Vectra AI Platform

Lets an AI agent investigate a confirmed network threat and propose or execute containment actions, such as isolating a host or blocking a flow, under configurable human approval gates that move response from manual sign-off toward conditional autonomy, rather than only firing fixed playbooks.

Runs traditional detection alongside behavioral analytics: intrusion-detection signatures (Suricata or Zeek rule sets and vendor IPS signatures), rule-based heuristics, and threshold alerts, with support for importing community rules and authoring custom rules, so known exploits and indicators are caught deterministically and analysts can codify their own detections.

Learns from analyst dispositions and confirmed benign patterns to suppress recurring false positives and adjust detection thresholds automatically after the initial learning period, keeping the alert stream trustworthy enough to drive automated response.

Assigns a risk score to each detection and affected entity from threat severity, detection certainty, and asset or account importance, with adjustable scoring, so response effort goes to the highest-risk hosts and accounts first rather than to the newest alert.

Attributes network activity and detections to users and accounts by ingesting identity provider, directory, and SSE or SASE telemetry, correlating network anomalies with user behavior and distinguishing on-premises users from remote workers, so lateral movement and insider activity are traced to an identity rather than only to an IP address.

Discovers every device communicating on the network and assembles a continuously updated inventory with device type, role, protocols in use, and communication paths, grouping and tracking entities across address changes (for example through a knowledge graph) and tagging criticality and exposure, so risk scoring and investigations start from an accurate map of what is on the network.

Executes containment automatically on confirmed detections: isolating infected hosts, blocking malicious traffic, or disabling compromised accounts, either natively (for example through the vendor's own switches, firewalls, or inline sensors) or through integrations with firewalls, NAC, EDR, SASE or SSE, and SOAR platforms. Whether enforcement is native or integration-dependent is the primary buying distinction.

Uses an AI assistant to qualify and triage network detections inside the NDR console, explaining each anomaly in plain language, assembling related detections into an incident narrative, and recommending the next investigation or response step, so analysts spend less time on first-pass triage of network alerts.

Provides a natural-language search assistant over network metadata, detections, and entities, so analysts can ask hunting questions in plain language, receive generated queries and summarized results, and pivot across hosts, accounts, and sessions without writing query syntax. Distinct from AI-assisted triage, which qualifies detections rather than answering analyst queries.

Aggregates related network alerts into structured incidents that link the hosts, accounts, and detections of one attack, reducing alert volume and giving analysts one case to investigate and respond to instead of disconnected events.

Renders the network events, entities, and detections of an incident on an interactive timeline or attack graph, so analysts can reconstruct the sequence of an intrusion across hosts and time and see the path an attacker took through the environment.

Detects threats inside TLS-encrypted sessions either without decryption, through JA3, JA4, and certificate fingerprinting plus behavioral analysis of encrypted flows, or through on-appliance decryption where keys are available for full payload inspection. Fingerprint-only analysis is now standard across NDR; on-appliance decryption, JA4 support, and detection quality on encrypted command-and-control are the differentiators.

Shows analysts the reasoning behind each machine-learning or behavioral detection, such as the baseline deviated from, the contributing signals, and the model's confidence, so alerts can be validated and tuned rather than trusted as opaque outputs.

Connects to SaaS platforms through their APIs to pull events and user activity, such as logins, sharing, and administrative changes, and analyzes them alongside network detections, extending detection coverage to activity that never crosses a monitored network sensor.

Learns per-entity baselines of normal network behavior for devices, users, and applications, typically with unsupervised or self-learning models that need little manual tuning, and detects deviations that reveal insider threats, external attacks, and advanced persistent threats, including novel command-and-control, data staging, and lateral movement. Detection quality separates products: self-learning models with minimal tuning versus rule-primary engines with limited machine learning.

Extends network detection to cloud VPC traffic using VPC flow log analysis, cloud-native sensors, or mirroring, covering east-west traffic between cloud workloads.