Migration to RUX from QUX
Reasons to migrate to RUX from QUX, FAQ, prep, migration, and post migration guidance along with required firewall rules.
Upgrading to the Vectra AI Platform with Respond UX
The Vectra AI platform (a RUX deployment) is our best experience for consuming Vectra AI’s Attack Signal Intelligence using a unified set of interfaces and tooling to deliver:
Best-in-class signal clarity
Expedited access to relevant information
Faster investigation workflow
The Vectra AI Platform is cloud-delivered, enabling:
Best-in-class experiences and protection
Cloud performance and scale
Native support for remote and hybrid SOC teams
Customers not yet using the new Vectra AI Platform UX are consuming Vectra through the Appliance Platform where the UI is hosted on their Vectra Brain. This document outlines the process by which your data and configuration is migrated to the Vectra AI Platform. The migration process involves uploading a copy of the configuration, detections, hosts, detection state to the cloud and keeping that in-sync going forward.
Post-migration, customers…
Continue to leverage their existing fleet of Sensors and Brains for the collection and analysis of network traffic.
Fulfill all workflows (UI, API, etc) through cloud endpoints as opposed to endpoints hosted on the Vectra Appliance platform.
Benefit from cloud-powered AI-driven prioritization, and cloud-powered AI-triage to help you focus on the things that really matter within your environment.
Customers not yet using the new Vectra AI Platform with Respond UX are consuming Vectra through the Vectra Appliance platform where the UI (Quadrant UX) is hosted on your Vectra Brain. This document outlines the process by which your data and configuration is migrated to the Vectra AI Platform.
Key Information
UI
Served from Brain appliance
Served from Vectra Cloud
Signal
Partitioned experience, with quadrants, Threat and Certainty
Unified experience with single Urgency Score
Investigation
Using Recall or Stream for network only.
Using integrated Instant and Advanced Investigation for all attack surfaces
Network Coverage
Using existing Brain and Sensor deployment
Using existing Brain and Sensor deployment
Frequently Asked Questions (FAQ)
Will I lose active detections and history?
No, all detections and history are preserved (Recall Metadata is not migrated).
Do I have to do anything?
Yes, but not much! See the Preparing for the migration section below.
How long will it take?
Typical customers will take between 30 and 60 minutes to migrate.
Is there any cost to migrate?
Depends on your deployment. Please talk to your Vectra account team to understand.
Migration Guidance
This below is a brief overview, follow the links or just keep scrolling down for added details.
Preparing for the Migration
There will be a planning meeting with Vectra
Ensure you meet the firewall requirements in the next step.
You will need to ensure you have adequate egress bandwidth to Vectra's cloud.
A date will be scheduled for migration.
You will need to plan for changes to any API integrations and authentication changes.
Firewall Requirements
You will need to ensure you meet the additional firewall requirements for ongoling access to RUX and allow access to the S3 bucket that is required only during migration.
Migration
This section describes what happens the day before migration and on the day of migration. It also details what to expect after migration has completed.
Post Migration
This section describes critical steps that must be followed post-migration for authentication, SIEM/SOAR integration, and any other API level integrations
Preparing for the Migration
Planning Meeting
A planning meeting will be scheduled where your Vectra account team will discuss with you exactly what will happen and when.
Bandwidth Requirements
Validate that you have adequate egress bandwidth to accommodate the transfer of network metadata to the Vectra Cloud to support new metadata based functionality that is only available in RUX. This is estimated to be between 0.5% and 5% (typically near 1%) of the traffic observed by your Brain/Sensors. If you have Recall, this is instead of Recall, not in addition to Recall.
Date and Time
Align with your Vectra account team on the date and time for the migration.
API and Authentication Changes
API Changes
List out any custom API based integration you may have built. Talk with your Vectra account team about any potential impacts. The API for RUX is different than the API used for QUX deployments.
See the Post Migration section for more details.
Authentication Changes
Both QUX and RUX deployments support SAML for Single Sign-On (SSO) but the claim requirements and the way IdP metadata is collected is different for each deployment method.
See the Post Migration section for more details.
Firewall Requirements (RUX Migration)
Ongoing Required Firewall Rules
Adjust your firewall rules (if necessary) to enable ongoing access from the Brain appliance to the Vectra Cloud. There are new firewall rules that are required for RUX deployments that were not previously required for QUX deployments.
Firewall requirements for RUX deployments.
Migration Only Firewall Rules
In addition, during the migration only, Vectra will need connectivity from the existing Brain to a specific AWS S3 bucket. This is required to enable the upload of the Brain's backup to Vectra Cloud.
These need to be opened for HTTPS use over TCP/443.
