ExtraHop Deprecated

category: Network Security
provider: BainCapital
commonfields:
  id: ExtraHop
  version: -1
deprecated: true
configuration:
- display: API Key for instance
  name: apikey
  defaultvalue: ""
  type: 4
  required: true
- display: URL for the instance
  name: url
  defaultvalue: ""
  type: 0
  required: true
- display: Trust any certificate (not secure)
  name: insecure
  defaultvalue: "false"
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  defaultvalue: "false"
  type: 8
  required: false
description: Deprecated. We recommend using ExtraHop Reveal(x) instead. ExtraHop performs real-time stream analysis of the packets that carry data across a network.
display: ExtraHop (Deprecated)
name: ExtraHop
script:
  commands:
  - deprecated: true
    description: Get alerts from ExtraHop
    name: extrahop-get-alert-rules
    outputs:
    - contextPath: Extrahop.Alert.Operator
      description: The logical operator applied when comparing the value of the operand field to alert conditions.
      type: String
    - contextPath: Extrahop.Alert.FieldName
      description: The name of the monitored metric.
      type: String
    - contextPath: Extrahop.Alert.NotifySnmp
      description: 'Indicates whether to send an SNMP trap when an alert is generated. '
      type: Boolean
    - contextPath: Extrahop.Alert.Operand
      description: The value to compare against alert conditions.
      type: String
    - contextPath: Extrahop.Alert.IntervalLength
      description: The length of the alert interval, expressed in seconds.
      type: Number
    - contextPath: Extrahop.Alert.Author
      description: 'The name of the user that created the alert. '
      type: String
    - contextPath: Extrahop.Alert.Name
      description: The unique, friendly name for the alert.
      type: String
    - contextPath: Extrahop.Alert.FieldName2
      description: The second monitored metric when applying a ratio.
      type: String
    - contextPath: Extrahop.Alert.RefireInterval
      description: The time interval in which alert conditions are monitored, expressed in seconds.
      type: Number
    - contextPath: Extrahop.Alert.ModTime
      description: 'The time of the most recent update, expressed in milliseconds since the epoch. '
      type: Number
    - contextPath: Extrahop.Alert.Units
      description: The interval in which to evaluate the alert condition.
      type: String
    - contextPath: Extrahop.Alert.ApplyAll
      description: Indicates whether the alert is assigned to all available data sources.
      type: Boolean
    - contextPath: Extrahop.Alert.Type
      description: The type of alert.
      type: String
    - contextPath: Extrahop.Alert.FieldOp
      description: The type of comparison between the "field_name" and "field_name2" fields when applying a ratio.
      type: String
    - contextPath: Extrahop.Alert.Id
      description: The unique identifier for the alert.
      type: Number
    - contextPath: Extrahop.Alert.Disabled
      description: Indicates whether the alert is disabled.
      type: Boolean
    - contextPath: Extrahop.Alert.Description
      description: An optional description for the alert.
      type: String
    - contextPath: Extrahop.Alert.Severity
      description: The severity level of the alert.
      type: Number
    - contextPath: Extrahop.Alert.StatName
      description: The statistic name for the alert.
      type: String
  - arguments:
    - description: The name of the field in the record to filter.
      name: field
    - description: The value that the query attempts to match.
      name: value
    - description: The compare method applied when matching the operand value against the field contents.
      name: operator
      required: true
    - description: The beginning timestamp of the time range the query will search, expressed in milliseconds since the epoch. A negative value specifies that the search will begin with records created at a time in the past. For example, specify -600000ms to begin the search with records created 10 minutes before the time of the request.
      name: query_from
      required: true
    - defaultValue: '20'
      description: The maximum number of entries to return.
      name: limit
    deprecated: true
    description: Queries records from ExtraHop.
    name: extrahop-query
    outputs:
    - contextPath: ExtraHop.Query.Id
      description: The ID of the queried item.
      type: String
    - contextPath: ExtraHop.Query.Index
      description: The index of the queried item.
      type: String
    - contextPath: ExtraHop.Query.Sort
      description: The sort type for the queried item.
      type: Number
    - contextPath: ExtraHop.Query.Source.roundTripTime
      description: The roundtrip time of the item.
      type: Number
    - contextPath: ExtraHop.Query.Source.processingTime
      description: The processing time of the item.
      type: Number
    - contextPath: ExtraHop.Query.Source.method
      description: The method of the item.
