The Missing Data Layer Behind SIEM and SOAR by Dale O’Grady

This document describes Vectra AI's Investigate API, which exposes high-fidelity, behavior-driven telemetry (network, Entra ID, M365, AWS, Azure control plane) through a query interface so SOCs can pull correlated evidence directly into SIEMs, SOARs, or playbooks; it details available data tables and presents three investigation scenarios (validating detections with network sessions, hunting DNS-based exfiltration, and investigating compromised identities) to illustrate use cases.