> For the complete documentation index, see [llms.txt](https://docs.vectra.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.vectra.ai/deployment/getting-started/migration-to-rux-from-qux.md). # Migration to RUX from QUX ## Upgrading to the Vectra AI Platform with Respond UX The Vectra AI platform (a RUX deployment) is our best experience for consuming Vectra AI’s Attack Signal Intelligence using a unified set of interfaces and tooling to deliver: * Best-in-class signal clarity * Expedited access to relevant information * Faster investigation workflow The Vectra AI Platform is cloud-delivered, enabling: * Best-in-class experiences and protection * Cloud performance and scale * Native support for remote and hybrid SOC teams Customers not yet using the new Vectra AI Platform UX are consuming Vectra through the Appliance Platform where the UI is hosted on their Vectra Brain. This document outlines the process by which your data and configuration is migrated to the Vectra AI Platform. The migration process involves uploading a copy of the configuration, detections, hosts, detection state to the cloud and keeping that in-sync going forward. {% hint style="info" %} **Please Note:** Recall metadata is **NOT** migrated. Please see [#expectations-upon-migration-completion](#expectations-upon-migration-completion "mention") for details. {% endhint %} Post-migration, customers… * Continue to leverage their existing fleet of Sensors and Brains for the collection and analysis of network traffic. * Fulfill all workflows (UI, API, etc) through cloud endpoints as opposed to endpoints hosted on the Vectra Appliance platform. * Benefit from cloud-powered AI-driven prioritization, and cloud-powered AI-triage to help you focus on the things that really matter within your environment. Customers not yet using the new Vectra AI Platform with Respond UX are consuming Vectra through the Vectra Appliance platform where the UI (Quadrant UX) is hosted on your Vectra Brain. This document outlines the process by which your data and configuration is migrated to the Vectra AI Platform. ### Key Information
From: Vectra Appliance PlatformTo: Vectra AI Platform
UIServed from Brain applianceServed from Vectra Cloud
SignalPartitioned experience, with quadrants, Threat and CertaintyUnified experience with single Urgency Score
InvestigationUsing Recall or Stream for network only.Using integrated Instant and Advanced Investigation for all attack surfaces
Network CoverageUsing existing Brain and Sensor deploymentUsing existing Brain and Sensor deployment
## Frequently Asked Questions (FAQ) **Will I lose active detections and history?** * No, all detections and history are preserved (Recall Metadata is not migrated). **Do I have to do anything?** * Yes, but not much! See the [Preparing for the migration](#preparing-for-the-migration) section below. **How long will it take?** * Typical customers will take between 30 and 60 minutes to migrate. **Is there any cost to migrate?** * Depends on your deployment. Please talk to your Vectra account team to understand. ## Migration Guidance This below is a brief overview, follow the links or just keep scrolling down for added details. {% stepper %} {% step %} #### [Preparing for the Migration](#preparing-for-the-migration) * There will be a planning meeting with Vectra * Ensure you meet the firewall requirements in the next step. * You will need to ensure you have adequate egress bandwidth to Vectra's cloud. * A date will be scheduled for migration. * You will need to plan for changes to any API integrations and authentication changes. {% endstep %} {% step %} #### [Firewall Requirements](#firewall-requirements-rux-migration) You will need to ensure you meet the additional firewall requirements for ongoling access to RUX and allow access to the S3 bucket that is required only during migration. {% endstep %} {% step %} #### [Migration](#migration) This section describes what happens the day before migration and on the day of migration. It also details what to expect after migration has completed. {% endstep %} {% step %} #### [Post Migration](#post-migration) This section describes critical steps that must be followed post-migration for authentication, SIEM/SOAR integration, and any other API level integrations {% endstep %} {% endstepper %} ### Preparing for the Migration #### Planning Meeting A planning meeting will be scheduled where your Vectra account team will discuss with you exactly what will happen and when. #### Bandwidth Requirements Validate that you have adequate egress bandwidth to accommodate the transfer of network metadata to the Vectra Cloud to support new metadata based functionality that is only available in RUX. This is estimated to be between 0.5% and 5% (typically near 1%) of the traffic observed by your Brain/Sensors. If you have Recall, this is instead of Recall, not in addition to Recall. #### Date and Time Align with your Vectra account team on the date and time for the migration. #### API and Authentication Changes **API Changes** List out any custom API based integration you may have built. Talk with your Vectra account team about any potential impacts. The API for RUX is different than the API used for QUX deployments. See the [Post Migration](#post-migration) section for more details. **Authentication Changes** Both QUX and RUX deployments support SAML for Single Sign-On (SSO) but the claim requirements and the way IdP metadata is collected is different for each deployment method. See the [Post Migration](#post-migration) section for more details. ### Firewall Requirements (RUX Migration) #### Ongoing Required Firewall Rules Adjust your firewall rules (if necessary) to enable ongoing access from the Brain appliance to the Vectra Cloud. There are new firewall rules that are required for RUX deployments that were not previously required for QUX deployments. * [Firewall requirements](/deployment/getting-started/respond-ux-deployment-guide/firewall-requirements.md) for RUX deployments. #### Migration Only Firewall Rules In addition, during the migration only, Vectra will need connectivity from the existing Brain to a specific AWS S3 bucket. This is required to enable the upload of the Brain's backup to Vectra Cloud. These need to be opened for **HTTPS** use over **TCP/443**. Access is only required to the one region where your Vecrta AI Platform tenant will be deployed, and it is only required during the migration. The AWS S3 bucket names are below:
RegionConnectivity required to this AWS S3 bucket
