> For the complete documentation index, see [llms.txt](https://docs.vectra.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.vectra.ai/configuration/response/siem/upgrade-guide-vectra-xdr-technology-add-on-v1.1.2-to-vectra-rux-technology-add-on-v2.0.0.md).
# Upgrade Guide: Vectra XDR Technology Add-on v1.1.2 to Vectra RUX Technology Add-on v2.0.0
Upgrade the Splunk Vectra XDR Technology Add-on v1.1.2 to Vectra RUX Technology Add-on v2.0.0.
## Summary
{% hint style="info" %}
**Product Name Update:** We have changed the product name from **Vectra XDR** to **Vectra RUX**.
{% endhint %}
Version 2.0.0 is the Vectra RUX Technology Add-on release. It replaces the generic modular-input type names used in v1.1.2 with Vectra-specific names. This avoids conflicts with other Splunk add-ons that use a generic input type such as `detections_input`.
{% hint style="danger" %}
**Important:** The add-on configuration is retained during the upgrade, including configured Vectra account details such as the Client ID and Client Secret. Only existing data inputs are removed. After the upgrade, recreate and enable each required input in the v2.0.0 Inputs page.
{% endhint %}
## What changes in v2.0.0
| Area | v1.1.2 | v2.0.0 |
| ------------------------- | --------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
| Add-on name in Splunk Web | Vectra XDR Technology Add-on | Vectra RUX Technology Add-on |
| Input-type naming | Generic names, for example `detections_input` | Unique Vectra RUX names, for example `vectra_rux_detections_input` |
| Upgrade behavior | Add-on configuration and data inputs | Add-on configuration is retained; only data inputs are removed and must be recreated |
| Detection options | Historical data | Historical data, **From Checkpoint ID**, **Include Triaged**, and **Include Info Category** |
| Health collection | Existing health collection | Selectable collection of `/health/edr`, `/health/edr/details`, `/health/external_connectors`, and `/health/external_connectors/details` |
## Input-type rename
{% hint style="info" %}
**Why this change was made:** v1.1.2 used generic input-type names that can also be used by other Splunk technology add-ons. If another TA defines the same generic name, Splunk can load the wrong input definition or show an input-page error. Version 2.0.0 prefixes every Vectra input type with vectra\_rux\_ so that its input definitions are unique.
{% endhint %}
{% hint style="warning" %}
**Effect of this change:** The add-on configuration, including Vectra accounts and credentials, is retained. However, Splunk treats the renamed input types as new inputs, so existing v1.1.2 data inputs are removed during the upgrade and must be recreated in v2.0.0.
{% endhint %}
The following input types have changed. The new unique names prevent a collision with another TA that defines a generic input name such as `detections_input`.
| v1.1.2 input type | v2.0.0 input type |
| ---------------------- | --------------------------------- |
| `entity_scoring_input` | `vectra_rux_entity_scoring_input` |
| `detections_input` | `vectra_rux_detections_input` |
| `audits_input` | `vectra_rux_audits_input` |
| `lockdown_input` | `vectra_rux_lockdown_input` |
| `health_input` | `vectra_rux_health_input` |
## Before you upgrade
1. **Record all v1.1.2 input configurations**, including:
* Input type
* Input name
* Vectra account
* Index
* Interval
* Historical-data setting
* Any other selected options
2. **Disable and delete all v1.1.2 Vectra inputs** to prevent overlapping data collection during the upgrade.
3. **Have the v2.0.0 installation package ready.**
{% hint style="info" %}
**Note:** The add-on configuration is retained during the upgrade. You do **not** need to recreate configured Vectra accounts, Client IDs, Client Secrets, proxy settings, or logging settings.
{% endhint %}
## Upgrade procedure
1. In Splunk Web, go to **Apps > Manage Apps**.
2. Select **Install app from file**.
3. Choose the v2.0.0 Vectra RUX Technology Add-on package.
4. Select the **Upgrade app** checkbox, then upload the package.
5. Allow Splunk to finish installing the add-on.
6. Open **Vectra RUX Technology Add-on > Inputs**.
7. Recreate each required input. Use the configuration record captured before the upgrade.
8. Confirm that each recreated input is enabled and that data is arriving in the intended index.
## Expected temporary Inputs-page error after installation
Immediately after installing v2.0.0, the Inputs page may briefly display **“Something went wrong”** with **“Not Found”** in the error details.
{% hint style="warning" %}
**Important:** This can occur while Splunk registers the new modular input types. Follow the steps below in order. Continue to the next step only if the error remains.
{% endhint %}
1. **Wait a short time, then refresh the page.** The error should disappear and the Inputs page should load normally.
2. **Clear the browser cache**, then reopen or refresh the Inputs page.
3. **Restart the Splunk instance**, then open the Inputs page again.
## Reconfigure inputs after the upgrade
This is required because v2.0.0 uses new, unique input types. The v1.1.2 data inputs will be removed during the upgrade and cannot be carried forward automatically. The add-on configuration, including Vectra account credentials, is retained.
Create the inputs again from **Vectra RUX Technology Add-on > Inputs**:
* Entity Scoring Input
* Detection Input
* Audit Input
* Lockdown Input
* Health Input
## New fields in v2.0.0
The following fields are new in v2.0.0. Review and configure them when recreating the applicable input.
| Input | New field | Description |
| --------------- | ------------------------------------------ | --------------------------------------------------- |
| Detection Input | **From Checkpoint ID** | Event id to begin collection from on the first run. |
| Detection Input | **Include Triaged** | Collect triaged detections. |
| Detection Input | **Include Info Category** | Collect informational detections. |
| Health Input | **Get Health EDR** | Collect /health/edr data. |
| Health Input | **Get Health EDR Details** | Collect /health/edr/details data. |
| Health Input | **Get Health External Connectors** | Collect /health/external\_connectors data. |
| Health Input | **Get Health External Connectors Details** | Collect /health/external\_connectors/details data. |
## Detection input checkpoint guidance
{% hint style="warning" %}
**Important:** For **From Checkpoint ID**, enter the event id, not detection\_id. These fields are different. Use id: 120348; do **not** use detection\_id: 34938.
{% endhint %}
To avoid duplicate detections after the upgrade, do not select **Historical Data** (Last 24 hours). Instead, find the latest event id in the Splunk detection table and enter it in **From Checkpoint ID**.
Use the following Splunk search to retrieve the latest detection event id:
```spl
index=vectra_xdr source=detections_input
| sort 0 - _time
| head 1
| table _time id
```
Copy the value in the id field from the result into **From Checkpoint ID**. Do not use the detection\_id field.
For Health inputs, select the health endpoints needed in your environment. The available options are EDR, EDR details, external connectors, and external connector details.
## Post-upgrade validation
1. Verify that no old v1.1.2 input definitions remain in use.
2. Verify that each required v2.0.0 input has been recreated and enabled.
3. Check that events are being written to the selected index.
4. Review Splunk internal logs for `ta_vectra_xdr` errors if collection does not begin as expected.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.vectra.ai/configuration/response/siem/upgrade-guide-vectra-xdr-technology-add-on-v1.1.2-to-vectra-rux-technology-add-on-v2.0.0.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
