Endace
Pivot from a Vectra AI detection straight into the matching EndaceProbe packet capture for full-fidelity investigation.
The Endace pivot links integration connects Vectra AI detections to full packet capture in EndaceProbe / EndaceVision. A script adds a note to active host detections containing a pre-scoped EndaceVision link, filtered automatically by the detection's time window and the IP addresses involved.
From an analyst's perspective: open a detection, click the link in the note, and land in EndaceVision looking at exactly the right traffic — no manual copying of IPs or timestamps. This gives investigators immediate access to full-fidelity packet data as context for a Vectra AI detection.
The integration is community-supported and script-based. Setup instructions, requirements, configuration options, and the script itself are maintained on GitHub.
Last updated
Was this helpful?