> For the complete documentation index, see [llms.txt](https://help.radiantsecurity.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.radiantsecurity.ai/radiant-connectors/network-security/vectra/vectra-ndr.md).

# Vectra NDR

Vectra NDR (Network Detection and Response) is a network detection and response platform that analyzes network metadata with behavioral AI to surface threats such as command-and-control, lateral movement, credential abuse, and data exfiltration. Connecting Vectra NDR forwards network alerts to Radiant Security over syslog. Radiant uses these alerts as triage inputs and pairs them with Vectra Stream network metadata to determine whether the activity reflects a real compromise or benign network behavior.

{% hint style="warning" %}
Vectra NDR forwards network alerts only, not the underlying network events. If you have Vectra Stream, connect it as well so Radiant can correlate the network events that support Vectra NDR alert triage. See [Vectra Stream](/radiant-connectors/network-security/vectra/vectra-stream.md).
{% endhint %}

Vectra NDR can forward syslog to Radiant Security in two ways:

* **Through the Radiant Agent (recommended).** Forward to a Radiant Agent deployed in your environment.
* **Direct to Radiant Security.** Forward to a Radiant-managed collector. Use only when a Radiant Agent is not available.

### Prerequisites

* [ ] Admin access to Vectra NDR
* [ ] For the Radiant Agent path: a deployed [Radiant Agent](https://help.radiantsecurity.ai/radiant-connectors/data-connectors/install-the-radiant-security-agent) reachable from Vectra NDR
* [ ] For the direct path: network egress from Vectra NDR to the Radiant collector IP and port provided in the data connector setup

### Add the data connector in Radiant Security

{% tabs %}
{% tab title="Radiant Agent (recommended)" %}

1. Log in to [Radiant Security](https://app.radiantsecurity.ai/).
2. From the navigation menu, click **Settings** > **Data Connectors**, then click **+ Add Connector**.
3. Search for and select **Radiant Agent**, then click **Data Feeds**.
4. Under **Select your data feeds**, select **Vectra NDR**, then click **Credentials**.
5. Under **Credential Name**, enter an identifiable name for the Radiant Agent integration (e.g., `Radiant Agent integration`). To reuse an existing Radiant Agent credential, select it from the drop-down menu.
6. Click **Add Connector**.
   {% endtab %}

{% tab title="Direct syslog" %}

1. Log in to [Radiant Security](https://app.radiantsecurity.ai/).
2. From the navigation menu, click **Settings** > **Data Connectors**, then click **+ Add Connector**.
3. Search for and select **Vectra NDR (syslog)**, then click **Data Feeds**.
4. Under **Select your data feeds**, select **Vectra NDR (syslog)**, then click **Credentials**.
5. Under **Credential Name**, enter an identifiable name (e.g., `Vectra NDR Credentials`). To reuse an existing credential, select it from the drop-down menu.
6. In the **Connector tag** field, enter a random value. This value acts as the salt to randomize the **Token** you download in the next step.
7. Click **Add Connector**.
   {% endtab %}
   {% endtabs %}

### Configure Vectra NDR to forward syslog through the Radiant Agent

Before starting, confirm the IP address of the Radiant Agent and the port configured to receive Vectra NDR data. If you do not know the port, contact your Customer Success representative.

1. Log in to the Vectra (Brain) UI with an admin user.
2. Navigate to **Settings** > **Notification**, then scroll to the **Syslog** section.
3. Click **Edit** to add a new syslog destination, then enter the following:

   <div align="left"><figure><img src="/files/TtMaPL7muFL6chKurssQ" alt=""><figcaption></figcaption></figure></div>

   * **Destination**: IP address of the Radiant Agent
   * **Port**: port configured on the Radiant Agent to receive Vectra NDR data
   * **Protocol**: `TCP`
   * **Format**: `JSON`
   * **Log Types**: select all
   * Enable **Include enhanced detail**
   * Enable **Include detections in info category**
   * Disable **Include filtered Detections**
   * Disable **Include host/account score decreases**
4. Click **Save**.

<figure><img src="/files/Chtb1l7pV16YZPrfAjOD" alt=""><figcaption></figcaption></figure>

5. Click **Test** to verify the syslog configuration.

### Configure Vectra NDR to forward syslog directly to Radiant Security

Use this path only when a Radiant Agent is not available. Use the collector IP and port provided in the Radiant data connector setup.

1. Log in to the Vectra (Brain) UI with an admin user.
2. Navigate to **Settings** > **Notification**, then scroll to the **Syslog** section.
3. Click **Edit** to add a new syslog destination, then enter the following:
   * **Destination**: Radiant collector IP
   * **Port**: Radiant collector port
   * **Protocol**: `TCP`
   * **Format**: `JSON`
   * **Log Types**: select all
   * Enable **Include enhanced detail**
   * Enable **Include detections in info category**
   * Disable **Include filtered Detections**
   * Disable **Include host/account score decreases**
4. Click **Save**.
5. Click **Test** to verify the syslog configuration.

### Verify ingestion

After Vectra NDR begins forwarding, confirm alerts are reaching Radiant.

1. In Radiant, navigate to [Log Management](https://app.radiantsecurity.ai/logs).
2. Filter by `rs_connectorType:"vectra_ndr"`.
3. Confirm recent alerts appear.

{% hint style="info" %}
Allow several minutes for alerts to be parsed, indexed, and available for search.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://help.radiantsecurity.ai/radiant-connectors/network-security/vectra/vectra-ndr.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.