Vectra AI

No entries match these filters. Clear filters

1. v9.15 - Control (2026-10-20) Oct 20, 2026 · issue 130

   Vectra AI adds 48- and 72-hour automatic lockdown durations for HostID, Traffic, and Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. Account lockdowns⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
2. v9.15 - Observe (2026-10-20) Oct 20, 2026 · issue 130

   Vectra AI adds post-quantum cryptographypost-quantum cryptographyCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. metadata in Stream and Recall, a new PQCPQCCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. Dashboard, and expanded JA4LJA4LA network fingerprinting method that estimates client geographic distance or latency by measuring TCP/TLS handshake timing deltas, giving cyber tools a passive way to detect VPN or proxy use. fingerprinting across general TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. traffic.

   • Vectra AI now captures post-quantumpost-quantumCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. cryptography metadata in Stream and Recall, giving teams visibility into which cryptographic methods are in use across network communications.
   • Access a new Post-Quantum Cryptography Dashboard under Dashboard > Post-Quantum Cryptography Dashboard to monitor and track PQC adoption across your network.
   • Vectra AI now extends JA4L fingerprinting to cover general TCP traffic, beyond the previous SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination./TLS and HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate.-only scope, providing richer network context for investigation.

   3 details in Everything

   • New detection Command-and-Control detection expansion
   • New detection Suspicious SMB Activity Coverage
   • Updated detection Kerberoasting Host-Centric Cipher Downgrade detection
3. v9.15 - Platform (2026-10-20) Oct 20, 2026 · issue 130

   Vectra AI v9.15 reorganizes platform navigation under Threat, Exposure, Observability, and Platform, and adds a dedicated Exposure section combining Inventory and Findings.

   • Platform left navigation is reorganized under Threat, Exposure, Observability, and Platform sections; Respond is now Priorities, Investigate is now Event Search, and Discover is now Dashboards.
   • A new Exposure section in the platform navigation brings together Inventory and Findings in one dedicated area.

   2 details in Everything

   • Updated detection SPA Detections Available by Default
   • New supported platform Azure Esv5 Support for Cloud Brain
   • Updated supported platform 100 Gbps Sensor, Brain, and Stream Support
   • Updated supported platform Encapsulated Endpoints Support for Mixed Mode Appliances
   └──▷ BREAKING ON UPGRADE

   • !Esv3-series Azure instance types can no longer run after Nov 15, 2029; Cloud Brain deployments must migrate to Esv5-series before that date.
   • !Sensors with Match/SPA enabled will be rebooted as part of the v9.15 upgrade.
4. v9.14 - Control (2026-09-10) Sep 10, 2026 · issue 071

   Vectra AI v9.14 expands APIv2.5 with Traffic Lockdown support and faster host data retrieval.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   • Expands APIv2.5 support to cover Traffic Lockdown, enabling automation of a broader range of response actions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Improves APIv2.5 host information retrieval performance in Quadrant UX.
   • Expands APIv2.5 support to cover Traffic Lockdown, enabling automation of a broader range of response actions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

5. v9.14 - Observe (2026-09-10) Sep 10, 2026 · issue 071

   Vectra AI v9.14 expands detection coverage for Quick Assist, Tailscale, C2 frameworks, and completes Traffic Visibility Drop Alerting rollout.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   • Adds Traffic Visibility Drop Alerting — now fully available to all customers — delivering health notifications via email, webhook integrations, API, or Syslog when significant drops in observed IPs, traffic bandwidth, or packet volume are detected, using ML-adapted thresholds per customer network.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Expands Suspect Protocol Activity detections to include Microsoft Quick Assist and Tailscale discovery traffic, identifying potentially unauthorized remote-support and overlay-network activity.
   • Adds detection coverage for commonly used command-and-control frameworks and web-scanning behavior.
   • Enhances network metadata with Post-Quantum CryptographyPost-Quantum CryptographyCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. (PQCPQCCryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA.) visibility, surfacing cryptographic methods used across network communications to help identify where modern and post-quantum cryptography is being adopted.
   • Adds Traffic Visibility Drop Alerting — now fully available to all customers — delivering health notifications via email, webhook integrations, API, or Syslog when significant drops in observed IPs, traffic bandwidth, or packet volume are detected, using ML-adapted thresholds per customer network.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   3 more in Everything