      type: String
    - contextPath: ExtraHop.Query.Source.serverZeroWnd
      description: The Server Zero Wnd.
      type: Number
    - contextPath: ExtraHop.Query.Source.server.type
      description: The type of item found.
      type: String
    - contextPath: ExtraHop.Query.Source.server.value
      description: The ID of server found.
      type: String
    - contextPath: ExtraHop.Query.Source.serverPort
      description: The port of item.
      type: Number
    - contextPath: ExtraHop.Query.Source.reqTimeToLastByte
      description: The time to Last Byte.
      type: Number
    - contextPath: ExtraHop.Query.Source.isSQLi
      description: Whether it is SQLi.
      type: Boolean
    - contextPath: ExtraHop.Query.Source.isRspCompressed
      description: Whether the response is compressed.
      type: Boolean
    - contextPath: ExtraHop.Query.Source.rspTimeToFirstHeader
      description: The response time of the first header.
      type: Number
    - contextPath: ExtraHop.Query.Source.reqL2Bytes
      description: Request L2 Bytes.
      type: Number
    - contextPath: ExtraHop.Query.Source.isRspChunked
      description: Whether the response is chunked.
      type: Boolean
    - contextPath: ExtraHop.Query.Source.query
      description: The query of the item.
      type: String
    - contextPath: ExtraHop.Query.Source.host
      description: The host of item.
      type: String
    - contextPath: ExtraHop.Query.Source.rspPkts
      description: The number of response packets found.
      type: Number
    - contextPath: ExtraHop.Query.Source.flowId
      description: The flow ID.
      type: String
    - contextPath: ExtraHop.Query.Source.rspVersion
      description: The response version.
      type: String
    - contextPath: ExtraHop.Query.Source.isRspAborted
      description: Whether the response was aborted.
      type: Boolean
    - contextPath: ExtraHop.Query.Source.client.type
      description: The type of client.
      type: String
    - contextPath: ExtraHop.Query.Source.client.value
      description: The ID of client.
      type: String
    - contextPath: ExtraHop.Query.Source.uri
      description: The URI of the item.
      type: String
    - contextPath: ExtraHop.Query.Source.clientPort
      description: The client port.
      type: Number
    - contextPath: ExtraHop.Query.Source.reqBytes
      description: The request size (in bytes).
      type: Number
    - contextPath: ExtraHop.Query.Source.isXSS
      description: Whether it is XSS.
      type: Boolean
    - contextPath: ExtraHop.Query.Source.reqRTO
      description: The request RTO.
      type: Number
    - contextPath: ExtraHop.Query.Source.rspSize
      description: The response size.
      type: Number
    - contextPath: ExtraHop.Query.Source.ex.isSuspicious
      description: Whether it is suspicious?
      type: Boolean
    - contextPath: ExtraHop.Query.Source.contentType
      description: The content type.
      type: String
    - contextPath: ExtraHop.Query.Source.serverAddr.type
      description: The server address type.
      type: String
    - contextPath: ExtraHop.Query.Source.serverAddr.value
      description: The server address value.
      type: String
    - contextPath: ExtraHop.Query.Source.rspTimeToLastByte
      description: The response time to last byte.
      type: Number
    - contextPath: ExtraHop.Query.Source.rspTimeToFirstPayload
      description: The response time to first payload.
      type: Number
    - contextPath: ExtraHop.Query.Source.timestamp
      description: The timestamp of the item.
      type: Number
    - contextPath: ExtraHop.Query.Source.rspL2Bytes
      description: The Response L2 Bytes.
      type: Number
    - contextPath: ExtraHop.Query.Source.reqPkts
      description: The request packets.
      type: Number
    - contextPath: ExtraHop.Query.Source.isPipelined
      description: Whether it is pipelined?
      type: Boolean
    - contextPath: ExtraHop.Query.Source.clientZeroWnd
      description: Client Zero Wnd
      type: Number
    - contextPath: ExtraHop.Query.Source.isReqAborted
      description: Whether the request was aborted.
      type: Boolean
    - contextPath: ExtraHop.Query.Source.clientAddr.type
      description: The client address type.
      type: String
    - contextPath: ExtraHop.Query.Source.clientAddr.value
      description: The client address value.
      type: String
    - contextPath: ExtraHop.Query.Source.rspBytes
      description: The response bytes.
      type: Number
    - contextPath: ExtraHop.Query.Source.rspRTO
      description: The response RTO.
