Appliance and Sensor Specifications

The Vectra AI Platform provides coverage, clarity, and control across the entire modern network. Coverage for attackers’ moves across all of your network, identity, and cloud threat surfaces. AI signal clarity prioritizes attacks with AI assistants to automatically triage, correlate, and prioritize threats across domains. We put you in control with context to discover, hunt, investigate, and stop attacks early in their progression - all while spending less time prioritizing alerts.

Software updates, including new threat intelligence and detection algorithms, are included with your license. They are delivered to your system on a regular basis to ensure continuous protection from the latest threats. Vectra Match customers can also choose to enable automated curated ruleset updates that provide signature updates.

Vectra appliances are supported in traditional physical on-prem, virtual hypervisor, and IaaS cloud environments. Vectra supports AWS, Azure, and GCP clouds along with VMware, Hyper-V, Nutanix, and KVM hypervisors. Vectra continually evaluates customer demand for support of new environments. Please check with your account team for questions on future plans.

X-Series and S-Series appliances can perform “Sensor” duties, passively capturing network traffic out-of-band and forwarding a metadata stream to the“Brain” appliance for further processing. B-Series and X-Series appliances can serve as the Brain for your deployment. They run network detection models locally and serve as customer side integration point for added coverage, response, and context enhancement options. The Brain appliance is connected to the Vectra cloud where the Respond UX provides the UI along with advanced features such as Instant Investigation and AI-Assisted Search. In Quadrant UX deployments, the Brain appliance serves the classic Vectra UI locally.

Network traffic can be directed to appliances through physical SPAN/Copy/Mirror ports, TAPs, and packet brokers. Native cloud packet forwarding options are supported such as VPC Traffic Mirroring (AWS), VTAP (Azure), and NSI (GCP). Hypervisor based packet forwarding options are also supported. Vectra Sensors support a variety of encapsulation methods such as VXLAN andGENEVE. For additional detail, please see the Vectra NDR (Detect) and Network Identity Architecture Overview.

Physical Appliance Specifications

Alternate Interface Configuration:
*For the X29/M29 and X47/M47 appliances, one of the 10 GbE SFP+ ports that are normally used for capture traffic can be configured to be used as a management interface. When configured as such, the original MGT1 copper port would be unused.

Please see the quick start guides for these appliances for full details and how to configure the alternate interface configurations.

Alternate Interface Configuration:

**For the S1 appliance, both management and capture ports can be configured to use one of the 10 GbE SFP+ ports for either management or capture use. In the default configuration, only the cooper interfaces are used. This results in4 different potential interface configurations for the S1 appliance.

Please see the quick start guides for these appliances for full details and how to configure the alternate interface configurations.

^† SFP Options : For any appliance that supports SFP interface (SFP+, SFP28, QSFP, QSFP28, etc), please see the SFPs and QSFPs supported in Vectra appliances article on the Vectra support site for additional details and note the following regarding which can be included free as part of your order, or added to your order for an additional cost:

• Up to 2 (if supported by your appliance model), SFP, SFP+, or SFP28 modules can be included at no additional cost in your appliance order.
  
  • This is valid for each appliance in your order.
    
  • Additional SFPs above a count of the two per appliance specified above, will incur additional cost.
• All 40/100G QSFPs will incur additional cost over the base price of the appliance. ^‍

^†† Paired Sensors : Refers to how many Sensors (physical, virtual, or cloud) an appliance can pair with.
¹ Tracked Hosts : Refers to how many hosts the appliance running in Brain or Mixed mode can track simultaneously (open host sessions).
Brains can typically retain and display data for larger numbers of hosts, this only refers to how many hosts the system can process metadata for simultaneously.
Performance – Refers to the amount of network traffic observed by Sensors that a Sensor can produce metadata for, or the amount of traffic observed by Sensors that a Brain can process metadata for. The performance numbers are based upon average throughput a given Sensor/Brain can process. Actual performance may vary depending on traffic composition. Please contact Vectra AI to discuss further.

Please see the quick start guides for these appliances for full details and how to configure the alternate interface configurations.

Vectra Match Performance

Virtual Brains – Customer Premise Hypervisor Deployment

Virtual Sensors - Customer Premise Hypervisor Deployment

Cloud - IaaS Deployment

Brain Deployment

² This disk has upgraded performance over standard EBS volumes.

vSensor Deployment

³ AWS vSensor configurations include both “n” and non “n” r5 instance types.

• Networking performance is quoted as “up to 10Gbps” on the r5 instances by AWS and can be influenced by neighboring instances allocated to the same physical hardware inAWS.
• Networking performance is quoted as “up to 25Gbps” on the r5n instances by AWS. These instances are still shared with neighbors but are optimized by AWS to have higher overall network throughput.
• Customers can work with AWS to utilize dedicated instances and distribute instances to provide the required networking throughput to their vSensor instances on that dedicated hardware.

The c5n.18x large vSensor instance type does not have a rolling capture buffer and can therefore not support PCAP generation for Detections that originate from traffic that is processed by those instances.

Due to variability in customer cloud network configurations and how mirroring may configured, it is not possible to guarantee performance on any instance with more than 2 cores (numbers are approximate and based on even distribution of packets across threads). Please contact Vectra to discuss further.

Vectra monitors instance types available from the supported IaaS vendors for cost, performance, and availability. If you have questions about specific instance types that are not supported, please contact your Vectra account team.