Access is only required to the one region where your Vecrta AI Platform tenant will be deployed, and it is only required during the migration.
The AWS S3 bucket names are below:
us-west-2 (US)
prd-vuibackup-artifacts-580786928539-uswt2.s3.us-west-2.amazonaws.com
eu-west-1 (Ireland)
prd-vuibackup-artifacts-580786928539-euwt1.s3.eu-west-1.amazonaws.com
eu-central-2 (Switzerland)
prd-vuibackup-artifacts-580786928539-eucl2.s3.eu-central-2.amazonaws.com
ca-central-1 (Canada)
prd-vuibackup-artifacts-580786928539-cacl1.s3.ca-central-1.amazonaws.com
ap-southeast-2 (Australia)
prd-vuibackup-artifacts-580786928539-apse2.s3.ap-southeast-2.amazonaws.com
Migration
On the day before the migration, Vectra will request authorization to proceed with the migration. If authorization is not received, the migration will be postponed. This is to ensure that we don’t migrate when key people are out of office, or when there’s an active and ongoing incident.
[Optional] Should you desire an active call bridge during the migration, this will be provided. Vectra will create this bridge 15 minutes before the migration is due to start and will ensure you are present before the migration starts. The Vectra account team will be able to provide updates on progress during the migration.
On the day of the migration, the CSM/SE will send you an email confirming that the migration will start at the designated date and time.
During the migration, you will not have any access to the Brain UI. The Vectra services running on the Vectra Brain will be suspended for the duration of the migration.
Migrations that take longer than 40 minutes to complete will result in a detection coverage gap from the start of the migration window to the start of the “last 40 minute” window.
For example, if the migration takes 60 minutes, there will be a detection coverage gap from the start of the migration window to 20 minutes into the migration window.
During the migration, data flowing to Recall and Stream will be stopped. The data flow to Stream will resume automatically when the migration completes successfully and attempt to catch up on any queued data. A gap in data in Stream may exist from the migration window.
Expectations Upon Migration Completion
All data and configuration from the Brain has been sent to the Vectra AI platform in the cloud.
All new configuration, metadata, hosts, accounts, detections will start flowing into the Vectra AI platform and visible in the new UI.
If you are a Recall customer, forwarding to Recall will stop since metadata is integrated into the Vectra AI platform and accessible directly from the UI. Your Recall instance will be deprovisioned once the metadata retention period you previously had with Recall has elapsed. Please note that Recall metadata is NOT migrated to your new RUX deployment. If you wish to retain access to Recall before your existing Recall metadata has aged out, please let your migration team know and credentials to directly access your Recall Kibana URL can be provided.
You will receive an email from Vectra with details on how to log into the new Vectra AI platform. This initial login to the UI will require the setup of MFA (Multi-Factor Authentication) once authenticated.
The CSM/Support contact will send you an email to confirm that the migration has been completed, and to ensure that you are able to access the UI.
The UI on the Brain will no longer be accessible. All access must be through the new UI.
Please Note:
Once the migration is complete, you cannot revert back to the appliance platform UI for that deployment.
Post Migration
Login to the Vectra AI platform (RUX) UI using the link and credentials provided in the email.
You will need to re-create any standalone users to enable access to the RUX UI for your team.
If you use SAML, you will need to register a new SAML profile to enable Single-Sign On (SSO) access to the Respond UX. The setup for SAML requires claims in a different format for a RUX deployment vs any existing QUX SAML deployment.
Please see SAML SSO (RUX) for details.
Please note that RUX deployments do not support legacy authentication options such as LDAP, RADIUS, and TACACS+ that were available in QUX deployments. Local authentication, which uses accounts defined in the Vectra UI, is still available in RUX deployments.
Setup your SIEM, SOAR, and ITSM integrations.
Please note that the Respond UX does not support direct syslog output but if your integration requires syslog, an intermediary can be used to pull the required data via API calls, and then forward it using syslog.
Please see SIEM connector (syslog intermediary) for details.
If you use the Vectra API, the v2.x API endpoints that were used on your QUX deployment will no longer work. You will need to use v3.x API endpoints that are designed for your new RUX deployment. You will need to create new authentication tokens (using OAUTH) for any API clients. Please note that while the API is largely backwards-compatible, the API authentication is not. Any custom integrations that use the API will have to be updated. Please work with your Vectra account team if you wish for Vectra to assist with migration of custom API scripts. Please see the following for details:
This is a live site with the ability to download the API specs in .yaml form and also try live queries against your Vectra tenant.
If required, a .pdf of the API spec can also be downloaded from the site.
Last updated
Was this helpful?