Vectra X Series (CEF)

Vectra network detection and response detections and host scoring

High-value events that need near-real-time detection, low-volume join targets, or high-value tables the lake cannot hold.

Retention is set per table, so the retention for this source is advisory.

C1 Detections and findings

Detections, alerts, incidents, security findings (vulnerability and posture findings), and detection pipeline health

Generic detections need near-real-time matching on single events.

DeviceVendor =~ "Vectra Networks" and DeviceProduct =~ "X Series"

Azure-Sentinel public content corpus Table identity and usage evidence from public analytics rules, hunting queries, parsers, and solution content. Classification, tier, retention, and billing recommendations require human review.
Log Baseline classification rules Value rules C1-C9 mapped to ASD and CISA guidance, and tier rules T1-T5 including plan support. Stored per table as valueRule and tierRule.
Log Baseline volume model Judgment-based volume driver and relative volume class per table. Not measured tenant volume.
ASD ACSC Priority logs for SIEM ingestion: Practitioner guidance Loosely prioritized log categories (EDR, network devices, domain controllers, Windows, virtualisation, cloud, containers, databases, MDM, DNS, Linux, macOS) used by the classification rules. Collection priority, not storage tier.
CISA Guidance for Implementing M-21-31 Prioritized event types for collection and storage (ICAM, operating systems, network infrastructure, cloud, AWS, Azure, Microsoft 365, GCP) used by the classification rules. Collection priority, not storage tier.