Splunk On-Prem SIEM / Vectra integration guide (start here for RUX)

Start here for Splunk integration with Vectra Respond UX, including supported add-ons/apps, install matrix, API client setup, and data inputs.

Product Name Update: We have changed the product name from Vectra XDR to Vectra RUX.

As stated in the summary, this article only applies to customers using Vectra's Respond UX. If you are using the Quadrant UX please see the Splunk Integration Guide for Vectra AI. If you are unsure of which UX you are using, please see Vectra Analyst User Experiences (Respond vs Quadrant).

Integration Overview

Vectra AI provides Add-ons and Apps to seamlessly integrate with Splunk and Splunk Enterprise Security. Vectra provides 2 main data sources for Splunk:

Vectra RUX

• Vectra RUX uses a patent-pending combination of data science, machine learning and behavioral analysis to reveal the fundamental characteristics of malicious threat behavior. The Vectra platform captures packets and logs across public cloud, SaaS, federated identity and data center networks to surface and prioritize threats. These high-fidelity insights can be pulled via API to integrate seamlessly with your workflows and operations.

Network Metadata from Vectra Stream

• Leveraging the same platform, Vectra provides the ability to export network metadata collected by the Vectra Sensors deployed through the environment to Splunk. This data provides an in-depth view of any communication observed in your environment and enables you to perform investigation & threat hunting. A list of protocols supported, and attributes extracted is available here.

Vectra RUX Add-On and Apps for Splunk

Vectra RUX

Name	Type	Splunkbase Link	Supported Splunk Version	CIM Compatibility	Splunk Cloud	Vectra Platform	Data Structure
Vectra RUX Technology Add-on	Add-on	https://splunkbase.splunk.com/app/6991	10.5, 10.4, 10.3, 10.2, 10.1, 10.0, 9.4, 9.3, 9.2, 9.1	Yes	Yes	Vectra Respond UX	JSON
Vectra RUX App	App	https://splunkbase.splunk.com/app/6992	10.5, 10.4, 10.3, 10.2, 10.1, 10.0, 9.4, 9.3, 9.2, 9.1	Yes	Yes	Vectra Respond UX	n/a

Vectra Stream

Name	Type	Splunkbase Link	Supported Splunk Version	CIM Compatibility	Splunk Cloud	Data structure	Dependencies
Technology Add-on for Vectra Stream (JSON)	Add-on	https://splunkbase.splunk.com/app/6367	10.5, 10.4, 10.3, 10.2, 10.1, 10.0, 9.4, 9.3, 9.2, 9.1	Yes	Yes	JSON	N/A
Vectra Stream	App	https://splunkbase.splunk.com/app/4739	10.5, 10.4, 10.3, 10.2, 10.1, 10.0, 9.4, 9.3, 9.2, 9.1, 9.0	Yes	Yes	n/a	Treemap URL Toolbox

Prerequisites

Before configuring the Vectra AI integration with Splunk On-prem Platform, ensure the following requirements are met:

• A valid Splunk account with access to Splunkbase to download the required Vectra apps and add-ons.
• A supported version of Splunk Cloud Platform or Splunk Enterprise.
• All application dependencies listed in the Add-ons and Apps table are installed and configured.
• The required Splunk index or indexes are created before data ingestion begins.

Vectra recommends using a dedicated index for Vectra RUX data. If Vectra Stream is also enabled, Vectra recommends creating a separate dedicated index for Vectra Stream data.

Integration of Splunk On-Prem with Vectra RUX

Integrating Splunk On-Prem Platform with Vectra RUX involves three main steps:

1. Creating API clients in the Vectra Respond UX for use by the Technology Add-on.
2. Installing and configuring the Vectra RUX Technology Add-on.
3. Installing the Vectra RUX App.

Create API Clients in Vectra Respond UX

API clients must be created in the Vectra Respond UX. These API clients are used by the Vectra RUX Technology Add-on for Splunk to authenticate with the Vectra platform and retrieve data.

Install and Configure the Vectra RUX Technology Add-on

The Vectra RUX Technology Add-on for Splunk collects data from the Vectra platform, including:

• Entity scoring data
• Detection data
• Audit data
• Lockdown data
• Health data

The Technology Add-on performs CIM mapping for detection and audit data. It also maps entity scoring and detection data fields to the corresponding Vectra Syslog event fields.

Note: If you are using a prior version of a Vectra Technology Add-on with an existing Quadrant UX-based Vectra deployment, you can continue to keep that deployment separate. However, the Technology Add-on and App for Vectra RUX using the Respond UX must be installed separately. You cannot upgrade from a prior version to this version.

