Production-wide Vectra NDR via AWS VPC Traffic Mirroring centralizes threat detection across six production VPCs spanning three AWS accounts using Transit Gateway and VXLAN encapsulation. EC2 workload ENIs in each VPC mirror traffic via UDP/4789 to a dedicated Security Tooling VPC housing a Vectra Sensor Pool and AI Brain detection engine. This architecture separates mirrored traffic (blue) from production app traffic (green), routing both through a shared Transit Gateway and optional inspection layer for comprehensive visibility without impacting workload performance. Fork this diagram to customize mirror targets, add additional VPCs, or integrate with your SIEM and Vectra SaaS portal for centralized threat intelligence. The design balances high-volume traffic analysis with cost optimization by pooling sensors across accounts and leveraging AWS RAM for shared mirror target resources.