Welcome to Vectra Fusion
Logging in to Fusion
If you are setting up Fusion for the first time, or using it without centralized SSO, you will receive an email with your account information and a link to log in to your Fusion instance when your account is created. If you use an existing Fusion instance that is already deployed and connected to your corporate SSO, contact your Fusion admin for the correct login link.
Deploying Fusion
Deploy Fusion in two stages:
Ingest network traffic logs and context.
For cloud onboarding, see Fusion Onboarding for Cloud Engineers.
For on-premises networks, see Ingest NetFlow & sFlow.
For context enrichment integrations (native cloud context is covered in cloud onboarding), see Context Integrations.
Add supporting configuration.
Using the Fusion Portal
Use the Fusion Portal for two primary tasks beyond configuration:
Viewing Events, which are triggered by Detection Models.
Observing traffic for use cases such as network investigations, operational security, compliance and governance, and network management. This is done through System Dashboards and Custom Dashboards, tailored to your environment and use cases.
Fusion's Network Query Language (NQL) is used to filter traffic in the Portal, tailor dashboards, and create detection models. To learn how to use it, see NQL Overview and Syntax.
Fusion Admin: Initial Home
If you are setting up Fusion for the first time, the Fusion Portal will show a limited setup view directing you to configure a traffic source. The full Fusion Portal appears automatically once the first traffic log is successfully ingested.
The Home screen is a dashboard and can be changed
You can set a new dashboard to be Your Homepage (only for you) or Your Company Homepage (for all users by default) by clicking the ⋯ next to the dashboard name and selecting Set as Your Homepage or, if you are an administrator, Set as Company Homepage.
Select a New Dashboard
Display a system or custom dashboard by selecting it from the Select dashboard dropdown in the top-right corner of the Home screen. Once you select a dashboard, Fusion opens it directly. This is often faster than navigating back to the full dashboards list.
For more details, see About Dashboards.
Using Fusion with AI
The Vectra Fusion MCP Server is an open-source, local Model Context Protocol (MCP) server that enables direct, natural language interaction with Vectra Fusion through AI workflows. With the Vectra MCP Server, users can conduct network forensics, investigate suspicious activity, and analyze security events by chatting with their AI in plain English.
Get started in the neto-mcp GitHub repository.
Using Fusion with API
The Fusion Portal is an API-driven interface, so everything you can see in the Portal is also available via the API. For the full API, see: Fusion API Reference.
✋ Need Help?
About Fusion
Vectra Fusion is a SaaS network observability and threat detection platform.
It ingests network traffic logs, including cloud VPC flow logs, DNS logs, and on-premises NetFlow, then enriches them with context. It provides security detections and analytics based on the enriched network metadata it collects.
You can use the Fusion Portal to create and view dashboards and conduct incident investigations. You can use the Fusion API to interact with the system programmatically, the Fusion MCP to integrate with AI workflows, and Response Policies to deliver events from Fusion to systems such as SIEM, SOAR, and other third-party products.
Vectra Fusion supports the following flow log types:
AWS VPC flow logs, AWS Transit Gateway flow logs
Microsoft Azure VNet flow logs, Microsoft Azure NSG flow logs
Google Cloud Platform (GCP) VPC flow logs
Oracle Cloud (OCI) VCN flow logs
IBM Cloud VPC flow logs
NetFlow v5, NetFlow v9, NetFlow v10 (IPFIX), sFlow
Vectra Fusion supports the following DNS resolver log types:
AWS Route 53, GCP Cloud DNS
Vectra Fusion supports the following context enrichment sources:
Cloud Providers (AWS, Azure, GCP, IBM, Oracle)
Asset Management (Axonius, Device42, RunZero, Tanium)
Endpoint Protection (CrowdStrike, Microsoft Defender, SentinelOne)
Cloud Security (Wiz), Vulnerability Management (Tenable), OT Security (Claroty)
Generic Sources (S3, CSV, local files, REST API, custom modules)
Netography Fusion is the previous name for Vectra Fusion
You may still see references to Netography or Netography Fusion in parts of the documentation or product. Vectra acquired Netography in October 2025 and rebranded Netography Fusion to Vectra Fusion. See the acquisition announcement.
Last updated