Vectra RUX | Marketplace

Details
Content
Dependencies
Version History

Vectra RUX pack empowers the SOC to create incidents based on events detection using Vectra AI's Attack Signal Intelligence.

Vectra RUX pack allows the security operations center to create incidents based on Events Detections, powered by Vectra AI's Attack Signal Intelligence. This pack enables security teams to synchronize the Vectra RUX Detections with Cortex XSOAR incidents in real time, making it feasible to manage operations from a single place.

What does this pack do?

Fetch detections from Vectra RUX.
List and Describe Entities and Detections.
List, Create, Update, and Resolve Entity Assignments.
List, Create, Update, and Delete Entity notes.
List, Create, Update, and Delete Detection notes.
List, Update, and Remove Entity tags.
List, Update, and Remove Detection tags.
List, Assign, and Unassign members in Group.
Download PCAP of detection.
Update Investigation Status of the Detection.
Reset unresolved-priority of an Entity.
Update the External Reference ID of an Entity and Detection.
Send Investigation Query and Get Results for an Investigation Query.

Support

If you have questions or concerns about the content you're receiving, please reach out for support at https://support.vectra.ai or support@vectra.ai.

For more information, visit our Cortex XSOAR Developer Docs

Vectra RUX pack allows the security operations center to create incidents based on Events Detections, powered by Vectra AI's Attack Signal Intelligence. This pack enables security teams to synchronize the Vectra RUX Detections with Cortex incidents in real time, making it feasible to manage operations from a single place.

What does this pack do?

Fetch detections from Vectra RUX.
List and Describe Entities and Detections.
List, Create, Update, and Resolve Entity Assignments.
List, Create, Update, and Delete Entity notes.
List, Create, Update, and Delete Detection notes.
List, Update, and Remove Entity tags.
List, Update, and Remove Detection tags.
List, Assign, and Unassign members in Group.
Download PCAP of detection.
Update Investigation Status of the Detection.
Reset unresolved-priority of an Entity.
Update the External Reference ID of an Entity and Detection.
Send Investigation Query and Get Results for an Investigation Query.

Support

If you have questions or concerns about the content you're receiving, please reach out for support at https://support.vectra.ai or support@vectra.ai.

For more information, visit our Cortex XSOAR Developer Docs

Automations

Name	Description
VectraRUXSyncDetectionNotes	Sync the Detection Notes from the Vectra platform.
VectraRUXLinkEntityDetections	Link the Detections which have the same entity ID.
VectraRUXSyncEntityAssignment	Sync Entity Assignment details from the Vectra platform.
VectraRUXLinkTicketDetections	Link the Detections which have the same External Reference ID.
VectraRUXGetIncidents	Get the incidents with the type Vectra RUX Events Detection.
VectraRUXSyncDetectionSummary	Sync the detection summary from the Vectra platform.

Classifiers

Name	Description
Vectra RUX - Incoming Mapper

Incident Fields

Name	Description
Vectra RUX Data Source Sensor Name
Vectra RUX Entity Assignment Details
Vectra RUX Source External Host Name
Vectra RUX Data Source Sensor ID
Vectra RUX Detection Reason
Vectra RUX Entity Assignment Resolved Date
Vectra RUX Entity Importance
Vectra RUX Event Accounts
Vectra RUX Entity UID
Vectra RUX External Reference ID
Vectra RUX AWS Region
Vectra RUX Entity ID
Vectra RUX Entity Priority Status
Vectra RUX Threat Score
Vectra RUX Entity Urgency Score
Vectra RUX Entity Unresolved Priority Status
Vectra RUX Assumed Role
Vectra RUX Event Protocols
Vectra RUX Detection Notes
Vectra RUX Event Name
Vectra RUX Entity Privilege Category
Vectra RUX Process Context Query Link
Vectra RUX Entity Assignment Assigned Date
Vectra RUX Event Change Type
Vectra RUX Event Timestamp
Vectra RUX Account ID
Vectra RUX Destination Domain Information
Vectra RUX Detection Category
Vectra RUX Last Timestamp
Vectra RUX Event External Targets
Vectra RUX Event Severity
Vectra RUX Destination Host Information
Vectra RUX User Agent
Vectra RUX Entity Assignment Resolved By
Vectra RUX Entity Assignment Assigned By
Vectra RUX Event Domains
Vectra RUX Event DNS
Vectra RUX Entity External Reference ID
Vectra RUX Certainty Score
Vectra RUX Entity Assignment Assigned to
Vectra RUX Event IPs
Vectra RUX Process Context Processes
Vectra RUX Investigation Status
Vectra RUX Entity Assignment ID
Vectra RUX Data Source Type
Vectra RUX Entity IP
Vectra RUX Detection Type
Vectra RUX Access Key ID
Vectra RUX Process Context Error Message
Vectra RUX Source External Host IP
Vectra RUX Role Sequence
Vectra RUX Identity Type
Vectra RUX Entity URL
Vectra RUX Entity Name
Vectra RUX Mitre IDs
Vectra RUX Event Ports
Vectra RUX Destination Account Information
Vectra RUX Process Context Date Created
Vectra RUX Event Hosts
Vectra RUX Process Context Investigate Entity Link
Vectra RUX Entity Type
Vectra RUX Detection ID
Vectra RUX Is Event Triaged
Vectra RUX Entity Assignment Outcome
Vectra RUX Process Context Query Status