1. Creating API Clients for Splunk Integration

Before configuring the Splunk integration, create separate API clients for each endpoint required by the integration.

Creating individual API clients for each endpoint is required to ensure that the Splunk integration can securely and efficiently collect data from Vectra.

Why Separate API Clients Are Required

Separate API clients are required for the following reasons:

• Each endpoint used by the Splunk integration is polled individually.
• Different endpoints require different permission levels in Vectra.
• Using separate API clients helps improve performance and scalability when accessing multiple API endpoints.
• Troubleshooting is easier because each API client is associated with a specific endpoint and purpose.
• Access can be managed more securely by assigning only the required permissions to each API client.

API Clients Required for the Integration

Create the following API clients for use with the Vectra Splunk integration.

API Client Name	Role	Purpose
ro_splunk_entity_scoring	Read-only	Used by Splunk to poll the entity_scoring endpoint.
ro_splunk_detections	Read-only	Used by Splunk to poll the detections endpoint.
ro_splunk_lockdown	Read-only	Used by Splunk to poll the lockdown endpoint.
audit_splunk_audits	Auditor	Used by Splunk to poll the audits endpoint.
audit_splunk_health	Auditor	Used by Splunk to poll the health endpoint.

Recommended Naming Convention

Use clear and descriptive API client names so that each client can be easily identified during configuration, maintenance, and troubleshooting.

The recommended naming format is:

<role>_splunk_<endpoint>

For example:

ro_splunk_detections

This naming convention indicates that the API client:

• Uses a read-only role.
• Is intended for Splunk.
• Is associated with the detections endpoint.

Permission Guidance

Assign only the permissions required for each endpoint to follow the principle of least privilege.

• Use a Read-only role for endpoints that require only read access.
• Use an Auditor role for endpoints that require audit-level access.
• Avoid using overly permissive roles unless they are specifically required.

Following these guidelines helps maintain least-privilege access for the Splunk integration and reduces unnecessary permissions.

RUX API Client Creation

To create each of the API clients listed above, follow these steps:

1. Log in to Vectra Respond UX (RUX).
2. Navigate to Configuration > API Clients under Access.
3. Click Add API Client.

Enter a name for the API client, select the appropriate role, and optionally provide a description. Once you have entered the required details, click Generate Credentials.

Save the API Client Credentials

On the API Client Created screen, copy the Client ID and Secret Key and store them in a secure location for later configuration in Splunk. Then, click Done.

Important: The Secret Key is displayed only once and cannot be retrieved later. If you do not copy and securely save the Secret Key at this stage, you must delete the API client and create a new one to obtain a new key.

Once you have created all five required API clients, your screen should look similar to the following:

After Creating the API Clients

After all required API clients have been created:

1. Securely save the client credentials. Store the Client ID and Secret Key in a secure location for use during the Splunk configuration.
2. Verify the assigned roles. Confirm that each API client has been assigned the correct role.
3. Configure the API clients in Splunk. Use the API client credentials when configuring accounts in the Vectra RUX Technology Add-on for Splunk.
4. Create the account configurations. Create one account configuration in the add-on for each API client.
5. Continue with the Splunk configuration. Once all API clients are created and verified, proceed with the remaining add-on configuration steps in Splunk.

2. Installation and Configuration of "Vectra RUX Technology Add-on"

Installation of the Vectra RUX Technology Add-on for Splunk

This section explains how to install the Vectra RUX Technology Add-on for Splunk.

The add-on can be installed using one of the following methods:

1. Recommended: Install the add-on from Find More Apps in Splunk Web.
2. Alternative: Install the add-on from a downloaded file using Splunk Web.
3. Manual Installation: Install the add-on directly from the Splunk server file system.

Use the installation methods in the order listed above. The Find More Apps method is recommended because it allows the add-on to be installed directly from Splunk Web with minimal manual steps.

Recommended Installation Order

Install the add-on using the following order of preference:

Priority	Installation Method	When to Use
1	Install from Find More Apps	Recommended method for most Splunk environments
2	Install from a file using Splunk Web	Use when you have already downloaded the add-on package
3	Manual installation from the file system	Use when Splunk Web installation is not available or not suitable

Method 1: Install the Add-on from Find More Apps

This is the recommended method for installing the Vectra RUX Technology Add-on for Splunk.

Use this method if the add-on is available from the Find More Apps section in Splunk Web.