6. v9.14 - Platform (2026-09-10) Sep 10, 2026 · issue 071

   Vectra AI v9.14 adds Proxmox/KVMKVMA Linux kernel module that turns the kernel into a hypervisor, letting a process run fully isolated virtual machines using hardware virtualisation extensions. Cyber tools use it to sandbox execution environments at near-native speed. deployment support and expands Microsoft Defender for Endpoint to GCC, GCC HighGCC HighA Microsoft 365 cloud environment restricted to US government contractors handling controlled unclassified information, meeting compliance requirements like ITAR and DFARS that standard commercial tenants cannot satisfy./DoD, and custom environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   • Supports deploying Brain, Sensor, and Stream on KVM-based environments including Proxmox.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Expands Microsoft Defender for Endpoint integration to Commercial, GCC, GCC High/DoD, and custom Microsoft environments.
   • Supports deploying Brain, Sensor, and Stream on KVM-based environments including Proxmox.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

7. v9.14 - Signal (2026-09-10) Sep 10, 2026 · issue 071

   Vectra AI v9.14 adds Microsoft Defender EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. process correlation and HTTP user agent enrichment for Host ID.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   • Adds Microsoft Defender EDR process correlation, automatically surfacing the probable process behind an NDRNDRNetwork detection and response, analyzing network activity to find threats and support investigation. It focuses on communication patterns and suspicious traffic across systems. detection alongside the detection in the platform and via API — eliminating custom SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents./SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. correlation logic.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Enhances Host ID with observed HTTP user agent information to provide additional context for asset identification and investigation across changing sessions.
   • Adds Microsoft Defender EDR process correlation, automatically surfacing the probable process behind an NDRNDRNetwork detection and response, analyzing network activity to find threats and support investigation. It focuses on communication patterns and suspicious traffic across systems. detection alongside the detection in the platform and via API — eliminating custom SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents./SOARSOARSecurity orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. correlation logic.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

8. v9.13 - Observe (2026-07-23) Jul 23, 2026 · issue 022

   Vectra AI v9.13 expands detections for Windows post-exploitation, HTTP attack tools, covert tunneling, and credential/data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels. techniques.

   • New detections for SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments.-based lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access., malicious named pipe activity, and Cobalt Strike SMB beaconing across Windows environments.
   • Expanded HTTP-based behavioral signatures covering malicious file downloads/uploads, certificate abuse, and offensive framework activity using trusted Windows utilities.
   • New detection coverage for web-based tunnels, public tunneling services, and custom BackConnect protocols used to bypass perimeter controls.
   • New detections for Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. Certificate Services abuse, suspicious AD database file transfers, and cloud storage exfiltration via sync tools.

   4 details in Everything

9. v9.13 - Platform (2026-07-23) Jul 23, 2026 · issue 022

   Vectra AI v9.13 expands ERSPANERSPANA Cisco-originated GRE-based tunneling protocol that encapsulates mirrored network traffic and ships it across Layer 3 to a remote capture point, letting cyber tools analyze traffic from distant segments without local tap hardware. support to 8-core+ virtual Sensors and 16 IPs per capture interface.

   • Supports 8-core and higher virtual Sensors for ERSPAN-based monitoring deployments.
   • Supports up to 16 IPs per capture interface in ERSPAN environments.
   • Increases processing efficiency for encapsulated traffic workloads in ERSPAN deployments.

   3 details in Everything

10. v9.13 - Observe (2026-07-21) Jul 21, 2026 · issue 020
    • Adds behavioral signatures for HTTP-based attacker tooling, including malicious file downloads/uploads and certificate-related abuse via trusted Windows utilities and offensive frameworks.
11. v9.12 - Observe (2026-06-08) Jun 8, 2026 · release notes

    Vectra v9.12 adds GhostLock SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. detection, JA4DHCP fingerprints in Recall, expanded NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent./ C2 coverage and Empire/Merlin detections.