Incident Types

Name	Description
Vectra RUX Events Detection

Integrations

Name	Description
Vectra RUX - Network Detection & Response (Partner Contribution)	This integration allows the security operations center to create and manage incidents based on Vectra Events Detections.

Layouts

Name	Description
Vectra RUX Events Detection	Show Details about Vectra Events Detections

Playbooks

Name	Description
Expire Inactive Detections - Vectra RUX	This playbook identifies incidents with inactive detections and updates their investigation status to "expired".
Find Detection State and Expire Inactive Detections - Vectra RUX	This playbook identifies the detection states of incidents and updates the investigation status of inactive detections to "expired".

Automations

Name	Description
VectraRUXGetIncidents	Get the incidents with the type Vectra RUX Events Detection.
VectraRUXGetAlerts	Get the alerts with the type Vectra RUX Events Detection.
VectraRUXLinkTicketDetections	Link the Detections which have the same External Reference ID.
VectraRUXLinkEntityDetections	Link the Detections which have the same entity ID.
VectraRUXSyncDetectionNotes	Sync the Detection Notes from the Vectra platform.
VectraRUXSyncEntityAssignment	Sync Entity Assignment details from the Vectra platform.
VectraRUXSyncDetectionSummary	Sync the detection summary from the Vectra platform.

Classifiers

Name	Description
Vectra RUX - Incoming Mapper

Incident Fields

Name	Description
Vectra RUX Entity Assignment Assigned By
Vectra RUX Destination Account Information
Vectra RUX Entity Name
Vectra RUX Detection Reason
Vectra RUX Is Event Triaged
Vectra RUX Event Name
Vectra RUX Mitre IDs
Vectra RUX Process Context Query Link
Vectra RUX Event Accounts
Vectra RUX Entity IP
Vectra RUX Entity Unresolved Priority Status
Vectra RUX Threat Score
Vectra RUX Event Change Type
Vectra RUX Certainty Score
Vectra RUX AWS Region
Vectra RUX Access Key ID
Vectra RUX Entity Assignment Resolved By
Vectra RUX Identity Type
Vectra RUX Event Domains
Vectra RUX Process Context Processes
Vectra RUX Investigation Status
Vectra RUX Detection Type
Vectra RUX Destination Domain Information
Vectra RUX Event Ports
Vectra RUX Event Hosts
Vectra RUX Entity Assignment ID
Vectra RUX Detection ID
Vectra RUX Entity Importance
Vectra RUX Role Sequence
Vectra RUX Process Context Investigate Entity Link
Vectra RUX Entity Privilege Category
Vectra RUX Entity Assignment Assigned Date
Vectra RUX Entity External Reference ID
Vectra RUX Event Timestamp
Vectra RUX User Agent
Vectra RUX Data Source Sensor ID
Vectra RUX Entity URL
Vectra RUX Process Context Query Status
Vectra RUX Entity Type
Vectra RUX Event DNS
Vectra RUX Entity Priority Status
Vectra RUX Entity Assignment Assigned to
Vectra RUX Detection Notes
Vectra RUX Process Context Date Created
Vectra RUX Account ID
Vectra RUX Detection Category
Vectra RUX Last Timestamp
Vectra RUX Entity Assignment Details
Vectra RUX Entity UID
Vectra RUX Event IPs
Vectra RUX Entity Assignment Outcome
Vectra RUX Source External Host Name
Vectra RUX Data Source Type
Vectra RUX Source External Host IP
Vectra RUX Assumed Role
Vectra RUX Entity Urgency Score
Vectra RUX Event Protocols
Vectra RUX Event External Targets
Vectra RUX Event Severity
Vectra RUX Data Source Sensor Name
Vectra RUX Destination Host Information
Vectra RUX Process Context Error Message
Vectra RUX Entity Assignment Resolved Date
Vectra RUX Entity ID
Vectra RUX External Reference ID