Steps

1. Log in to Splunk Web using an administrator account.
2. From the Splunk home dashboard, go to the Apps section.
3. Click Find More Apps.
4. In the search bar, search for:

   Vectra RUX Technology Add-on
5. Select the Vectra RUX Technology Add-on from the search results.
6. Click Install.
7. Follow the on-screen instructions to complete the installation.
8. If Splunk prompts you to restart, restart the Splunk instance.
9. After the restart is complete, log back in to Splunk Web.
10. Navigate to:

Apps > Manage Apps

1. Search for the Vectra RUX Technology Add-on and confirm that it is installed and enabled.

Method 2: Install the Add-on from a File Using Splunk Web

Use this method if the add-on package has already been downloaded and you want to upload it through Splunk Web.

Steps

1. Download the Vectra RUX Technology Add-on package from Splunk.
2. Log in to Splunk Web using an administrator account.
3. From the Splunk home page, navigate to:

   Apps > Manage Apps
4. In the upper-right corner of the page, click:

   Install app from file
5. Click Choose File.
6. Browse to the location where the Vectra RUX Technology Add-on installation file is saved.
7. Select the add-on installation file.
8. Click Upload.
9. Follow the on-screen prompts to complete the installation.
10. If Splunk prompts you to restart, restart the Splunk instance.
11. After the restart is complete, verify that the add-on is installed by navigating to:

Apps > Manage Apps

1. Search for the Vectra RUX Technology Add-on and confirm that it appears in the installed apps list.

Verify the Installation

After completing any of the installation methods, verify that the add-on was installed successfully.

Steps

1. Log in to Splunk Web.
2. Navigate to:

   Apps > Manage Apps
3. Search for:

   Vectra RUX Technology Add-on
4. Confirm that the add-on appears in the list of installed apps.
5. Verify that the add-on status is Enabled.
6. If the add-on does not appear, restart Splunk and check again.

Configure Accounts in the Vectra RUX Technology Add-on

After the Vectra RUX Technology Add-on for Splunk is installed, configure the accounts that the add-on will use to authenticate with the Vectra platform.

1. In Splunk Cloud Platform, navigate to Apps.
2. Open Vectra RUX Technology Add-on.
3. Go to Configuration > Account.
4. Click Add to create a new account.
5. Add one account for each API client created earlier in the Vectra Respond UX.
6. Enter the required connection details, including the Vectra platform URL and the API client credentials.
7. Save each account configuration.

When complete, the Account page should include separate account entries for each required API client, similar to the following:

Account Name	Purpose
splunk_entity_scoring	Polls the entity_scoring endpoint.
ro_splunk_detections	Polls the detections endpoint.
ro_splunk_lockdown	Polls the lockdown endpoint.
audit_splunk_audits	Polls the audits endpoint.
audit_splunk_health	Polls the health endpoint.

---

Configure Proxy Settings

If your Splunk environment requires a proxy to connect to external services, configure the proxy settings in the add-on.

Skip this section if your Splunk environment does not use a proxy.

Steps

1. Navigate to:

   Vectra RUX Technology Add-on > Configuration > Proxy
2. Enable proxy configuration if required.
3. Enter the required proxy details, such as:

   • Proxy host
   • Proxy port
   • Proxy username, if authentication is required
   • Proxy password, if authentication is required
4. Save the proxy configuration.

Example Proxy Configuration:

Configure Logging Level

The logging level controls the amount of detail written to the add-on logs.

Steps

1. Navigate to:

   Vectra RUX Technology Add-on > Configuration > Logging
2. Select the desired logging level.
3. Save the configuration.

If you are unsure which logging level to use, Vectra recommends selecting:

Info

The Info logging level provides a balanced amount of operational detail and is suitable for most environments.

Recommended Logging Level

Logging Level	When to Use
Info	Recommended for normal operation.
Debug	Use temporarily when troubleshooting an issue.
Error	Use when you only want to capture error messages.

Note: Debug logging can generate more log data. Use it only when troubleshooting and change the logging level back to Info after the issue is resolved.

Verify the Add-on Configuration

After completing the configuration:

1. Confirm that all required accounts are listed under the Account tab.
2. Confirm that proxy settings are configured only if required by your Splunk environment.
3. Confirm that the logging level is set to Info, unless a different level is needed.
4. Continue to the data input configuration section.

