Vectra AI Platform Metadata Retention FAQ
FAQ for Vectra AI metadata retention for observability, hunting, and investigations.
What is Vectra AI metadata retention?
Metadata retention unlocks deeper investigations, flexible hunting, and a broad set of observability insights across Vectra AI monitored attack surfaces.
How do I access metadata retention?
Metadata retention is available in the new Vectra AI experience and is enabled at specific Vectra AI license levels. Retention can be increased up to 180 days. Contact your Vectra AI account team to learn more.
How long can historical data be stored?
The retention period is the maximum number of days during which data is searchable in the Vectra AI Platform.
Retention can be increased for up to 180 days.
Is there a limit to the number of results rendered in a search?
Yes. The UI renders up to 10,000 results per query.
Is there a limit to the number of results downloaded in the CSV file from a search?
The search download feature exports the same number of results rendered in the UI. If a search reaches the 10,000-result limit, the CSV download also contains 10,000 results.
What is a Vectra AI enriched field?
Enriched metadata fields contain additional information or attributes that, when added to the existing metadata of a network or security event, provide more context and insight into the event.
Typically, enriched metadata fields are derived from advanced analysis techniques, machine learning algorithms, or other data enrichment processes.
What network metadata is enriched with host information?
Network metadata is enriched with the name of the host associated with the traffic, when available, for the most recent 30 days of traffic. Traffic from hosts with detections is enriched for 60 days. Beyond 30 days, non-enriched host names appear as null.
How do I filter my network metadata using a sensor?
Filter network metadata using the sensor_uid field.
How do I filter using CIDR notation?
To use CIDR notation, add a filter for any IP address field and specify the filter in (CIDR notation).
Where can I see the metadata types available?
Metadata for all available for all monitored domains, e.g. Network, Entra ID, M365, AWS Control Plane, and Azure Control Plane.
Vectra AI Platform Metadata Descriptions
Are there Vectra enriched fields for AWS metadata?
Yes. The Vectra enriched metadata field in AWS is called Vectra.entity.Resolved_Identity.Canonical_Name.
In AWS, a user or service often performs actions using an assumed role. In the metadata, this is reflected by a value in the assumedRole field.
Vectra automatically attributes CloudTrail events to the original entity that initiated the action instead of an intermediate or temporary access key or role. This provides the visibility needed for a successful investigation and exposes that value in Vectra.entity.Resolved_Identity.Canonical_Name.
Are there Vectra AI enriched fields for AAD and M365 metadata?
The enriched field in Azure AD and M365 data streams is VECTRA.IDENTITY_PRINCIPAL. It identifies the normalized identity performing the action accross available logs for faster searching.
Which Microsoft license do I need to collect all the metadata needed for AAD and M365 Instant Investigation?
Microsoft requires a P1 license for access to SignIn and Directory Audit logs. No other log types are limited by Microsoft licenses.
Why do I get an error message in Instant Investigation for Azure AD and M365 that says I may not have the required Microsoft license?
Microsoft requires a P1 license for access to Azure AD SignIn and Directory Audit logs. If you don’t have that license in your deployment, Instant Investigation won’t be able to provide results for the SignIns and Directory Audit data streams.
What search period is selected by default after I click the Instant Investigation tab?
When accessing the Instant Investigation tab for a host or an account, the default time selected is 6 hours prior to the last active detection.
If the last active detection falls outside the retention period, the default search will instead be set to 6 hours before the moment the Instant Investigation page is accessed ('now').
Last updated
Was this helpful?