ExtraHop v2

ExtraHop Reveal(x) for Cortex XSOAR is a network detection and response solution that provides complete visibility of network communications at enterprise scale, real-time threat detections backed by machine learning, and guided investigation workflows that simplify response.

Network Security · ExtraHop Reveal(x)

Configuration parameters

  • isFetch — Fetch incidents
  • incidentType — Incident type
  • on_cloud — On Cloud
  • url — URL (required)
  • apikey — API Key
  • client_id — Client ID
  • client_secret — Client Secret
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • first_fetch — First fetch time
  • max_fetch — How many incidents to fetch each time
  • advanced_filter — Advanced Filter

Commands (30)

  • extrahop-activity-map-get

    Get a link to a live activity map in ExtraHop Reveal(x).

  • extrahop-alert-rule-create

    Create a new alert rule in ExtraHop Reveal(x).

  • extrahop-alert-rule-edit

    Modify an alert rule in ExtraHop Reveal(x).

  • extrahop-alert-rules-get

    Get all alert rules from ExtraHop Reveal(x).

  • extrahop-create-alert Deprecated

    Use extrahop-alert-rule-create instead. Create a new alert rule in Reveal(x).

  • extrahop-create-alert-rule Deprecated

    Use extrahop-alert-rule-create instead. Create a new alert rule in Reveal(x).

  • extrahop-detections-list

    Get detections from ExtraHop Reveal(x).

  • extrahop-device-search Deprecated

    Use extrahop-devices-search instead. Search for devices in Reveal(x).

  • extrahop-devices-search

    Search for devices in ExtraHop Reveal(x).

  • extrahop-devices-tag

    Add or remove a tag from devices in ExtraHop Reveal(x).

  • extrahop-edit-alert Deprecated

    Use extrahop-alert-rule-edit instead. Modify an alert rule in Reveal(x).

  • extrahop-edit-alert-rule Deprecated

    Use extrahop-alert-rule-edit instead. Modify an alert rule in Reveal(x).

  • extrahop-edit-watchlist Deprecated

    Use extrahop-watchlist-edit instead. Add or remove devices from the watchlist in Reveal(x).

  • extrahop-get-activity-map Deprecated

    Use extrahop-activity-map-get instead. Get a link to a live activity map in Reveal(x).

  • extrahop-get-alert-rules Deprecated

    Use extrahop-alert-rules-get instead. Get all alert rules from Reveal(x).

  • extrahop-get-alerts Deprecated

    Use extrahop-alert-rules-get instead. Get all alert rules from Reveal(x).

  • extrahop-get-peers Deprecated

    Use extrahop-peers-get instead. Get all peers for a device from Reveal(x).

  • extrahop-get-protocols Deprecated

    Use extrahop-protocols-get instead. Get all active network protocols for a device from Reveal(x).

  • extrahop-get-watchlist Deprecated

    Use extrahop-watchlist-get instead. Get all devices on the watchlist in Reveal(x).

  • extrahop-metrics-list

    Get metrics for specified objects from ExtraHop Reveal(x).

  • extrahop-packets-search

    Search for specific packets in ExtraHop Reveal(x).

  • extrahop-peers-get

    Get all peers for a device from ExtraHop Reveal(x).

  • extrahop-protocols-get

    Get all active network protocols for a device from ExtraHop Reveal(x).

  • extrahop-query-records Deprecated

    No available replacement. Query records from Reveal(x).

  • extrahop-search-packets Deprecated

    Use extrahop-packets-search instead. Search for specific packets in Reveal(x).

  • extrahop-tag-devices Deprecated

    Use extrahop-devices-tag instead. Add or remove a tag from devices in Reveal(x).

  • extrahop-ticket-track

    Link an ExtraHop Reveal(x) detection to a Cortex XSOAR incident.

  • extrahop-track-ticket Deprecated

    Use extrahop-ticket-track instead. Link a Reveal(x) detection to a Demisto Investigation.

  • extrahop-watchlist-edit

    Add or remove devices from the advanced analysis watchlist in ExtraHop Reveal(x).

  • extrahop-watchlist-get

    Get all devices on the advanced analysis watchlist in ExtraHop Reveal(x).