2.2 Vectra RUX Technology Add-on: New Installation and Data Input Configuration

After installing the Vectra RUX Technology Add-on and configuring the required Vectra account. It explains how to create data inputs that collect data from the selected Vectra endpoints. Create a separate data input for each account and endpoint that you want to ingest into Splunk.

Note: This is a new-installation and configuration guide. For an upgrade from v1.1.2 to v2.0.0, use the separate upgrade guide.

Add a New Data Input

1. Navigate to Vectra RUX Technology Add-on.
2. Open Inputs.
3. Select Create New Input or Add Input, depending on the option available in your Splunk interface.
4. Select the input type and configure the required fields.
5. Save the input and confirm that it is enabled.

Data Input Configuration Fields

Create a separate input for each Vectra account and endpoint that you want to ingest. Configure the following fields for the selected input type.

Entity Scoring Input Fields

• Name: A unique name for the data input.
• Interval: How often Splunk polls the selected Vectra endpoint, in seconds.
• Index: The Splunk index where collected events are stored.
• Vectra RUX Account: The configured Vectra RUX account used to authenticate to the endpoint.
• Historical Data: When enabled, collects the previous 24 hours of data on the first collection cycle.

Detection Input Fields

• Name: A unique name for the data input.
• Interval: How often Splunk polls the selected Vectra endpoint, in seconds.
• Index: The Splunk index where collected events are stored.
• Vectra RUX Account: The configured Vectra RUX account used to authenticate to the endpoint.
• Historical Data: When enabled, collects the previous 24 hours of data on the first collection cycle. This option is available only for Entity Scoring, Detection, and Audit inputs.
• From Checkpoint ID: An optional event id from which collection begins on the first run. Use it when you want collection to start after a specific event instead of collecting the previous 24 hours.
• Include Triaged: Include triaged detections.
• Include Info Category: Include informational detections.
• Input Start Time: Select the event timestamp source used for data collection.

Audit Input Fields

• Name: A unique name for the data input.
• Interval: How often Splunk polls the selected Vectra endpoint, in seconds.
• Index: The Splunk index where collected events are stored.
• Vectra RUX Account: The configured Vectra RUX account used to authenticate to the endpoint.

Lockdown Input Fields

• Name: A unique name for the data input.
• Interval: How often Splunk polls the selected Vectra endpoint, in seconds.
• Index: The Splunk index where collected events are stored.
• Vectra RUX Account: The configured Vectra RUX account used to authenticate to the endpoint.

Health Input Fields

• Name: A unique name for the data input.
• Interval: How often Splunk polls the selected Vectra endpoint, in seconds. Use 900 seconds for the Health input.
• Index: The Splunk index where collected events are stored.
• Vectra RUX Account: The configured Vectra RUX account used to authenticate to the endpoint.
• Get Health EDR: Collect data from the health EDR endpoint.
• Get Health EDR Details: Collect data from the detailed health EDR endpoint.
• Get Health External Connectors: Collect data from the health external connectors endpoint.
• Get Health External Connectors Details: Collect data from the detailed health external connectors endpoint.

Recommended Input Interval

For Entity Scoring, Detection, Audit, and Lockdown inputs, an interval of 60 seconds is recommended. Splunk checks the configured endpoint every 60 seconds and collects available data.

Health Input Interval

For the Health input, use an interval of 900 seconds. Health data is refreshed every 15 minutes on the Vectra side, so the longer interval avoids unnecessary polling and aligns Splunk collection with the data refresh cycle.

Historical Data Option

Historical Data is optional. When enabled, the input collects data from the previous 24 hours. This can be useful in smaller environments when verifying that the add-on is working and data is reaching Splunk.

Important: Historical Data is not available for Health or Lockdown inputs.

Use From Checkpoint ID with the latest event id when you need to resume collection without re-ingesting the previous 24 hours. Do not use detection_id as the checkpoint value.

Use this Splunk search to retrieve the latest event id:

index=vectra_xdr source=detections_input
| sort 0 - _time
| head 1
| table _time id

Copy the id field from the result into From Checkpoint ID. Do not use detection_id.

Verify Data Input Configuration

After creating data inputs:

1. Confirm that each required input appears in the Inputs table.
2. Verify that its status is Enabled.
3. Confirm that the correct Vectra account and Splunk index are selected.
4. Wait for the configured interval to pass.
5. Verify that data is being ingested by searching the configured index in Splunk Search.

3. Installation of Vectra RUX App for Splunk

This section explains how to install, configure, troubleshoot, and uninstall the Vectra RUX App for Splunk.

