Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Restoring backups

Guidance for restoring backups and deleting older backup versions.

Please Note:

Prior to running any restore operation, please examine the Common Options for the Restore Run Command below to ensure that the proper options are selected if you are replacing a Brain. In particular, it is critical that you use the --replace option when migrating to a new Brain if the new Brain will fully replace the old Brain.

Please Note:

  • You can not restore a RUX brain (also known as a cloud-bridge) onto another RUX brain (cloud-bridge).

  • You can restore a RUX brain backup onto the same RUX brain.

  • You can also restore a RUX brain (cloud-bridge) onto any non-RUX brain.

To run a restore, you will need to provide the filename of the backup that you are trying to restore along with the location of the file (local or external target).

Use the restore list command on the Brain that you will be restoring to in order to see a list of available backup files that can be restored.

restore list

Example output:

Timestamp              |Origin Serial Number               |Location    |Filename
2024-04-14 00:03:11 CDT VHE096b6600d63f2a566b3bce13db90abcd This machine migration-8.4.0-0-10941-20240414-0003.tar.gz.gpg
2024-04-11 19:30:04 CDT VHE12100b75730baaaf48b91eeb04a4def0 This machine migration-8.4.0-0-10941-20240411-1930.tar.gz.gpg
2024-04-11 19:29:40 CDT VHE12100b75730baaaf48b91eeb04a4def0 This machine migration-8.4.0-0-10941-20240411-1929.tar.gz.gpg
2024-04-11 19:27:59 CDT VHE12100b75730baaaf48b91eeb04a4def0 This machine migration-8.4.0-0-10941-20240412-0027.tar.gz.gpg
None                    unknown                             scp-1        migration-8.4.0-0-10941-20240411-1928.tar.gz.gpg
None                    unknown                             scp-1        migration-8.4.0-0-10941-20240404-1928.tar.gz.gpg
None                    unknown                             sftp-2       migration-8.4.0-0-10941-20240411-1928.tar.gz.gpg
None                    unknown                             sftp-2       migration-8.4.0-0-10941-20240404-1928.tar.gz.gpg
None                    unknown                             s3-4         migration-8.4.0-0-10941-20240411-1928.tar.gz.gpg
None                    unknown                             s3-4         migration-8.4.0-0-10941-20240404-1928.tar.gz.gpg

Please Note:

Only the most recent backup file is kept on the local machine when backing up locally. In the above example, the backups for Serial # VHE12100b75730baaaf48b91eeb04a4def0 are from Brain-to-Brain backups. The retention of Brain-to-Brain backup files is discussed in the Brain-to-Brain Backups section above (in the larger Configuring External Targets section).

  • Location in the above table shows This machine for a file that exists locally on the Brain that just ran the restore list command. The name of the external target is listed in Location for external targets.

To restore a backup file that resides on the local machine, execute the following:

  • --filename <FILE> may be omitted to use the local backup file taken for this machine. If there is none, the most recent backup file from Brain-to-Brain sync will be used.

For external targets you need to specify the external target and the filename. As an example using the sftp-2 target:

  • --filename <FILE> may be omitted to use the most recent backup file on the specified target.

If the file that you need to restore is not in the restore list output, but is otherwise accessible to the Brain, then a URL may be used. This is NOT common.

HTTP(S) URLs:

SFTP or SCP URLs:

Common Options for the Restore Run Command

The restore run command (from-local, from-external-target, and from-url) also accept the following options:

  • --preserve-saml

    • Keeps the SAML configuration that was present on the target Brain prior to the restore.

    • For example, this can be helpful when SAML configuration is tied to an IP address that will be different on the target Brain.

  • --preserve-ui-certs

    • Keeps the UI certificates that were present on the target Brain prior to the restore.

    • This can be useful when the restore target will have a different IP/hostname that would invalidate the UI certificate configuration.

  • --replace

    • This option is meant to be used when a Brain is being fully replaced by another Brain and ensures that internal processes at Vectra properly link this new Brain with our back end as a replacement.

    • For customers running the Respond UX with network data sources, this option will ensure your replacement Brain can automatically connect to your GUI that is being served from the Vectra AI platform.

    • For customers running the Quadrant UX with non-network data sources (AWS CloudTrail, Azure AD & M365, etc), this option will ensure that these data sources will now report detections to the new Brain instead of the old Brain.

Please Note:

  • The Brain must be connected to the Vectra cloud (at a minimum: update2.vectranetworks.com) at the time the restore is run for the back end to be properly linked. This should already be the case for customers using the Respond UX or Quadrant UX customers with non-network data sources because Vectra Cloud connectivity is required for either.

  • NTP settings do not restore upon execution of this command, ensure the NTP settings are updated appropriately after the restore has completed.

Deleting Versions

Please Note:

Users can only restore a machine from a backup with the same version as the current machine. To delete out-of-date backup versions, use the following commands.

To delete all backups on the current machine, and on any external targets, with version 8.3:

To delete all backups on the current machine, and on any external targets regardless of version:

For either command, add --local-only to only delete backups on the Brain you are logged into. This will not touch backups on any external targets.

PreviousConfiguring external targetsNextTroubleshooting and additional commands

Last updated

Was this helpful?