      type: Number
    - contextPath: ExtraHop.Query.Source.statusCode
      description: The status code.
      type: Number
    - contextPath: ExtraHop.Query.Source.reqSize
      description: The request size.
      type: Number
    - contextPath: ExtraHop.Query.Type
      description: The type of query.
      type: String
  - arguments:
    - description: The beginning timestamp for the request. Returns only devices active after this time. Time is expressed in milliseconds since the epoch.
      name: active_from
    - description: The ending timestamp for the request.
      name: active_until
    - auto: PREDEFINED
      defaultValue: any
      description: Indicates the field to search.
      name: search_type
      predefined:
      - any
      - name
      - discovery_id
      - ip address
      - mac address
      - vendor
      - type
      - tag
      - activity
      - node
      - vlan
      required: true
    - defaultValue: '10'
      description: The maximum number of devices to return.
      name: limit
    deprecated: true
    description: View Devices from ExtraHop
    name: extrahop-devices
    outputs:
    - contextPath: ExtraHop.Device.Macaddr
      description: The MAC Address of the device.
      type: String
    - contextPath: ExtraHop.Device.DeviceClass
      description: The class of the device.
      type: String
    - contextPath: ExtraHop.Device.UserModTime
      description: The time of the most recent update, expressed in milliseconds since the epoch.
      type: Number
    - contextPath: ExtraHop.Device.AutoRole
      description: The role given automatically to the device.
      type: String
    - contextPath: ExtraHop.Device.ParentId
      description: The ID of the parent device.
      type: Number
    - contextPath: ExtraHop.Device.Vendor
      description: The device vendor.
      type: String
    - contextPath: ExtraHop.Device.AnalysisLevel
      description: The analysis level of the device.
      type: Number
    - contextPath: ExtraHop.Device.DiscoveryId
      description: The ID given by Discovery appliance.
      type: String
    - contextPath: ExtraHop.Device.DefaultName
      description: The default name of the device.
      type: String
    - contextPath: ExtraHop.Device.DisplayName
      description: The display name of device.
      type: String
    - contextPath: ExtraHop.Device.OnWatchlist
      description: Whether the device is on allow list.
      type: Boolean
    - contextPath: ExtraHop.Device.ModTime
      description: The time of the most recent update, expressed in milliseconds since the epoch.
      type: Number
    - contextPath: ExtraHop.Device.IsL3
      description: Indicates whether the device is an L3 device.
      type: Boolean
    - contextPath: ExtraHop.Device.ExtrahopId
      description: The ID given by ExtraHop.
      type: String
    - contextPath: ExtraHop.Device.Role
      description: The role of the device.
      type: String
    - contextPath: ExtraHop.Device.DiscoverTime
      description: The time that the device was discovered.
      type: Number
    - contextPath: ExtraHop.Device.Id
      description: The ID of the device.
      type: Number
    - contextPath: ExtraHop.Device.Ipaddr4
      description: The IPv4 address of the device.
      type: String
    - contextPath: ExtraHop.Device.Analysis
      description: The analysis level of the device.
      type: String
    - contextPath: ExtraHop.Device.Vlanid
      description: The ID of VLan.
      type: Number
  - arguments:
    - description: The IDs of the resources to assign.
      isArray: true
      name: add
    - description: The IDs of the resources to unassign.
      isArray: true
      name: remove
    deprecated: true
    description: Modifies an allow list from ExtraHop.
    name: extrahop-whitelist-modify
  - deprecated: true
    description: Retrieves the allow list from ExtraHop.
    name: extrahop-whitelist-retrieve
    outputs:
    - contextPath: Extrahop.Device.Macaddr
      description: 'The MAC address for this device. '
      type: String
    - contextPath: Extrahop.Device.DeviceClass
      description: 'The class of this device. '
      type: String
    - contextPath: Extrahop.Device.UserModTime
      description: 'The time of the most recent update made by the user, expressed in milliseconds since the epoch. '
      type: Number
    - contextPath: Extrahop.Device.AutoRole
      description: 'The role automatically detected by the ExtraHop. '
      type: String
    - contextPath: Extrahop.Device.ParentId
      description: 'The unique identifier for the parent device object. '
      type: Number
    - contextPath: Extrahop.Device.Vendor
      description: The name of the vendor that created the device.