Incident Types

Name	Description
Vectra RUX Events Detection

Integrations

Name	Description
Vectra RUX - Network Detection & Response (Partner Contribution)	This integration allows the security operations center to create and manage incidents based on Vectra Events Detections.

Playbooks

Name	Description
Find Detection State and Expire Inactive Detections - Vectra RUX	This playbook identifies the detection states of alerts and updates the investigation status of inactive detections to "expired".
Expire Inactive Detections - Vectra RUX	This playbook identifies alerts with inactive detections and updates their investigation status to "expired".

Required Content Packs (5)

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Common Types	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
Phishing	By: Cortex XSOAR

Optional Content Packs (2)

Pack Name	Pack By
Vectra XDR	By: Vectra AI
Vectra AI	By: Vectra TME Integrations

All level dependencies (8)

Pack Name	Pack By
Cortex REST API	By: Cortex XSOAR
Base	By: Cortex XSOAR
Common Playbooks	By: Cortex XSOAR
Phishing	By: Cortex XSOAR
Common Types	By: Cortex XSOAR
Rasterize	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR

1.0.1 - 10442616 (June 24, 2026)

Incident Fields

Vectra RUX AWS Region
Documentation and metadata improvements.
Vectra RUX Access Key ID
Documentation and metadata improvements.
Vectra RUX Account ID
Documentation and metadata improvements.
Vectra RUX Assumed Role
Documentation and metadata improvements.
Vectra RUX Certainty Score
Documentation and metadata improvements.
Vectra RUX Data Source Sensor ID
Documentation and metadata improvements.
Vectra RUX Data Source Sensor Name
Documentation and metadata improvements.
Vectra RUX Data Source Type
Documentation and metadata improvements.
Vectra RUX Destination Account Information
Documentation and metadata improvements.
Vectra RUX Destination Domain Information
Documentation and metadata improvements.
Vectra RUX Destination Host Information
Documentation and metadata improvements.
Vectra RUX Detection Category
Documentation and metadata improvements.
Vectra RUX Detection ID
Documentation and metadata improvements.
Vectra RUX Detection Notes
Documentation and metadata improvements.
Vectra RUX Detection Reason
Documentation and metadata improvements.
Vectra RUX Detection Type
Documentation and metadata improvements.
Vectra RUX Entity Assignment Assigned By
Documentation and metadata improvements.
Vectra RUX Entity Assignment Assigned Date
Documentation and metadata improvements.
Vectra RUX Entity Assignment Assigned to
Documentation and metadata improvements.
Vectra RUX Entity Assignment Details
Documentation and metadata improvements.
Vectra RUX Entity Assignment ID
Documentation and metadata improvements.
Vectra RUX Entity Assignment Outcome
Documentation and metadata improvements.
Vectra RUX Entity Assignment Resolved By
Documentation and metadata improvements.
Vectra RUX Entity Assignment Resolved Date
Documentation and metadata improvements.
Vectra RUX Entity External Reference ID
Documentation and metadata improvements.
Vectra RUX Entity ID
Documentation and metadata improvements.