The Vectra RUX App provides dashboards and visualizations for data collected by the Vectra RUX Technology Add-on for Splunk. Before using the app, ensure that the add-on is installed, configured, and collecting data successfully.

Installation

The Vectra XDR App for Splunk can be installed using one of the following methods:

1. Recommended: Install the app from Find More Apps in Splunk Web.
2. Alternative: Install the app from a downloaded file using Splunk Web.

Method 1: Install from Find More Apps

Use this method if the app is available directly from Splunk Web.

Steps

1. Log in to Splunk Web using an administrator account.
2. From the Splunk Home dashboard, go to the Apps section.
3. Click Find More Apps.
4. Search for:

   Vectra RUX App for Splunk
5. Select the app from the search results.
6. Click Install.
7. Follow the on-screen instructions to complete the installation.
8. Restart Splunk if prompted.
9. After installation, verify that the app is available from the Splunk Apps menu.

Method 2: Install from a File Using Splunk Web

Use this method if you have already downloaded the app package.

Steps

1. Download the Vectra RUX App for Splunk package from Splunk.
2. Log in to Splunk Web using an administrator account.
3. Navigate to:

   Apps > Manage Apps
4. In the upper-right corner, click:

   Install app from file
5. Click Choose File.
6. Select the downloaded Vectra RUX App package.
7. Click Upload.
8. Follow the on-screen prompts to complete the installation.
9. Restart Splunk if prompted.
10. After installation, confirm that the app appears in the Splunk Apps menu.

Configuration

No additional configuration is required if the data collected by the add-on is stored in the default Splunk index:

main

However, if you configured the data inputs to send data to an index other than main, you must update the app macro so that the dashboards search the correct index.

Important: Updating the vectra_xdr_index_macro is required for the Vectra RUX App for Splunk to display data correctly when a custom index is used. If this macro is not updated, the dashboards may not show Vectra data because the app will continue searching the default main index.

Configure the App Index

In the new Vectra RUX App for Splunk, you do not need to update the vectra_xdr_index_macro manually.

1. Log in to Splunk Web.
2. Open Vectra RUX App for Splunk.
3. Go to the Configuration section.
4. Select the index where the Vectra RUX Technology Add-on stores data from the Index drop-down.
5. Click Save.
6. Open the dashboards and confirm that data is displayed.

The app uses the selected index for its dashboard searches.

Uninstall and Clean Up Steps

Use the following steps to uninstall the Vectra RUX Technology Add-on for Splunk and remove related log files from the Splunk instance.

Note: Before removing files, ensure that you have the required permissions on the Splunk server. If needed, take a backup of the add-on configuration before uninstalling.

Remove the Add-on Directory

Remove the add-on directory from the Splunk apps folder:

$SPLUNK_HOME/etc/apps/TA-Vectra-XDR

This removes the installed add-on files from the Splunk instance.

Remove Add-on Log Files

Remove the log files generated by the add-on from the Splunk log directory:

$SPLUNK_HOME/var/log/Splunk/ta_vectra_xdr_*.log

These log files are created by the add-on during configuration, data collection, and troubleshooting activities.

Restart Splunk

After removing the add-on directory and related log files, restart the Splunk Enterprise instance.

Restarting Splunk ensures that the cleanup changes are reflected in the Splunk Web UI.

$SPLUNK_HOME/bin/splunk restart

After the restart is complete, verify that the add-on no longer appears under:

Apps > Manage Apps

---

Troubleshooting

This section provides basic troubleshooting steps for the Vectra RUX Technology Add-on for Splunk.

Use these checks if the add-on is not working as expected, data is not being collected, or logs need to be reviewed.

General Checks

To troubleshoot the add-on, review the add-on log files located in the Splunk log directory:

$SPLUNK_HOME/var/log/Splunk/

All log files generated by this add-on are stored in this directory and use the following naming pattern:

ta_vectra_xdr*.log

You can also review the logs directly from Splunk Web using the following search query:

index="_internal" source=*ta_vectra_xdr*.log

This query displays all log messages generated by the add-on.

To view only error messages, use the following query:

index="_internal" source=*ta_vectra_xdr*.log ERROR

Review the error messages to identify configuration issues, authentication failures, connectivity problems, or data collection errors.

Add-on Icons Are Not Showing

The add-on does not require a Splunk restart immediately after installation for its core functionality to work.

However, the add-on icons may not appear in Splunk Web until Splunk is restarted once after installation.

