Versa Analytics is the analytics platform of the Versa headend: it collects status, telemetry, and log data from every VOS device, then correlates, searches, and visualizes it as dashboards and reports covering devices, networks, security, and application performance – and streams the same logs to third-party SIEM platforms.
Key takeaways
- Versa Analytics collects logs and telemetry from every VOS device.
- Each node holds a log collector, a database engine, and a REST API.
- Production clusters run four nodes for high availability by default.
- It generates device, network, security, and SD-WAN performance reports.
- It streams logs natively to third-party SIEM and reporting platforms.
On this page: Why it mattersHow it worksVersa Analytics deployment modelsVersa Analytics & the VersaONE platformFAQ
Why is Versa Analytics important?
An SD-WAN and security fabric generates an overwhelming volume of telemetry – link status, session logs, firewall decisions, threat events – and none of it is useful sitting on the device that produced it. Versa Analytics is what turns that raw stream into operational intelligence: capacity planning, security forensics, SLA verification, and the trending data that lets a NOC catch degradation before users notice it.
It is also the reporting layer administrators and business stakeholders actually consume. Versa Director configures the network; Versa Analytics reports how it is performing and who is using it, with per-tenant and per-appliance breakdowns from a single branch to a global estate. For teams standardized on a SIEM, Analytics does not silo that data: it streams the same logs onward, so the SD-WAN and security fabric strengthens an existing security operations workflow instead of competing with it.
What is Versa Analytics?
Versa Analytics is the telemetry and reporting member of the Versa headend, alongside Director (management) and the Controller (SD-WAN control plane); the Versa Networks solution components overview tours all three. Every VOS device continuously reports link, path, and service status to Analytics, and every running service – NGFW, URL filtering, DLP, and the rest – exports flow-level and aggregate logs to it over log export functionality (LEF).
Each Analytics node combines three components: a log collector and exporter that receives logs over TCP, UDP, or SSL in IPFIX or syslog format and can forward them onward; a database, search, and analytics engine built on Cassandra with Shark and Spark for high-speed in-memory analysis; and the Analytics application itself, exposing RESTful APIs and, with Director, handling authentication for the UI. Analytics performs networkwide analysis, trending, and security forensics, then passes results back to Director, where role-based access controls who can see them.
Versa Analytics deployment models
Because search and analysis are resource-intensive, Analytics scales through clustering rather than a single box. A minimal cluster pairs one search node with one analysis node; the production HA standard is four nodes – two for analytics data, two for search data, each pair active-active with replicated data – deployable on bare metal, Versa-certified white-box hardware, or as VMs. Each cluster forms an instance, and an instance can span one or more data centers or regions.
For redundancy beyond a single cluster, a secondary Analytics (or third-party) cluster can pair with a primary in active-backup or active-active mode, with an ADC load-balancing connections and handling failover. For organizations that would rather not operate on-premises clusters, the Advanced Logging Service (ALS) is a cloud-hosted, Versa-managed alternative: VOS devices route logs to ALS instead of, or alongside, a local cluster.
Versa Analytics & the VersaONE platform
Within VersaONE, Analytics is the visibility layer beneath every front end. Administrators reach its dashboards through Versa Director, which also governs role-based access to what each admin or tenant can see; Versa Concerto surfaces the same data through its own SASE portal, and Versa Titan does the same for Titan-managed customers, whose self-service Titan Portal carries its own Analytics and Live Monitoring dashboards. Wherever the front end, the reports – bandwidth per site, top applications and destinations, firewall-rule hits, IP reputation, SD-WAN path performance, security events – are generated once, by Analytics.
Analytics also natively integrates with third-party SIEM products: log-forwarder nodes can stream events onward, for example to CrowdStrike Falcon Next-Gen SIEM, so a security team’s existing tooling gets Versa telemetry without a separate export pipeline. Predefined business report templates – covering Advanced Logging Service usage, generative-AI activity, and SASE CIO summaries – turn the same data into recurring stakeholder reports without custom query building.
Frequently asked questions
What is the difference between Versa Analytics and Versa Director?
Director is the management plane: templates, configuration, device lifecycle. Analytics is the visibility plane – it ingests logs and telemetry from VOS devices and turns them into dashboards, reports, and SIEM feeds. Administrators reach Analytics through Director, but the two are separate headend components.
Does Versa Analytics require its own hardware cluster?
Not necessarily. A traditional deployment runs Analytics as a bare-metal, white-box, or virtual-machine cluster hosted on-premises. The Advanced Logging Service (ALS) is a Versa-managed, cloud-hosted alternative that ingests the same logs without an organization sizing, buying, or operating its own cluster hardware.
How does Versa Analytics get log and telemetry data from VOS devices?
VOS devices continuously report status and path information, and every running service exports flow-level and aggregate logs, through log export functionality (LEF) – TCP, UDP, or SSL connections in IPFIX or syslog format – to an Analytics node log collector.
Can Versa Analytics send data to a third-party SIEM?
Yes. Analytics natively integrates with third-party data-reporting and SIEM products; dedicated log-forwarder nodes can stream logs onward to platforms such as CrowdStrike Falcon Next-Gen SIEM, so an organization’s existing security-operations tooling receives Versa telemetry alongside its own native reporting dashboards.
What happens if a primary Analytics cluster goes down?
A secondary Analytics cluster, or a third-party one, configured in active-backup or active-active mode with the primary, takes over log collection automatically. An ADC load-balances connections between the primary and secondary clusters and handles failover when the primary becomes unavailable.
More on Versa Analytics
If you want to learn more, these are sources we trust.
| Versa Networks: platform | Versa Networks: secure SD-WAN | Versa Academy |
|---|---|---|
| The vendor product pages for the platform Analytics reports on – capabilities, editions, and architecture briefs. | How the SD-WAN service that generates the telemetry Analytics collects and reports on is packaged, from the vendor. | Versa training portal: courses covering Analytics dashboards, reporting, and log-export configuration hands-on. |
Related terms
If you’re reading about Versa Analytics, these are worth looking at next.
| Versa Director | Headend | Versa Operating System |
|---|---|---|
| The centralized management console that fronts Analytics and governs role-based access to its dashboards and reports. | The centralized headend components – Director, Analytics, and Controller – that manage and monitor a Versa deployment. | The software stack running on every VOS device: the source of the logs and telemetry Analytics collects. |