    • Adds GhostLock SMB detection for file-level locking behavior associated with the tool’s default authorization artifact.
    • Adds JA4DHCP fingerprint support in Recall metadata.
    • Expands Unified Beacon detection to interactive C2 over HTTP/HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. by detecting sustained connection patterns to uncommon external domains.
    • Adds detection coverage for Empire, Merlin, Caldera Sandcat, and interactive beaconing activity.
    • Adds detection of Ncrack-based RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. activity and Responder NTLM behavior.

    5 details in Everything

12. v9.11 - Observe (2026-05-05) May 5, 2026 · release notes

    Vectra AI v9.11 adds SASESASEA network architecture model combining wide-area networking and network security functions into a single cloud-delivered service, letting cyber tools enforce consistent policy regardless of where users or workloads sit. exfiltration and Beaconless C2 detection with behavioral models.

    • Extends Smash-and-Grab exfiltration detection to SASE traffic (Zscaler and Netskope).
    • Adds XWorm C2 Detection for encrypted TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. check-in patterns.

    2 details in Everything

13. v9.11 - Platform (2026-05-05) May 5, 2026 · release notes

    Vectra AI v9.11 adds traffic visibility drop alerting via email, webhook, API, Syslog and a new top-bar UI.

    └──▷ HOW TO FIND IT
    Receive visibility drop alerts via Syslog for immediate integration with SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. pipelines.
    📍Configure Syslog as a delivery target in the Vectra AI QUX platform settings.
    Access account profile and theme preferences from the new centralized top bar navigation.
    📍Click the account menu in the top-right corner of the Vectra AI UI page.
    • Adds health notifications for drops in observed IPs, traffic bandwidth, and packet volume with adaptive ML detection
    • Adds email, webhook, API, and Syslog delivery targets for visibility drop alerts on QUX
    • Introduces a new top bar UI element for account settings, theme preferences, and logout options

    3 details in Everything

14. v9.10 - Observe (2026-04-08) Apr 8, 2026 · release notes

    Vectra AI v9.10 adds native detections for Sliver/CobaltStrike/Meterpreter/Mythic/DNScat, DeepSeek generative AI, LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. recon, SSH on reserved ports, and NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent./DHCP metadata ex

    • Native detection coverage for Sliver Command & Control activity leveraging LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code./AI modeling for beaconing patterns
    • New Hidden Tunnel detection for stealthy, non-beaconing C2 over previously uncovered protocols
    • Native detections for Cobalt Strike, Meterpreter, Mythic C2, and DNScat activity replacing Suricata engine reliance
    • New rule to detect SSH on other reserved ports
    • Detection of DeepSeek generative AI application usage within network traffic

    +3 more show less

    • Expanded LDAP reconnaissance detection covering Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. enumeration, delegation, and trust relationships
    • NTLM authentication metadata expansion surfacing server challenge and protocol version in Stream and Recall
    • Expanded DHCP telemetry including vendor/user class identifiers, client architecture, router info, TFTPTFTPTrivial File Transfer Protocol, a minimal UDP-based file transfer protocol standardized in RFC 1350, used by cyber tools when simplicity and low overhead matter more than authentication or error recovery./WPAD/MUD URLs

    8 details in Everything

15. v9.10 - Platform (2026-04-08) Apr 8, 2026 · release notes

    Vectra AI v9.10 adds Multi-SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. support and SSH personal key management

    └──▷ HOW TO FIND IT
    Switch the platform interface to dark mode via user profile settings
    📍In the UI, go to My Profile › Theme and select Dark Mode
    • Adds multi-SAML identity provideridentity providerA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. support via the UI and API
    • Introduces My Profile > Theme toggle for Dark Mode public preview

    2 details in Everything

16. v9.10 - Signal (2026-04-08) Apr 8, 2026 · release notes

    Vectra AI v9.10 makes CrowdStrike EDREDREndpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. process correlation GA for all customers to streamline investigations.

17. v9.9 - Observe (2026-03-02) Mar 2, 2026 · release notes

    Vectra AI v9.9 adds new Azure token misuse detections, expands brute-force coverage, and moves Cobalt Strike/Meterpreter/Ursnif to native flow engine.

