Vectra AI — The Cyber Toolchain

Vectra AI v9.15 - Control (2026-10-20)

Tue, 20 Oct 2026 00:00:00 GMT

Vectra AI adds 48- and 72-hour automatic lockdown durations for HostID, Traffic, and Active Directory Account lockdowns⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Automatic lockdown now supports 48- and 72-hour durations for HostID Lockdown, Traffic Lockdown, and Active Directory Accounts, in addition to all existing options, so analysts can contain risk across weekends, holidays, or low-coverage periods without manual intervention.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/vectra-ai

Vectra AI v9.15 - Observe (2026-10-20)

Tue, 20 Oct 2026 00:00:00 GMT

Vectra AI adds post-quantum cryptography metadata visibility, a PQC dashboard, and expanded JA4L fingerprinting to cover general TCP traffic⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Access a new Post-Quantum Cryptography Dashboard under `Dashboard > Post-Quantum Cryptography Dashboard` to monitor and track PQC adoption across your network.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Vectra AI now captures post-quantum cryptography metadata in Stream and Recall, giving teams visibility into which cryptographic methods are in use across network communications. • Vectra AI now extends JA4L fingerprinting to cover general TCP traffic, beyond the previous SSL/TLS and HTTPS-only scope, providing richer network context for investigation. • Vectra AI now detects suspicious SMB client behavior and executable transfers over administrative shares to surface lateral movement and attacker tooling activity. • Vectra AI now detects command-and-control activity from Adaptix, Ares, Pupy, Quasar, Manjusaka, and Cobalt Strike across HTTP, DNS, and additional network channels. • Vectra AI now applies host-specific behavioral thresholds to Kerberoasting Weak Cipher Downgrade detection, improving sensitivity to low-volume weak-cipher activity where host history is available. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/vectra-ai

Vectra AI v9.15 - Platform (2026-10-20)

Tue, 20 Oct 2026 00:00:00 GMT

Vectra AI adds ERSPAN/GRE/GENEVE/VXLAN decapsulation for Mixed Mode appliances, 100 Gbps sensor support, Azure Esv5 Cloud Brain instances, and SPA detections on by default in⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Mixed Mode appliances now support ERSPAN decapsulation and IP addresses on capture interfaces, letting administrators direct ERSPAN, GRE, GENEVE, and VXLAN tunneled traffic to a specific capture interface.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Vectra AI S127, B127, and M47 appliances now support up to 100 Gbps of throughput, extending network visibility across high-volume environments. • Vectra AI now supports Azure Esv5-series instances for Cloud Brain deployments, including 16-core and 32-core images, replacing the Esv3-series. • Suspect Protocol Activity (SPA) detections are now available to all Vectra NDR customers by default, without separately enabling the Suricata-based SPA feature. • A small set of former SPA rules are now exclusively available to customers running Match through the Vectra Curated Ruleset, using Vectra's reserved SID range 4,200,000–4,299,999 and the naming format `VECTRA `. • Platform left navigation is reorganized under Threat, Exposure, Observability, and Platform sections; Respond is now Priorities, Investigate is now Event Search, and Discover is now Dashboards. • A new Exposure section in the platform navigation brings together Inventory and Findings in one dedicated area. Breaking changes: • Esv3-series Azure instance types can no longer run after Nov 15, 2029; Cloud Brain deployments must migrate to Esv5-series before that date. • Sensors with Match/SPA enabled will be rebooted as part of the v9.15 upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/vectra-ai

Vectra AI v9.14 - Control (2026-09-10)

Thu, 10 Sep 2026 00:00:00 GMT

Vectra AI v9.14 expands APIv2.5 with Traffic Lockdown support and faster host data retrieval.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Expands APIv2.5 support to cover Traffic Lockdown, enabling automation of a broader range of response actions.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Improves APIv2.5 host information retrieval performance in Quadrant UX. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/vectra-ai

Vectra AI v9.14 - Observe (2026-09-10)

Thu, 10 Sep 2026 00:00:00 GMT

Vectra AI v9.14 expands detection coverage for Quick Assist, Tailscale, C2 frameworks, and completes Traffic Visibility Drop Alerting rollout.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Traffic Visibility Drop Alerting — now fully available to all customers — delivering health notifications via email, webhook integrations, API, or Syslog when significant drops in observed IPs, traffic bandwidth, or packet volume are detected, using ML-adapted thresholds per customer network.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Expands Suspect Protocol Activity detections to include Microsoft Quick Assist and Tailscale discovery traffic, identifying potentially unauthorized remote-support and overlay-network activity. • Adds detection coverage for commonly used command-and-control frameworks and web-scanning behavior. • Enhances network metadata with Post-Quantum Cryptography (PQC) visibility, surfacing cryptographic methods used across network communications to help identify where modern and post-quantum cryptography is being adopted. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/vectra-ai

Vectra AI v9.14 - Platform (2026-09-10)

Thu, 10 Sep 2026 00:00:00 GMT

Vectra AI v9.14 adds Proxmox/KVM deployment support and expands Microsoft Defender for Endpoint to GCC, GCC High/DoD, and custom environments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Supports deploying Brain, Sensor, and Stream on KVM-based environments including Proxmox.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Expands Microsoft Defender for Endpoint integration to Commercial, GCC, GCC High/DoD, and custom Microsoft environments. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/vectra-ai

