# Restoring backups {% hint style="warning" %} **Please Note:** Prior to running any restore operation, please examine the [Common Options for the Restore Run Command](#common-options-for-the-restore-run-command) below to ensure that the proper options are selected if you are replacing a Brain. In particular, it is critical that you use the `--replace` option when migrating to a new Brain if the new Brain will fully replace the old Brain. {% endhint %} {% hint style="info" %} **Please Note:** * You **can not** restore a RUX brain (also known as a cloud-bridge) onto another RUX brain (cloud-bridge). * You can restore a RUX brain backup onto the same RUX brain. * You can also restore a RUX brain (cloud-bridge) onto any non-RUX brain. {% endhint %} To run a restore, you will need to provide the filename of the backup that you are trying to restore along with the location of the file (local or external target). Use the restore list command on the Brain that you will be restoring to in order to see a list of available backup files that can be restored. ```language-markup restore list ``` Example output: ```language-markup Timestamp |Origin Serial Number |Location |Filename 2024-04-14 00:03:11 CDT VHE096b6600d63f2a566b3bce13db90abcd This machine migration-8.4.0-0-10941-20240414-0003.tar.gz.gpg 2024-04-11 19:30:04 CDT VHE12100b75730baaaf48b91eeb04a4def0 This machine migration-8.4.0-0-10941-20240411-1930.tar.gz.gpg 2024-04-11 19:29:40 CDT VHE12100b75730baaaf48b91eeb04a4def0 This machine migration-8.4.0-0-10941-20240411-1929.tar.gz.gpg 2024-04-11 19:27:59 CDT VHE12100b75730baaaf48b91eeb04a4def0 This machine migration-8.4.0-0-10941-20240412-0027.tar.gz.gpg None unknown scp-1 migration-8.4.0-0-10941-20240411-1928.tar.gz.gpg None unknown scp-1 migration-8.4.0-0-10941-20240404-1928.tar.gz.gpg None unknown sftp-2 migration-8.4.0-0-10941-20240411-1928.tar.gz.gpg None unknown sftp-2 migration-8.4.0-0-10941-20240404-1928.tar.gz.gpg None unknown s3-4 migration-8.4.0-0-10941-20240411-1928.tar.gz.gpg None unknown s3-4 migration-8.4.0-0-10941-20240404-1928.tar.gz.gpg ``` {% hint style="info" %} **Please Note:** Only the most recent backup file is kept on the local machine when backing up locally. In the above example, the backups for Serial # `VHE12100b75730baaaf48b91eeb04a4def0` are from Brain-to-Brain backups. The retention of Brain-to-Brain backup files is discussed in the [Brain-to-Brain Backups](https://docs.vectra.ai/operations/backup-restore-dr/configuring-external-targets#brain-to-brain-backups) section above (in the larger Configuring External Targets section). {% endhint %} * `Location` in the above table shows `This machine` for a file that exists locally on the Brain that just ran the restore list command. The name of the external target is listed in `Location` for external targets. To restore a backup file that resides on the local machine, execute the following: ```language-markup restore run from-local --filename ``` * `--filename ` may be omitted to use the local backup file taken for this machine. If there is none, the most recent backup file from Brain-to-Brain sync will be used. For external targets you need to specify the external target and the filename. As an example using the `sftp-2` target: ```language-markup restore run from-external-target sftp-2 --filename ``` * `--filename ` may be omitted to use the most recent backup file on the specified target. If the file that you need to restore is not in the restore list output, but is otherwise accessible to the Brain, then a URL may be used. This is NOT common. HTTP(S) URLs: ```language-markup restore run from-url https://your-server.com/migration-1234.tar.gz.gpg # HTTPS without certificate validation (not recommended) restore run from-url https://your-server.com/migration-1234.tar.gz.gpg --no-check-https-certificate ``` SFTP or SCP URLs: ```language-markup restore run from-url sftp://ubuntu@192.168.12.34:/path/to/backup/migration-1234.tar.gz.gpg restore run from-url scp://ubuntu@192.168.12.34:/path/to/backup/migration-1234.tar.gz.gpg ``` ## Common Options for the Restore Run Command The restore run command (from-local, from-external-target, and from-url) also accept the following options: * `--preserve-saml` * Keeps the SAML configuration that was present on the target Brain prior to the restore. * For example, this can be helpful when SAML configuration is tied to an IP address that will be different on the target Brain. * `--preserve-ui-certs` * Keeps the UI certificates that were present on the target Brain prior to the restore. * This can be useful when the restore target will have a different IP/hostname that would invalidate the UI certificate configuration. * `--replace` * This option is meant to be used when a Brain is being fully replaced by another Brain and ensures that internal processes at Vectra properly link this new Brain with our back end as a replacement. * For customers running the Respond UX with network data sources, this option will ensure your replacement Brain can automatically connect to your GUI that is being served from the Vectra AI platform. * For customers running the Quadrant UX with non-network data sources (AWS CloudTrail, Azure AD & M365, etc), this option will ensure that these data sources will now report detections to the new Brain instead of the old Brain. {% hint style="info" %} **Please Note:** * The Brain must be connected to the Vectra cloud (at a minimum: update2.vectranetworks.com) at the time the restore is run for the back end to be properly linked. This should already be the case for customers using the Respond UX or Quadrant UX customers with non-network data sources because Vectra Cloud connectivity is required for either. * NTP settings do not restore upon execution of this command, ensure the NTP settings are updated appropriately after the restore has completed. {% endhint %} ## **Deleting Versions** {% hint style="info" %} **Please Note:** Users can only restore a machine from a backup with the same version as the current machine. To delete out-of-date backup versions, use the following commands. {% endhint %} To delete all backups on the current machine, and on any external targets, with version 8.3: ```language-markup restore delete-version 8.3 ``` To delete all backups on the current machine, and on any external targets regardless of version: ```language-markup restore delete-version all ``` For either command, add `--local-only` to only delete backups on the Brain you are logged into. This will not touch backups on any external targets.