Vectra RUX Entity IP
Documentation and metadata improvements.
Vectra RUX Entity Importance
Documentation and metadata improvements.
Vectra RUX Entity Name
Documentation and metadata improvements.
Vectra RUX Entity Priority Status
Documentation and metadata improvements.
Vectra RUX Entity Privilege Category
Documentation and metadata improvements.
Vectra RUX Entity Type
Documentation and metadata improvements.
Vectra RUX Entity UID
Documentation and metadata improvements.
Vectra RUX Entity URL
Documentation and metadata improvements.
Vectra RUX Entity Unresolved Priority Status
Documentation and metadata improvements.
Vectra RUX Entity Urgency Score
Documentation and metadata improvements.
Vectra RUX Event Accounts
Documentation and metadata improvements.
Vectra RUX Event Change Type
Documentation and metadata improvements.
Vectra RUX Event DNS
Documentation and metadata improvements.
Vectra RUX Event Domains
Documentation and metadata improvements.
Vectra RUX Event External Targets
Documentation and metadata improvements.
Vectra RUX Event Hosts
Documentation and metadata improvements.
Vectra RUX Event IPs
Documentation and metadata improvements.
Vectra RUX Event Name
Documentation and metadata improvements.
Vectra RUX Event Ports
Documentation and metadata improvements.
Vectra RUX Event Protocols
Documentation and metadata improvements.
Vectra RUX Event Severity
Documentation and metadata improvements.
Vectra RUX Event Timestamp
Documentation and metadata improvements.
Vectra RUX External Reference ID
Documentation and metadata improvements.
Vectra RUX Identity Type
Documentation and metadata improvements.
Vectra RUX Investigation Status
Documentation and metadata improvements.
Vectra RUX Is Event Triaged
Documentation and metadata improvements.
Vectra RUX Last Timestamp
Documentation and metadata improvements.
Vectra RUX Mitre IDs
Documentation and metadata improvements.
Vectra RUX Process Context Date Created
Documentation and metadata improvements.
Vectra RUX Process Context Error Message
Documentation and metadata improvements.
Vectra RUX Process Context Investigate Entity Link
Documentation and metadata improvements.
Vectra RUX Process Context Processes
Documentation and metadata improvements.
Vectra RUX Process Context Query Link
Documentation and metadata improvements.
Vectra RUX Process Context Query Status
Documentation and metadata improvements.
Vectra RUX Role Sequence
Documentation and metadata improvements.
Vectra RUX Source External Host IP
Documentation and metadata improvements.
Vectra RUX Source External Host Name
Documentation and metadata improvements.
Vectra RUX Threat Score
Documentation and metadata improvements.
Vectra RUX User Agent
Documentation and metadata improvements.

Incident Types

Vectra RUX Events Detection
Documentation and metadata improvements.

Mappers

Vectra RUX - Incoming Mapper

Documentation and metadata improvements.

Related pull requests:
- 44779

Download

1.0.0 - 9264184 (May 25, 2026)

Vectra RUX pack empowers the SOC to create incidents based on events detection using Vectra AI's Attack Signal Intelligence.

Download

1.0.1 - 10442616 (June 24, 2026)

