Upgrade Guide: Vectra XDR Technology Add-on v1.1.2 to Vectra RUX Technology Add-on v2.0.0

Upgrade the Splunk Vectra XDR Technology Add-on v1.1.2 to Vectra RUX Technology Add-on v2.0.0.

Summary

Product Name Update: We have changed the product name from Vectra XDR to Vectra RUX.

Version 2.0.0 is the Vectra RUX Technology Add-on release. It replaces the generic modular-input type names used in v1.1.2 with Vectra-specific names. This avoids conflicts with other Splunk add-ons that use a generic input type such as detections_input.

Important: The add-on configuration is retained during the upgrade, including configured Vectra account details such as the Client ID and Client Secret. Only existing data inputs are removed. After the upgrade, recreate and enable each required input in the v2.0.0 Inputs page.

What changes in v2.0.0

Area	v1.1.2	v2.0.0
Add-on name in Splunk Web	Vectra XDR Technology Add-on	Vectra RUX Technology Add-on
Input-type naming	Generic names, for example detections_input	Unique Vectra RUX names, for example vectra_rux_detections_input
Upgrade behavior	Add-on configuration and data inputs	Add-on configuration is retained; only data inputs are removed and must be recreated
Detection options	Historical data	Historical data, From Checkpoint ID, Include Triaged, and Include Info Category
Health collection	Existing health collection	Selectable collection of /health/edr, /health/edr/details, /health/external_connectors, and /health/external_connectors/details

Input-type rename

Why this change was made: v1.1.2 used generic input-type names that can also be used by other Splunk technology add-ons. If another TA defines the same generic name, Splunk can load the wrong input definition or show an input-page error. Version 2.0.0 prefixes every Vectra input type with vectra_rux_ so that its input definitions are unique.

Effect of this change: The add-on configuration, including Vectra accounts and credentials, is retained. However, Splunk treats the renamed input types as new inputs, so existing v1.1.2 data inputs are removed during the upgrade and must be recreated in v2.0.0.

The following input types have changed. The new unique names prevent a collision with another TA that defines a generic input name such as detections_input.

v1.1.2 input type	v2.0.0 input type
entity_scoring_input	vectra_rux_entity_scoring_input
detections_input	vectra_rux_detections_input
audits_input	vectra_rux_audits_input
lockdown_input	vectra_rux_lockdown_input
health_input	vectra_rux_health_input

Before you upgrade

1. Record all v1.1.2 input configurations, including:

   • Input type
   • Input name
   • Vectra account
   • Index
   • Interval
   • Historical-data setting
   • Any other selected options
2. Disable and delete all v1.1.2 Vectra inputs to prevent overlapping data collection during the upgrade.
3. Have the v2.0.0 installation package ready.

Note: The add-on configuration is retained during the upgrade. You do not need to recreate configured Vectra accounts, Client IDs, Client Secrets, proxy settings, or logging settings.

Upgrade procedure

1. In Splunk Web, go to Apps > Manage Apps.
2. Select Install app from file.
3. Choose the v2.0.0 Vectra RUX Technology Add-on package.
4. Select the Upgrade app checkbox, then upload the package.
5. Allow Splunk to finish installing the add-on.
6. Open Vectra RUX Technology Add-on > Inputs.
7. Recreate each required input. Use the configuration record captured before the upgrade.
8. Confirm that each recreated input is enabled and that data is arriving in the intended index.

Expected temporary Inputs-page error after installation

Immediately after installing v2.0.0, the Inputs page may briefly display “Something went wrong” with “Not Found” in the error details.

Important: This can occur while Splunk registers the new modular input types. Follow the steps below in order. Continue to the next step only if the error remains.

1. Wait a short time, then refresh the page. The error should disappear and the Inputs page should load normally.
2. Clear the browser cache, then reopen or refresh the Inputs page.
3. Restart the Splunk instance, then open the Inputs page again.

Reconfigure inputs after the upgrade

This is required because v2.0.0 uses new, unique input types. The v1.1.2 data inputs will be removed during the upgrade and cannot be carried forward automatically. The add-on configuration, including Vectra account credentials, is retained.

Create the inputs again from Vectra RUX Technology Add-on > Inputs:

• Entity Scoring Input
• Detection Input
• Audit Input
• Lockdown Input
• Health Input

New fields in v2.0.0

The following fields are new in v2.0.0. Review and configure them when recreating the applicable input.

Input	New field	Description
Detection Input	From Checkpoint ID	Event id to begin collection from on the first run.
Detection Input	Include Triaged	Collect triaged detections.
Detection Input	Include Info Category	Collect informational detections.
Health Input	Get Health EDR	Collect /health/edr data.
Health Input	Get Health EDR Details	Collect /health/edr/details data.
Health Input	Get Health External Connectors	Collect /health/external_connectors data.
Health Input	Get Health External Connectors Details	Collect /health/external_connectors/details data.

Detection input checkpoint guidance

Important: For From Checkpoint ID, enter the event id, not detection_id. These fields are different. Use id: 120348; do not use detection_id: 34938.

To avoid duplicate detections after the upgrade, do not select Historical Data (Last 24 hours). Instead, find the latest event id in the Splunk detection table and enter it in From Checkpoint ID.

Use the following Splunk search to retrieve the latest detection event id:

index=vectra_xdr source=detections_input
| sort 0 - _time
| head 1
| table _time id

Copy the value in the id field from the result into From Checkpoint ID. Do not use the detection_id field.

For Health inputs, select the health endpoints needed in your environment. The available options are EDR, EDR details, external connectors, and external connector details.

Post-upgrade validation

1. Verify that no old v1.1.2 input definitions remain in use.
2. Verify that each required v2.0.0 input has been recreated and enabled.
3. Check that events are being written to the selected index.
4. Review Splunk internal logs for ta_vectra_xdr errors if collection does not begin as expected.