      type: String
    - contextPath: Extrahop.Device.AnalysisLevel
      description: (Deprecated) Replaced by the analysis field.
      type: Number
    - contextPath: Extrahop.Device.DiscoveryId
      description: The unique identifier for the device, which is displayed as part of the device URL in the ExtraHop Web UI.
      type: String
    - contextPath: Extrahop.Device.DefaultName
      description: The default name for this device.
      type: String
    - contextPath: Extrahop.Device.DisplayName
      description: 'The display name chosen based on the running configuration settings. '
      type: String
    - contextPath: Extrahop.Device.OnWatchlist
      description: Indicates whether the device is on the watchlist.
      type: Boolean
    - contextPath: Extrahop.Device.ModTime
      description: 'The time of the most recent update, expressed in milliseconds since the epoch. '
      type: Number
    - contextPath: Extrahop.Device.IsL3
      description: 'Indicates whether the device is an L3 device. '
      type: Boolean
    - contextPath: Extrahop.Device.ExtrahopId
      description: (Deprecated) Use the discover_id field instead.
      type: String
    - contextPath: Extrahop.Device.Role
      description: 'The role of the device. '
      type: String
    - contextPath: Extrahop.Device.DiscoverTime
      description: 'The time when the device was first discovered on the network, expressed in milliseconds since the epoch. '
      type: Number
    - contextPath: Extrahop.Device.Id
      description: The unique identifier for the device, which is displayed as the API ID on the device page in the ExtraHop Web UI .
      type: Number
    - contextPath: Extrahop.Device.Ipaddr4
      description: The IPv4 address for this device.
      type: String
    - contextPath: Extrahop.Device.DhcpName
      description: 'The DHCP name for this device. '
      type: String
    - contextPath: Extrahop.Device.Analysis
      description: 'The analysis level of the device. '
      type: String
    - contextPath: Extrahop.Device.Vlanid
      description: The unique identifier for the VLAN this device is associated with.
      type: Number
  - arguments:
    - auto: PREDEFINED
      description: Indicates whether the alert is assigned to all available data sources.
      name: apply_all
      predefined:
      - 'true'
      - 'false'
      required: true
    - auto: PREDEFINED
      description: Indicates whether the alert is disabled.
      name: disabled
      predefined:
      - 'true'
      - 'false'
      required: true
    - description: The unique, friendly name for the alert.
      name: name
      required: true
    - auto: PREDEFINED
      description: Indicates whether to send an SNMP trap when an alert is generated.
      name: notify_snmp
      predefined:
      - 'true'
      - 'false'
      required: true
    - auto: PREDEFINED
      description: 'The time interval in which alert conditions are monitored, expressed in seconds. '
      name: refire_interval
      predefined:
      - '300'
      - '600'
      - '900'
      - '1800'
      - '3600'
      - '7200'
      - '14400'
      required: true
    - description: 'The severity level of the alert, which is displayed in the Alert History, email notifications, and SNMP traps. Supported values: 0, 1, 2, 3, 4, 5, 6, 7'
      name: severity
      required: true
    - auto: PREDEFINED
      description: 'The type of alert. '
      name: type
      predefined:
      - detection
      - threshold
      required: true
    - auto: PREDEFINED
      description: 'The type of metric source monitored by the alert configuration. Only applicable to detection alerts. '
      name: object_type
      predefined:
      - application
      - device
    - description: The list of monitored protocols. Only applicable to detection alerts.
      name: protocols
    - description: The name of the monitored metric. Only applicable to threshold alerts.
      name: field_name
    - description: The second monitored metric when applying a ratio. Only applicable to threshold alerts.
      name: field_name2
    - description: The statistic name for the alert. Only applicable to threshold alerts.
      name: stat_name
    - auto: PREDEFINED
      description: "The interval in which to evaluate the alert condition. Only applicable to threshold alerts. \nSupported values: \"none\", \"period\", \"1 sec\", \"1 min\", \"1 hr\""
      name: units
      predefined:
      - none
      - period
      - 1 sec
      - 1 min
      - 1 hr
    - auto: PREDEFINED
      defaultValue: '30'
      description: "The length of the alert interval, expressed in seconds. Only applicable to threshold alerts. \nSupported values: 30, 60, 120, 300, 600, 900, 1200, 1800"
      name: interval_length
      predefined:
      - '30'
      - '60'
      - '120'
      - '300'
      - '600'
      - '900'
      - '1200'
      - '1800'
    - description: The value to compare against alert conditions. The compare method is specified by the value of the operator field. Only applicable to threshold alerts.