Incident Fields

Vectra RUX AWS Region
Documentation and metadata improvements.
Vectra RUX Access Key ID
Documentation and metadata improvements.
Vectra RUX Account ID
Documentation and metadata improvements.
Vectra RUX Assumed Role
Documentation and metadata improvements.
Vectra RUX Certainty Score
Documentation and metadata improvements.
Vectra RUX Data Source Sensor ID
Documentation and metadata improvements.
Vectra RUX Data Source Sensor Name
Documentation and metadata improvements.
Vectra RUX Data Source Type
Documentation and metadata improvements.
Vectra RUX Destination Account Information
Documentation and metadata improvements.
Vectra RUX Destination Domain Information
Documentation and metadata improvements.
Vectra RUX Destination Host Information
Documentation and metadata improvements.
Vectra RUX Detection Category
Documentation and metadata improvements.
Vectra RUX Detection ID
Documentation and metadata improvements.
Vectra RUX Detection Notes
Documentation and metadata improvements.
Vectra RUX Detection Reason
Documentation and metadata improvements.
Vectra RUX Detection Type
Documentation and metadata improvements.
Vectra RUX Entity Assignment Assigned By
Documentation and metadata improvements.
Vectra RUX Entity Assignment Assigned Date
Documentation and metadata improvements.
Vectra RUX Entity Assignment Assigned to
Documentation and metadata improvements.
Vectra RUX Entity Assignment Details
Documentation and metadata improvements.
Vectra RUX Entity Assignment ID
Documentation and metadata improvements.
Vectra RUX Entity Assignment Outcome
Documentation and metadata improvements.
Vectra RUX Entity Assignment Resolved By
Documentation and metadata improvements.
Vectra RUX Entity Assignment Resolved Date
Documentation and metadata improvements.
Vectra RUX Entity External Reference ID
Documentation and metadata improvements.
Vectra RUX Entity ID
Documentation and metadata improvements.
Vectra RUX Entity IP
Documentation and metadata improvements.
Vectra RUX Entity Importance
Documentation and metadata improvements.
Vectra RUX Entity Name
Documentation and metadata improvements.
Vectra RUX Entity Priority Status
Documentation and metadata improvements.
Vectra RUX Entity Privilege Category
Documentation and metadata improvements.
Vectra RUX Entity Type
Documentation and metadata improvements.
Vectra RUX Entity UID
Documentation and metadata improvements.
Vectra RUX Entity URL
Documentation and metadata improvements.
Vectra RUX Entity Unresolved Priority Status
Documentation and metadata improvements.
Vectra RUX Entity Urgency Score
Documentation and metadata improvements.
Vectra RUX Event Accounts
Documentation and metadata improvements.
Vectra RUX Event Change Type
Documentation and metadata improvements.
Vectra RUX Event DNS
Documentation and metadata improvements.
Vectra RUX Event Domains
Documentation and metadata improvements.
Vectra RUX Event External Targets
Documentation and metadata improvements.
Vectra RUX Event Hosts
Documentation and metadata improvements.
Vectra RUX Event IPs
Documentation and metadata improvements.
Vectra RUX Event Name
Documentation and metadata improvements.
Vectra RUX Event Ports
Documentation and metadata improvements.
Vectra RUX Event Protocols
Documentation and metadata improvements.
Vectra RUX Event Severity
Documentation and metadata improvements.
Vectra RUX Event Timestamp
Documentation and metadata improvements.
Vectra RUX External Reference ID
Documentation and metadata improvements.
Vectra RUX Identity Type
Documentation and metadata improvements.
Vectra RUX Investigation Status
Documentation and metadata improvements.
Vectra RUX Is Event Triaged
Documentation and metadata improvements.
Vectra RUX Last Timestamp
Documentation and metadata improvements.
Vectra RUX Mitre IDs
Documentation and metadata improvements.
Vectra RUX Process Context Date Created
Documentation and metadata improvements.
Vectra RUX Process Context Error Message
Documentation and metadata improvements.
Vectra RUX Process Context Investigate Entity Link
Documentation and metadata improvements.
Vectra RUX Process Context Processes
Documentation and metadata improvements.
Vectra RUX Process Context Query Link
Documentation and metadata improvements.
Vectra RUX Process Context Query Status
Documentation and metadata improvements.
Vectra RUX Role Sequence
Documentation and metadata improvements.
Vectra RUX Source External Host IP
Documentation and metadata improvements.
Vectra RUX Source External Host Name
Documentation and metadata improvements.
Vectra RUX Threat Score
Documentation and metadata improvements.
Vectra RUX User Agent
Documentation and metadata improvements.

Incident Types

Vectra RUX Events Detection
Documentation and metadata improvements.

Mappers

Vectra RUX - Incoming Mapper

Documentation and metadata improvements.

Related pull requests:
- 44779

Download

1.0.0 - 9264184 (May 25, 2026)

Vectra RUX pack empowers the SOC to create incidents based on events detection using Vectra AI's Attack Signal Intelligence.

Download

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Partner
Created	May 25, 2026
Last Release	June 24, 2026

Network Security

Asset Management

Vulnerability Management

Breach Notification

Incident Response

WORKS WITH THE FOLLOWING INTEGRATIONS:

Vectra RUX - Network Detection & Response

DISCLAIMER

By downloading or using Marketplace content, you agree to the applicable Terms of Use and End User License Agreement. Third-party content is provided by its publisher, and Palo Alto Networks does not warrant, endorse, support, or assume responsibility for content not expressly identified as owned by Palo Alto Networks.