uninstall option is not available in Splunk Cloud, contact Splunk Support or use the supported Splunk Cloud app management workflow for your deployment.

Cleanup Considerations

Direct filesystem cleanup steps, such as removing files from $SPLUNK_HOME/etc/apps/ or deleting logs from $SPLUNK_HOME/var/log/, apply to self-managed Splunk Enterprise deployments and are not applicable to Splunk Cloud Platform.

Restarting Splunk is also handled by Splunk Cloud as part of the managed service. If a restart or additional cleanup is required, contact Splunk Support.

Uninstalling the app and add-on does not automatically remove indexed Vectra data. If historical Vectra data must also be removed, review your organization’s data retention requirements and coordinate with your Splunk Cloud administrator or Splunk Support.

Troubleshooting

General Checks

For Splunk Cloud Platform, Vectra RUX Technology Add-on logs are not accessed directly from the filesystem. Instead, use Splunk Search to review logs from the _internal index.

To list available Splunk internal log sources from the last 24 hours, run:

index=_internal earliest=-24h
| dedup source
| sort source
| table source

To identify Vectra-related log sources, run:

index=_internal earliest=-24h source="*vectra*"
| dedup source
| sort source
| table source

This is useful when troubleshooting the Vectra RUX integration because it helps identify which Vectra-related log files are available in Splunk Cloud.

Example Vectra log sources may include:

/opt/splunk/var/log/splunk/ep/extension-platform-worker-TA-Vectra-XDR.log
/opt/splunk/var/log/splunk/ta_vectra_xdr_TA_Vectra_XDR_rh_account.log
/opt/splunk/var/log/splunk/ta_vectra_xdr_account_validation.log
/opt/splunk/var/log/splunk/ta_vectra_xdr_audits_input.log
/opt/splunk/var/log/splunk/ta_vectra_xdr_audits_input_<input_name>.log
/opt/splunk/var/log/splunk/ta_vectra_xdr_common.log
/opt/splunk/var/log/splunk/ta_vectra_xdr_detections_input.log
/opt/splunk/var/log/splunk/ta_vectra_xdr_detections_input_<input_name>.log
/opt/splunk/var/log/splunk/ta_vectra_xdr_entity_scoring_input.log
/opt/splunk/var/log/splunk/ta_vectra_xdr_entity_scoring_input_<input_name>.log
/opt/splunk/var/log/splunk/ta_vectra_xdr_health_input.log
/opt/splunk/var/log/splunk/ta_vectra_xdr_health_input_<input_name>.log
/opt/splunk/var/log/splunk/ta_vectra_xdr_lockdown_input.log
/opt/splunk/var/log/splunk/ta_vectra_xdr_lockdown_input_<input_name>.log

Search Add-on Logs

To view all Vectra RUX Technology Add-on logs in Splunk Cloud, run:

index=_internal earliest=-24h source="*ta_vectra_xdr*.log"

To view only error messages from the add-on logs, run:

index=_internal earliest=-24h source="*ta_vectra_xdr*.log" ERROR

You can also search all Vectra-related internal logs by using:

index=_internal earliest=-24h source="*vectra*"

Data Collection Troubleshooting

If Vectra data is not being collected, verify the following:

• The Vectra SaaS account configuration is correct.
• The API client credentials are valid.
• The configured API client has the required role and permissions for the endpoint.
• The data input is enabled.
• The configured index exists and is searchable.
• Network connectivity to the Vectra platform is available.
• If a proxy is used, confirm that the proxy configuration is correct and that the proxy can reach the Vectra platform.

Review the relevant log source based on the input being troubleshot:

Data Input	Log Source
Entity Scoring	ta_vectra_xdr_entity_scoring_input*.log
Detections	ta_vectra_xdr_detections_input*.log
Audits	ta_vectra_xdr_audits_input*.log
Lockdown	ta_vectra_xdr_lockdown_input*.log
Health	ta_vectra_xdr_health_input*.log
Account validation	ta_vectra_xdr_account_validation.log
Common add-on logs	ta_vectra_xdr_common.log

For example, to troubleshoot detection input logs, run:

index=_internal earliest=-24h source="*ta_vectra_xdr_detections_input_Splunk_RUX_Detections.log"

Validate Collected Data

To confirm that Vectra data is being written to the configured index, run searches using the correct source and sourcetype values.

To check all supported Vectra RUX data types in the configured index, run:

index=<your_index_name> earliest=-24h
(
  (source="health_input" sourcetype="vectra:cloud:health")
  OR (source="detections_input" sourcetype="vectra:cloud:detections")
  OR (source="audits_input" sourcetype="vectra:cloud:audits")
  OR (source="entity_scoring_input" sourcetype="vectra:cloud:entity:scoring")
  OR (source="lockdown_input" sourcetype="vectra:cloud:lockdown")
)

You can also validate each data type individually.

Health Data

index=<your_index_name> earliest=-24h source="health_input" sourcetype="vectra:cloud:health"

Detection Data

index=<your_index_name> earliest=-24h source="detections_input" sourcetype="vectra:cloud:detections"

Audit Data

index=<your_index_name> earliest=-24h source="audits_input" sourcetype="vectra:cloud:audits"

Entity Scoring Data

index=<your_index_name> earliest=-24h source="entity_scoring_input" sourcetype="vectra:cloud:entity:scoring"

Lockdown Data

index=<your_index_name> earliest=-24h source="lockdown_input" sourcetype="vectra:cloud:lockdown"

If these searches return events, the Vectra RUX Technology Add-on is successfully collecting data and writing it to the configured index. If no events are returned, verify that the related data input is enabled, the selected index is correct, and the corresponding Vectra SaaS account is configured with the correct API client credentials.

Dashboard Not Populating

If the Vectra RUX App dashboards are not displaying data, verify the following:

1. Confirm that Vectra data is being collected in the configured index.
2. Confirm that the correct sourcetypes are present.
3. Confirm that the vectra_xdr_index_macro macro is updated to reference the index used by the Vectra RUX Technology Add-on.
4. Confirm that the time range selected in the dashboard includes the time period when data was collected.

Important: If a custom index is used and the vectra_xdr_index_macro macro is not updated, the Vectra RUX App dashboards may not display data because the app may continue searching the default main index.

Add-on Icons Not Displaying

The Vectra RUX Technology Add-on does not require a restart for its core functionality after installation. However, app or add-on icons may not appear immediately in the Splunk UI.

In Splunk Cloud Platform, restarts are managed by Splunk Cloud. If icons do not appear after installation and a restart is required, contact Splunk Support or use the supported restart workflow for your Splunk Cloud deployment.

Integration of Splunk with Vectra Stream

There are 3 main steps required to integrate Splunk with Vectra Stream:

1. Installation and configuration of "Technology Add-on for Vectra Stream (JSON) ".
2. Installation of "Vectra Stream " App.
3. Configuring Vectra Stream to send metadata to Splunk using Publisher of "Raw JSON" using Protocol of "TCP" to the server IP/Hostname and port number of your choice where Splunk will be listening.

For details please see the Splunk Integration Guide for Vectra AI .