v9.9 Release Notes (QUX)

🛡️ Coverage

Rapid Release Improvements

The following improvements have been made to algorithms since the last software release cycle. Customers that are connected to Vectra’s update service with Remote Support enabled have received these improvements. All other customers will be receiving the following improvements as part of this release:

• Vectra AI continues its transition of detections previously delivered through the Suricata engine into native detections running directly on the Vectra flow engine. This ongoing effort ensures advanced attacker behavior coverage is available to all customers, without requiring Suspect Protocol Activity (SPA) or reliance on signature-based detection logic. This release introduces a number of new native detections covering Cobalt Strike, Meterpreter, and Ursnif activity.

• Vectra AI has resolved an issue where Suspicious Remote Execution detections did not correctly display mapped function names due to a missing function map file in container images. The update ensures the required mapping file is properly packaged and loaded, restoring accurate function name visibility and improving detection clarity for remote execution activity.

⚙️ Architecture/Administration

Multi-SAML Support

The Quadrant UX platform currently supports single sign-on (SSO) through integration with a customer’s identity provider (IDP) using a configured SAML profile. Until now, only a single SAML profile can be defined, which restricts integration to one IDP at a time.

To tackle this, we are introducing support for multiple SAML profiles. This enhancement will enable customers and MSSPs to configure and manage integrations with multiple IDPs simultaneously, providing greater flexibility and alignment with complex identity environments.

🐞 Bug Fixes

Please log in to https://support.vectra.ai/vectra/ and search "Quadrant UX Bug Fixes" to view the latest bug fixes.

📎 Appendix

New Close Workflow Enabled by Default in v9.10

In 9.10, customers will be moved by default to our new close workflow. The New Close workflow offers better workflows for customers, and also will power our new operational SOC overflow report. Customers can opt out at any time from their configuration section. Learn more about the workflow here.

S101 Platform End of Sale Notice

The S101 platform has reach its End of Sale milestone on Feb 13^th, 2026. As part of this milestone, Vectra has been transitioning to the new S127 system.

While the S101 reached End of Sale on Feb 13^th, 2026, we are going to continue to provide full platform support until Feb 13^th 2031. This includes support for new software releases, Vectra Customer Support, and hardware warranty based upon warranty terms at time of purchase.

For more information about Vectra EOS/EOL, please see End of Sale/End of Life Policy Page.

Will this upgrade perform a reboot of the Brain or Sensors?

No, a reboot is not required as part of the 9.9 update.