> For the complete documentation index, see [llms.txt](https://docs.fusion.vectra.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.fusion.vectra.ai/readme.md).

# Welcome to Vectra Fusion

## Logging in to Fusion <a href="#logging-in-to-fusion" id="logging-in-to-fusion"></a>

If you are setting up Fusion for the first time, or using it without centralized SSO, you will receive an email with your account information and a link to log in to your Fusion instance when your account is created. If you use an existing Fusion instance that is already deployed and connected to your corporate SSO, contact your Fusion admin for the correct login link.

## Deploying Fusion <a href="#deploying-fusion" id="deploying-fusion"></a>

Deploy Fusion in two stages:

1. Ingest network traffic logs and context.
   * For cloud onboarding, see [Fusion Onboarding for Cloud Engineers](/cloud-onboarding/fusion-onboarding-for-cloud-engineers.md).
   * For on-premises networks, see [Ingest NetFlow & sFlow](/ingest-network-traffic-logs/netflow-sflow.md).
   * For context enrichment integrations *(native cloud context is covered in cloud onboarding)*, see [Context Integrations](/settings/data-management/context-integrations.md).
2. Add supporting configuration.
   * [Traffic Classification](/settings/data-management/traffic-classifications.md)
   * [SSO](/settings/user-management/index-2.md)
   * [Automating Response in Fusion](/automate-responses/response.md)
   * [Add a Dashboard](/dashboards/manage/add-dashboard.md)
   * [Adding a Detection Model](/detection-models/add-detection-models.md)

## Using the Fusion Portal <a href="#using-the-fusion-portal" id="using-the-fusion-portal"></a>

Use the Fusion Portal for two primary tasks beyond configuration:

1. Viewing [Events](/events/viewing.md), which are triggered by [Detection Models](/detection-models/overview.md).
2. Observing traffic for use cases such as network investigations, operational security, compliance and governance, and network management. This is done through [System Dashboards](/dashboards/system.md) and [Custom Dashboards](/dashboards/manage/your-dashboards.md), tailored to your environment and use cases.

Fusion's Network Query Language (NQL) is used to filter traffic in the Portal, tailor dashboards, and create detection models. To learn how to use it, see [NQL Overview and Syntax](/network-query-language/nql-overview-and-basics.md).

{% hint style="info" icon="diagram-sankey" %}
**Fusion Admin: Initial Home**

If you are setting up Fusion for the first time, the Fusion Portal will show a limited setup view directing you to configure a traffic source. The full Fusion Portal appears automatically once the first traffic log is successfully ingested.
{% endhint %}

{% hint style="info" icon="house-chimney-window" %}
**The Home screen is a dashboard and can be changed**

You can set a new dashboard to be **Your Homepage** *(only for you)* or **Your Company Homepage** *(for all users by default)* by clicking the **⋯** next to the dashboard name and selecting **Set as Your Homepage** or, if you are an administrator, **Set as Company Homepage**.
{% endhint %}

#### Select a New Dashboard <a href="#select-a-new-dashboard" id="select-a-new-dashboard"></a>

Display a system or custom dashboard by selecting it from the **Select dashboard** dropdown in the top-right corner of the Home screen. Once you select a dashboard, Fusion opens it directly. This is often faster than navigating back to the full dashboards list.

For more details, see [About Dashboards](/dashboards/about.md).

## Using Fusion with AI <a href="#new--mcp-server---ai-powered-insights-into-your-network-activity" id="new--mcp-server---ai-powered-insights-into-your-network-activity"></a>

The Vectra Fusion MCP Server is an open-source, local Model Context Protocol (MCP) server that enables direct, natural language interaction with Vectra Fusion through AI workflows. With the Vectra MCP Server, users can conduct network forensics, investigate suspicious activity, and analyze security events by chatting with their AI in plain English.

Get started in the [neto-mcp GitHub repository](https://github.com/netography/neto-mcp).

## Using Fusion with API <a href="#new--mcp-server---ai-powered-insights-into-your-network-activity" id="new--mcp-server---ai-powered-insights-into-your-network-activity"></a>

The Fusion Portal is an API-driven interface, so everything you can see in the Portal is also available via the API.  For the full API, see: [Fusion API Reference](https://docs.fusion.vectra.ai/api-reference).

## ✋ Need Help? <a href="#need-more-support" id="need-more-support"></a>

{% embed url="<https://www.vectra.ai/success-center>" %}

## About Fusion <a href="#the-basics" id="the-basics"></a>

Vectra Fusion is a SaaS network observability and threat detection platform.

It ingests network traffic logs, including cloud VPC flow logs, DNS logs, and on-premises NetFlow, then enriches them with context. It provides security detections and analytics based on the enriched network metadata it collects.

You can use the Fusion Portal to create and view dashboards and conduct incident investigations. You can use the Fusion API to interact with the system programmatically, the Fusion MCP to integrate with AI workflows, and Response Policies to deliver events from Fusion to systems such as SIEM, SOAR, and other third-party products.

Vectra Fusion supports the following flow log types:

* AWS VPC flow logs, AWS Transit Gateway flow logs
* Microsoft Azure VNet flow logs, Microsoft Azure NSG flow logs
* Google Cloud Platform (GCP) VPC flow logs
* Oracle Cloud (OCI) VCN flow logs
* IBM Cloud VPC flow logs
* NetFlow v5, NetFlow v9, NetFlow v10 (IPFIX), sFlow

Vectra Fusion supports the following DNS resolver log types:

* AWS Route 53, GCP Cloud DNS

Vectra Fusion supports the following context enrichment sources:

* Cloud Providers (AWS, Azure, GCP, IBM, Oracle)
* Asset Management (Axonius, Device42, RunZero, Tanium)
* Endpoint Protection (CrowdStrike, Microsoft Defender, SentinelOne)
* Cloud Security (Wiz), Vulnerability Management (Tenable), OT Security (Claroty)
* Generic Sources (S3, CSV, local files, REST API, custom modules)

{% hint style="info" icon="bullhorn" %}
Netography Fusion is the previous name for Vectra Fusion

You may still see references to **Netography** or **Netography Fusion** in parts of the documentation or product. Vectra acquired Netography in October 2025 and rebranded Netography Fusion to Vectra Fusion. See the [acquisition announcement](https://www.vectra.ai/about/news/vectra-ai-acquires-netography-to-expand-its-ai-driven-cybersecurity-platform-with-pioneering-cloud-native-network-observability).
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.fusion.vectra.ai/readme.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.