Vectra AI v9.14 - Signal (2026-09-10)

Thu, 10 Sep 2026 00:00:00 GMT

Vectra AI v9.14 adds Microsoft Defender EDR process correlation and HTTP user agent enrichment for Host ID.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds Microsoft Defender EDR process correlation, automatically surfacing the probable process behind an NDR detection alongside the detection in the platform and via API — eliminating custom SIEM/SOAR correlation logic.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enhances Host ID with observed HTTP user agent information to provide additional context for asset identification and investigation across changing sessions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/vectra-ai

Vectra AI v9.13 - Observe (2026-07-23)

Thu, 23 Jul 2026 00:00:00 GMT

Vectra AI v9.13 expands detections for Windows post-exploitation, HTTP attack tools, covert tunneling, and credential/data exfiltration techniques. • New detections for SMB-based lateral movement, malicious named pipe activity, and Cobalt Strike SMB beaconing across Windows environments. • Expanded HTTP-based behavioral signatures covering malicious file downloads/uploads, certificate abuse, and offensive framework activity using trusted Windows utilities. • New detection coverage for web-based tunnels, public tunneling services, and custom BackConnect protocols used to bypass perimeter controls. • New detections for Active Directory Certificate Services abuse, suspicious AD database file transfers, and cloud storage exfiltration via sync tools. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/vectra-ai

Vectra AI v9.13 - Platform (2026-07-23)

Thu, 23 Jul 2026 00:00:00 GMT

Vectra AI v9.13 expands ERSPAN support to 8-core+ virtual Sensors and 16 IPs per capture interface. • Supports 8-core and higher virtual Sensors for ERSPAN-based monitoring deployments. • Supports up to 16 IPs per capture interface in ERSPAN environments. • Increases processing efficiency for encapsulated traffic workloads in ERSPAN deployments. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/vectra-ai

Vectra AI v9.13 - Observe (2026-07-21)

Tue, 21 Jul 2026 00:00:00 GMT

• Adds behavioral signatures for HTTP-based attacker tooling, including malicious file downloads/uploads and certificate-related abuse via trusted Windows utilities and offensive frameworks. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/vectra-ai

Vectra AI v9.12 - Observe (2026-06-08)

Mon, 08 Jun 2026 00:00:00 GMT

Vectra v9.12 adds GhostLock SMB detection, JA4DHCP fingerprints in Recall, expanded NTLM/ C2 coverage and Empire/Merlin detections. • Adds `GhostLock` SMB detection for file-level locking behavior associated with the tool’s default authorization artifact. • Adds JA4DHCP fingerprint support in Recall metadata. • Expands Unified Beacon detection to interactive C2 over HTTP/HTTPS by detecting sustained connection patterns to uncommon external domains. • Adds detection coverage for Empire, Merlin, Caldera Sandcat, and interactive beaconing activity. • Adds detection of Ncrack-based RDP activity and Responder NTLM behavior. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/vectra-ai

Vectra AI v9.11 - Observe (2026-05-05)

Tue, 05 May 2026 00:00:00 GMT

Vectra AI v9.11 adds SASE exfiltration and Beaconless C2 detection with behavioral models. • Extends Smash-and-Grab exfiltration detection to SASE traffic (Zscaler and Netskope). • Adds XWorm C2 Detection for encrypted TCP check-in patterns. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/vectra-ai

Vectra AI v9.11 - Platform (2026-05-05)

Tue, 05 May 2026 00:00:00 GMT

Vectra AI v9.11 adds traffic visibility drop alerting via email, webhook, API, Syslog and a new top-bar UI. • Adds health notifications for drops in observed IPs, traffic bandwidth, and packet volume with adaptive ML detection • Adds email, webhook, API, and Syslog delivery targets for visibility drop alerts on QUX • Introduces a new top bar UI element for account settings, theme preferences, and logout options Full history on Cyber Toolchain: https://cybertoolchain.io/tools/vectra-ai

Vectra AI v9.10 - Observe (2026-04-08)

Wed, 08 Apr 2026 00:00:00 GMT

Vectra AI v9.10 adds native detections for Sliver/CobaltStrike/Meterpreter/Mythic/DNScat, DeepSeek generative AI, LDAP recon, SSH on reserved ports, and NTLM/DHCP metadata ex • Native detection coverage for Sliver Command & Control activity leveraging LLM/AI modeling for beaconing patterns • New Hidden Tunnel detection for stealthy, non-beaconing C2 over previously uncovered protocols • Native detections for Cobalt Strike, Meterpreter, Mythic C2, and DNScat activity replacing Suricata engine reliance • New rule to detect SSH on other reserved ports • Detection of DeepSeek generative AI application usage within network traffic • Expanded LDAP reconnaissance detection covering Active Directory enumeration, delegation, and trust relationships • NTLM authentication metadata expansion surfacing server challenge and protocol version in Stream and Recall • Expanded DHCP telemetry including vendor/user class identifiers, client architecture, router info, TFTP/WPAD/MUD URLs Full history on Cyber Toolchain: https://cybertoolchain.io/tools/vectra-ai