    • Adds Azure Suspicious Token Usage - User Principal detection for stolen user principal access tokensaccess tokensA credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions.
    • Adds Azure Suspicious Token Usage - Service Principal detection for misused service principal and managed identity tokens
    • Enhances Azure AD Successful Brute-Force detection with ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses. parameters, trusted device logic, and faster time-to-detect

    3 details in Everything

18. v9.8 - Control (2026-01-27) Jan 27, 2026 · release notes

    Vectra AI v9.8 adds Traffic Lockdown firewall integration and Operational Overview Report.

    └──▷ HOW TO FIND IT
    Automatically block malicious hosts at the network edge by integrating with your firewall infrastructure.
    📍Visit Traffic Lockdown for configuration instructions.
    Monitor SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. performance metrics and investigation efficiency in a single visual dashboard.
    📍Access the Operational Overview Report from your Vectra AI dashboard to view Mean Time to Assignment, Mean Time to Investigate, and Mean Time to Resolve.
    • Adds Traffic Lockdown, an automated network defense capability that publishes threat feed IPs to supported firewalls for immediate enforcement.
    • Introduces the Operational Overview Report, a visual dashboard displaying Mean Time to Assignment, Mean Time to Investigate, and Mean Time to Resolve alongside top detections and MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. mappings.

    2 details in Everything

19. v9.8 - Observe (2026-01-27) Jan 27, 2026 · release notes

    Vectra AI v9.8 adds seven new Azure suspect operation detections, improves Smash and Grab accuracy, and introduces a native Threat Intelligence engine.

    • Introduces native detection for Azure Suspect Operation - DNS Security Policy Modification to identify deletion or modification of DNS Security Policy resources
    • Introduces native detection for Azure Suspect Operation - Flow Logs Disabled to identify deletion of Azure flow log resources
    • Introduces native detection for Azure Suspect Operation - Network Security Config Change to identify creation or modification of Azure network security groups or firewalls
    • Introduces native detection for Azure Suspect Operation - High-Risk Deletion to identify removal of sensitive backups and immutability policies
    • Adds new detection Azure AD Suspect Operation: Guest User Added to surface suspicious external guest user invitations inconsistent with behavioral profiles

    +2 more show less

    • Adds new detection Azure AD Suspect Operation: Unusual Sign-On from a Proxy leveraging the new Threat Intelligence engine for sign-in behavior analysis
    • Improves Smash and Grab detection accuracy by ensuring destination domain names update correctly later in a session

    7 details in Everything

20. v9.8 - Platform (2026-01-27) Jan 27, 2026 · release notes

    Vectra AI v9.8 adds Syslog TLS validation, personal SSH login, and a unified Configuration tab.

    • Adds certificate validation support for Syslog destinations via a new checkbox in the UI
    • Enables authorized UI users to log in to appliances using personal SSH credentials instead of the shared vectra account
    • Replaces Deployment Manager with Infrastructure Manager for GCP deployments

    3 details in Everything

21. v9.13 - Observe · issue 018

    Vectra AI v9.13 adds expanded detections for Windows post-exploitation, HTTP attack tools, covert tunneling, credential theft, and cloud exfiltration.

    • New detections for SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments.-based lateral movementlateral movementMoving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access., malicious named pipe activity, and Cobalt Strike SMB beaconing across Windows environments.
    • Expanded HTTP-based detection coverage for malicious downloads, uploads, certificate abuse, and offensive framework activity using trusted Windows utilities.
    • New detection coverage for tunneling frameworks and covert channels, including web-based tunnels, public tunneling services, and custom BackConnect protocols.
    • New detections for Active DirectoryActive DirectoryMicrosoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. Certificate Services abuse, suspicious AD database file transfers, and cloud storage exfiltration via common sync tools.

    4 details in Everything

22. v9.13 - Platform · issue 018

    Vectra AI v9.13 expands ERSPANERSPANA Cisco-originated GRE-based tunneling protocol that encapsulates mirrored network traffic and ships it across Layer 3 to a remote capture point, letting cyber tools analyze traffic from distant segments without local tap hardware. support with 8- and 16-core virtual Sensor options and improved encapsulated traffic performance.

    • Supports 8- and 16-core virtual Sensors for ERSPAN-based monitoring deployments.
    • Improved configuration handling for ERSPAN capture interface addressing simplifies virtual and physical Sensor setup.
    • Performance optimizations increase processing efficiency for encapsulated traffic workloads in ERSPAN environments.

    3 details in Everything