Appliance and Sensor Specifications

Vectra AI can be deployed in Cloud, On-Prem, and Virtual environments to satisfy customer security requirements. For the Cloud, we support vSensors in AWS, Azure, and GCP. For On-Prem, we have both hardware sensors (S-Series, X-Series), and virtual sensors (VMware ESXi, Hyper-V, and KVM) to provide flexible deployment and coverage.

Included in your Vectra AI subscription, software updates with new threat detection algorithms are delivered to your system on a regular basis to ensure continuous protection from the latest advanced threats.

To extend the reach of Vectra AI, X-Series and S-series Sensors are easily deployed at remote sites or with access switches on internal network segments. They passively monitor network traffic, extract critical metadata and forward it to Vectra for analysis and threat detection. Sensors can be deployed out-of-band on a SPAN port, network TAP, or packet broker.

Virtual Sensors

Virtual Sensors, known as vSensors, run in VMware ESXi, Microsoft Hyper-V, and KVM, making it easy to extend Vectra threat detection coverage across the physical network and into virtualized data centers. VMware vSensors support both VSS and VDS VMware switch types to provide visibility into all traffic and detect threats that pass between workloads in the virtual environment. Vectra AI also integrates with VMware vCenter so it has authoritative, always up-to-date views of the virtual environment.

Physical Appliance Performance

‍

Notes regarding performance chart above:

• Paired Sensors – Refers to how many Sensors (physical, virtual, or cloud) an appliance can pair with.
• N/A – Refers to unsupported modes. For example, an S11 cannot be used as a Brain, therefore the only relevant metric for an S11 is the performance in Sensor mode.
• Performance – Refers to the amount of network traffic observed by Sensors that a Sensor can produce metadata for, or the amount of traffic observed by Sensors that a Brain can process metadata for. The performance numbers are based upon average throughput a given Sensor/Brain can process. Actual performance may vary depending on traffic composition. Please contact Vectra AI to discuss further.
• 10Gbps management Interface supported in 6.19 or later. Consumes one of the 10Gbps traffic interfaces to operate as a management interface.
• Console access to Vectra appliances detailed in: Support

‍

Vectra Match Performance

‍

Physical Appliance Specifications

‍

Virtual Brains – Customer Premise Hypervisor Deployment

‍

Virtual Sensors - Customer Premise Hypervisor Deployment

‍

Cloud - IaaS Deployment

Brain Deployment

‍

vSensor Deployment

‍

• AWS vSensor configurations include both “n” and non “n” r5 instance types.
  - Networking performance is quoted as “up to 10Gbps” on the r5 instances by AWS and can be influenced by neighboring instances allocated to the same physical hardware in AWS.
  - Networking performance is quoted as “up to 25Gbps” on the r5n instances by AWS. These instances are still shared with neighbors but are optimized by AWS to have higher overall network throughput.
  - Customers can work with AWS to utilize dedicated instances and distribute instances to provide the required networking throughput to their vSensor instances on that dedicated hardware.

• The c5n.18x large vSensor instance type does not have a rolling capture buffer and can therefore not support PCAP generation for Detections that originate from traffic that is processed by those instances.

• Due to variability in customer cloud network configurations and how mirroring may configured, it is not possible to guarantee performance on any instance with more than 2 cores (numbers are approximate and based on even distribution of packets across threads). Please contact Vectra to discuss further.

• If using port mirroring via VXLAN, please contact Vectra AI to discuss performance.