Vectra AI v9.10 - Platform (2026-04-08)

Wed, 08 Apr 2026 00:00:00 GMT

Vectra AI v9.10 adds Multi-SAML support and SSH personal key management • Adds multi-SAML identity provider support via the UI and API • Introduces `My Profile > Theme` toggle for Dark Mode public preview Full history on Cyber Toolchain: https://cybertoolchain.io/tools/vectra-ai

Vectra AI v9.10 - Signal (2026-04-08)

Wed, 08 Apr 2026 00:00:00 GMT

Vectra AI v9.10 makes CrowdStrike EDR process correlation GA for all customers to streamline investigations. • Makes CrowdStrike EDR process correlation generally available for all Vectra AI customers. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/vectra-ai

Vectra AI v9.9 - Observe (2026-03-02)

Mon, 02 Mar 2026 00:00:00 GMT

Vectra AI v9.9 adds new Azure token misuse detections, expands brute-force coverage, and moves Cobalt Strike/Meterpreter/Ursnif to native flow engine. • Adds `Azure Suspicious Token Usage - User Principal` detection for stolen user principal access tokens • Adds `Azure Suspicious Token Usage - Service Principal` detection for misused service principal and managed identity tokens • Enhances `Azure AD Successful Brute-Force` detection with ASN parameters, trusted device logic, and faster time-to-detect Full history on Cyber Toolchain: https://cybertoolchain.io/tools/vectra-ai

Vectra AI v9.8 - Control (2026-01-27)

Tue, 27 Jan 2026 00:00:00 GMT

Vectra AI v9.8 adds Traffic Lockdown firewall integration and Operational Overview Report. • Adds 'Traffic Lockdown', an automated network defense capability that publishes threat feed IPs to supported firewalls for immediate enforcement. • Introduces the 'Operational Overview Report', a visual dashboard displaying Mean Time to Assignment, Mean Time to Investigate, and Mean Time to Resolve alongside top detections and MITRE ATT&CK mappings. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/vectra-ai

Vectra AI v9.8 - Observe (2026-01-27)

Tue, 27 Jan 2026 00:00:00 GMT

Vectra AI v9.8 adds seven new Azure suspect operation detections, improves Smash and Grab accuracy, and introduces a native Threat Intelligence engine. • Introduces native detection for "Azure Suspect Operation - DNS Security Policy Modification" to identify deletion or modification of DNS Security Policy resources • Introduces native detection for "Azure Suspect Operation - Flow Logs Disabled" to identify deletion of Azure flow log resources • Introduces native detection for "Azure Suspect Operation - Network Security Config Change" to identify creation or modification of Azure network security groups or firewalls • Introduces native detection for "Azure Suspect Operation - High-Risk Deletion" to identify removal of sensitive backups and immutability policies • Adds new detection "Azure AD Suspect Operation: Guest User Added" to surface suspicious external guest user invitations inconsistent with behavioral profiles • Adds new detection "Azure AD Suspect Operation: Unusual Sign-On from a Proxy" leveraging the new Threat Intelligence engine for sign-in behavior analysis • Improves Smash and Grab detection accuracy by ensuring destination domain names update correctly later in a session Full history on Cyber Toolchain: https://cybertoolchain.io/tools/vectra-ai

Vectra AI v9.8 - Platform (2026-01-27)

Tue, 27 Jan 2026 00:00:00 GMT

Vectra AI v9.8 adds Syslog TLS validation, personal SSH login, and a unified Configuration tab. • Adds certificate validation support for Syslog destinations via a new checkbox in the UI • Enables authorized UI users to log in to appliances using personal SSH credentials instead of the shared 'vectra' account • Replaces Deployment Manager with Infrastructure Manager for GCP deployments Full history on Cyber Toolchain: https://cybertoolchain.io/tools/vectra-ai

Vectra AI v9.13 - Observe

Vectra AI v9.13 adds expanded detections for Windows post-exploitation, HTTP attack tools, covert tunneling, credential theft, and cloud exfiltration. • New detections for SMB-based lateral movement, malicious named pipe activity, and Cobalt Strike SMB beaconing across Windows environments. • Expanded HTTP-based detection coverage for malicious downloads, uploads, certificate abuse, and offensive framework activity using trusted Windows utilities. • New detection coverage for tunneling frameworks and covert channels, including web-based tunnels, public tunneling services, and custom BackConnect protocols. • New detections for Active Directory Certificate Services abuse, suspicious AD database file transfers, and cloud storage exfiltration via common sync tools. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/vectra-ai

Vectra AI v9.13 - Platform

Vectra AI v9.13 expands ERSPAN support with 8- and 16-core virtual Sensor options and improved encapsulated traffic performance. • Supports 8- and 16-core virtual Sensors for ERSPAN-based monitoring deployments. • Improved configuration handling for ERSPAN capture interface addressing simplifies virtual and physical Sensor setup. • Performance optimizations increase processing efficiency for encapsulated traffic workloads in ERSPAN environments. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/vectra-ai