      name: operand
    - auto: PREDEFINED
      description: The logical operator applied when comparing the value of the operand field to alert conditions. Only applicable to threshold alerts.
      name: operator
      predefined:
      - ==
      - '>'
      - <
      - '>='
      - <=
    - auto: PREDEFINED
      description: The type of comparison between the field_name and field_name2 fields when applying a ratio. Only applicable to threshold alerts.
      name: field_op
      predefined:
      - /
      - 'null'
    - description: The first alert parameter, which is either a key pattern or a data point. Only applicable to threshold alerts.
      name: param
    - description: The second alert parameter, which is either a key pattern or a data point. Only applicable to threshold alerts.
      name: param2
    deprecated: true
    description: Adds an alert to ExtraHop.
    name: extrahop-add-alert-rule
  - arguments:
    - description: The unique identifier for the alert.
      name: alert_id
      required: true
    - auto: PREDEFINED
      description: Indicates whether the alert is assigned to all available data sources.
      name: apply_all
      predefined:
      - 'true'
      - 'false'
      required: true
    - auto: PREDEFINED
      description: Indicates whether the alert is disabled.
      name: disabled
      predefined:
      - 'true'
      - 'false'
      required: true
    - description: The unique, friendly name for the alert.
      name: name
      required: true
    - auto: PREDEFINED
      description: Indicates whether to send an SNMP trap when an alert is generated.
      name: notify_snmp
      predefined:
      - 'true'
      - 'false'
      required: true
    - description: The name of the monitored metric. Only applicable to threshold alerts.
      name: field_name
    - description: The statistic name for the alert. Only applicable to threshold alerts.
      name: stat_name
    - auto: PREDEFINED
      description: The interval in which to evaluate the alert condition. Only applicable to threshold alerts.
      name: units
      predefined:
      - none
      - period
      - 1 sec
      - 1 min
      - 1 hr
    - auto: PREDEFINED
      description: The length of the alert interval, expressed in seconds. Only applicable to threshold alerts.
      name: interval_length
      predefined:
      - '30'
      - '60'
      - '120'
      - '300'
      - '600'
      - '900'
      - '1200'
      - '1800'
    - description: The value to compare against alert conditions. The compare method is specified by the value of the operator field. Only applicable to threshold alerts.
      name: operand
    - auto: PREDEFINED
      description: The time interval in which alert conditions are monitored, expressed in seconds.
      name: refire_interval
      predefined:
      - '300'
      - '600'
      - '900'
      - '1800'
      - '3600'
      - '7200'
      - '14400'
      required: true
    - auto: PREDEFINED
      description: The severity level of the alert, which is displayed in the Alert History, email notifications, and SNMP traps.
      name: severity
      predefined:
      - '0'
      - '1'
      - '2'
      - '3'
      - '4'
      - '5'
      - '6'
      - '7'
      required: true
    - auto: PREDEFINED
      description: 'The type of alert.'
      name: type
      predefined:
      - detection
      - threshold
      required: true
    - auto: PREDEFINED
      description: The type of metric source monitored by the alert configuration. Only applicable to detection alerts.
      name: object_type
      predefined:
      - application
      - device
    - description: The list of monitored protocols. Only applicable to detection alerts.
      name: protocols
    - auto: PREDEFINED
      description: The logical operator applied when comparing the value of the operand field to alert conditions. Only applicable to threshold alerts.
      name: operator
      predefined:
      - ==
      - '>'
      - <
      - '>='
      - <=
    - description: The second monitored metric when applying a ratio. Only applicable to threshold alerts.
      name: field_name2
    - auto: PREDEFINED
      description: The type of comparison between the field_name and field_name2 fields when applying a ratio. Only applicable to threshold alerts.
      name: field_op
      predefined:
      - /
      - 'null'
    - description: The first alert parameter, which is either a key pattern or a data point. Only applicable to threshold alerts.
      name: param
    - description: The second alert parameter, which is either a key pattern or a data point. Only applicable to threshold alerts.
      name: param2
    deprecated: true
    description: Modifies an alert in ExtraHop.
    name: extrahop-modify-alert-rule
  dockerimage: demisto/python3:3.8.2.6981
  runonce: false
  script: ''
  type: python
  subtype: python3
tests:
- No tests
fromversion: 5.0.0