us-west-2 (US)prd-vuibackup-artifacts-580786928539-uswt2.s3.us-west-2.amazonaws.com
eu-west-1 (Ireland)prd-vuibackup-artifacts-580786928539-euwt1.s3.eu-west-1.amazonaws.com
eu-central-2 (Switzerland)prd-vuibackup-artifacts-580786928539-eucl2.s3.eu-central-2.amazonaws.com
ca-central-1 (Canada)prd-vuibackup-artifacts-580786928539-cacl1.s3.ca-central-1.amazonaws.com
ap-southeast-2 (Australia)prd-vuibackup-artifacts-580786928539-apse2.s3.ap-southeast-2.amazonaws.com
### Migration * On the day before the migration, Vectra will request authorization to proceed with the migration. If authorization is not received, the migration will be postponed. This is to ensure that we don’t migrate when key people are out of office, or when there’s an active and ongoing incident. * **\[Optional]** Should you desire an active call bridge during the migration, this will be provided. Vectra will create this bridge 15 minutes before the migration is due to start and will ensure you are present before the migration starts. The Vectra account team will be able to provide updates on progress during the migration. * On the day of the migration, the CSM/SE will send you an email confirming that the migration will start at the designated date and time. * During the migration, you will not have any access to the Brain UI. The Vectra services running on the Vectra Brain will be suspended for the duration of the migration. * Migrations that take longer than 40 minutes to complete will result in a detection coverage gap from the start of the migration window to the start of the “last 40 minute” window. * For example, if the migration takes 60 minutes, there will be a detection coverage gap from the start of the migration window to 20 minutes into the migration window. * During the migration, data flowing to Recall and Stream will be stopped. The data flow to Stream will resume automatically when the migration completes successfully and attempt to catch up on any queued data. A gap in data in Stream may exist from the migration window. #### Expectations Upon Migration Completion * All data and configuration from the Brain has been sent to the Vectra AI platform in the cloud. * All new configuration, metadata, hosts, accounts, detections will start flowing into the Vectra AI platform and visible in the new UI. * If you are a Recall customer, forwarding to Recall will stop since metadata is integrated into the Vectra AI platform and accessible directly from the UI. Your Recall instance will be deprovisioned once the metadata retention period you previously had with Recall has elapsed. Please note that Recall metadata is NOT migrated to your new RUX deployment. If you wish to retain access to Recall before your existing Recall metadata has aged out, please let your migration team know and credentials to directly access your Recall Kibana URL can be provided. * You will receive an email from Vectra with details on how to log into the new Vectra AI platform. This initial login to the UI will require the setup of MFA (Multi-Factor Authentication) once authenticated. * The CSM/Support contact will send you an email to confirm that the migration has been completed, and to ensure that you are able to access the UI. * The UI on the Brain will no longer be accessible. All access must be through the new UI. {% hint style="warning" %} **Please Note:** Once the migration is complete, you cannot revert back to the appliance platform UI for that deployment. {% endhint %} ### Post Migration * Login to the Vectra AI platform (RUX) UI using the link and credentials provided in the email. * You will need to re-create any standalone users to enable access to the RUX UI for your team. * If you use SAML, you will need to register a new SAML profile to enable Single-Sign On (SSO) access to the Respond UX. The setup for SAML requires claims in a different format for a RUX deployment vs any existing QUX SAML deployment. * Please see [SAML SSO (RUX)](/configuration/access/saml-sso-rux.md) for details. * Please note that RUX deployments do not support legacy authentication options such as LDAP, RADIUS, and TACACS+ that were available in QUX deployments. Local authentication, which uses accounts defined in the Vectra UI, is still available in RUX deployments. * Setup your SIEM, SOAR, and ITSM integrations. * Please note that the Respond UX does not support direct syslog output but if your integration requires syslog, an intermediary can be used to pull the required data via API calls, and then forward it using syslog. * Please see [SIEM connector (syslog intermediary)](/deployment/getting-started/respond-ux-deployment/siem-connector-syslog-intermediary.md) for details. * It is recommended to directly use the API with the Respond UX. To find RUX specific integrations for SIEM and SOARS see the following and look for integrations labeled for use with RUX deployments. * [SIEM](/integrations/siem.md) * [SOAR](/integrations/soar.md) * [ITSM](/integrations/itsm.md) * If you use the Vectra API, the v2.x API endpoints that were used on your QUX deployment will no longer work. You will need to use v3.x API endpoints that are designed for your new RUX deployment. You will need to create new authentication tokens (using OAUTH) for any API clients. Please note that while the API is largely backwards-compatible, the API authentication is not. Any custom integrations that use the API will have to be updated. Please work with your Vectra account team if you wish for Vectra to assist with migration of custom API scripts. Please see the following for details: * [Vectra REST API Documentation Website](https://apidocs.vectra.ai/) * This is a live site with the ability to download the API specs in .yaml form and also try live queries against your Vectra tenant. * If required, a .pdf of the API spec can also be downloaded from the site. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.vectra.ai/deployment/getting-started/migration-to-rux-from-qux.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.