If the icons are not visible:

1. Restart the Splunk Enterprise instance.

   $SPLUNK_HOME/bin/splunk restart

2. Log back in to Splunk Web.
3. Navigate to the Apps menu and verify that the add-on icons are displayed.

Data Collection Issues

If data collection is not working, verify the following:

1. Confirm that the Splunk server has internet connectivity.
2. If your environment uses a proxy, confirm that the proxy is enabled and configured correctly in the add-on.
3. Confirm that the configured account credentials are correct.
4. Verify that the data inputs are enabled.
5. Confirm that the selected index exists and is searchable.
6. Review the relevant input log files for error messages.

Input-Specific Log Files

Each data input writes logs to a specific log file. Use the log file that matches the input type you are troubleshooting.

Input Type	Log File
Entity Scoring	ta_vectra_xdr_entity_scoring_input_<input_name>.log
Detections	ta_vectra_xdr_detections_input_<input_name>.log
Audits	ta_vectra_xdr_audits_input_<input_name>.log
Lockdown	ta_vectra_xdr_lockdown_input_<input_name>.log
Health	ta_vectra_xdr_health_input_<input_name>.log

Replace <input_name> with the name of the data input configured in Splunk.

Example Troubleshooting Searches

Use the following Splunk searches to review add-on activity.

View All Add-on Logs

index="_internal" source=*ta_vectra_xdr*.log

View Add-on Errors

index="_internal" source=*ta_vectra_xdr*.log ERROR

View Logs for a Specific Input

index="_internal" source=*ta_vectra_xdr*<input_name>*.log

Replace <input_name> with the name of the input you want to troubleshoot.

Recommended Troubleshooting Flow

Use the following order when troubleshooting data collection issues:

1. Confirm that the data input is enabled.
2. Confirm that the account configuration is correct.
3. Confirm that the index is configured correctly.
4. Check network connectivity from the Splunk server.
5. Verify proxy configuration, if a proxy is required.
6. Review the add-on logs in:

   $SPLUNK_HOME/var/log/Splunk/

7. Search the _internal index for add-on errors.
8. Resolve any errors found in the logs and restart Splunk if required.

Troubleshooting Dashboards

Use this section if dashboards are not displaying data or if you need to verify that Vectra data is available in Splunk.

Verify Data in the Configured Index

To confirm that data is being collected, run a search using the index configured for the add-on.

Example:

index=<your_index_name> sourcetype IN ("vectralockdown", "vectraaudits", "vectradetections", "vectraentity:scoring", "vectrahealth")

Replace <your_index_name> with the index used in your data input configuration.

---

Search by Individual Sourcetype

You can also search each sourcetype individually.

Lockdown Events

index=<your_index_name> sourcetype="vectralockdown"

Audit Events

index=<your_index_name> sourcetype="vectraaudits"

Detection Events

index=<your_index_name> sourcetype="vectradetections"

Entity Scoring Events

index=<your_index_name> sourcetype="vectraentity:scoring"

Health Events

index=<your_index_name> sourcetype="vectrahealth"

Review Add-on Logs

The Vectra RUX App uses data collected by the Vectra RUX Technology Add-on. If data is not available, review the add-on logs.

The add-on log files are located in:

$SPLUNK_HOME/var/log/splunk/

Check log files that match the following pattern:

ta_vectra_xdr_*.log

You can also search the logs from Splunk Web:

index="_internal" source=*ta_vectra_xdr*.log

To view only error messages, use:

index="_internal" source=*ta_vectra_xdr*.log ERROR

Dashboard Is Not Populating

If the Vectra RUX App dashboards are not displaying data, verify the following:

1. Confirm that the Vectra RUX Technology Add-on is installed and collecting data.
2. Confirm that the data inputs are enabled.
3. Confirm that data exists in the configured index.
4. Confirm that the expected sourcetypes are available in Splunk.
5. If you are using a custom index, confirm that the vectra_xdr_index_macro macro is updated correctly.
6. Refresh the dashboard after updating the macro.
7. If required, restart Splunk and check the dashboard again.

Integration of Splunk with Vectra Stream

There are 3 main steps required to integrate Splunk with Vectra Stream:

1. Installation and configuration of "Technology Add-on for Vectra Stream (JSON) ".
2. Installation of "Vectra Stream " App.
3. Configuring Vectra Stream to send metadata to Splunk using Publisher of "Raw JSON" using Protocol of "TCP" to the server IP/Hostname and port number of your choice where Splunk will be listening.

For details please see the Splunk Integration Guide for Vectra AI .