ExtraHop v2

ExtraHop Reveal(x) for Cortex XSOAR is a network detection and response solution that provides complete visibility of network communications at enterprise scale, real-time threat detections backed by machine learning, and guided investigation workflows that simplify response.

Network Security · ExtraHop Reveal(x)

Details

IDExtraHop v2
ProviderBain Capital Private Equity
CategoryNetwork Security
From Version6.5.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM EDR Cortex Cloud Cloud Runtime Security

README

ExtraHop Reveal(x) for Cortex XSOAR is a network detection and response solution that provides complete visibility of network communications at enterprise scale, real-time threat detections backed by machine learning, and guided investigation workflows that simplify response.

Configure ExtraHop Reveal(x) in Cortex

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for ExtraHop Reveal(x).
  3. Click Add instance to create and configure a new integration instance.
Parameter Description Required
Name The name of the instance. True
Fetches incidents Select to enable this instance to fetch detection events. Otherwise, select Do not fetch. Each API call fetches a maximum of 200 detection events. True
Classifier Specifies the type of incident to be created for detection events ingested by this instance. False
Incident type Specifies the type of incident to be created for detection events ingested by this instance if a Classifier is not specified. False
Mapper Specifies how detection events ingested by this instance are mapped to Cortex XSOAR incident fields. False
On Cloud The type of ExtraHop system the integration will connect to. Select if connecting to ExtraHop Reveal(x) 360. Leave unselected if connecting to Reveal(x) Enterprise. False
URL The URL of the ExtraHop system this integration will connect to. True
API Key The API key required for authentication if connecting to ExtraHop Reveal(x) Enterprise. The API key is generated on your ExtraHop system. False
Client ID and Client Secret The credential pair required for authentication if connecting to ExtraHop Reveal(x) 360. The client ID and secret are generated on your ExtraHop system. False
Trust any certificate (not secure) Specifies whether to allow connections without verifying SSL certificate’s validity. False
Use system proxy settings Specifies whether to use XSOAR system proxy settings to connect to the API. False
First fetch time Specifies the beginning timestamp from which to start fetching detection events. False
Incidents Fetch Interval Specifies how often the instance fetches detection events. Because each API call fetches a maximum of 200 detection events, we recommend specifying one minute intervals to fetch all detection events. False
Advanced Filter Applies a filter to the list of detections based on a JSON-specific query.

Example for detections:
{
“categories”: [“sec.attack”],
“risk_score_min”: 51
}

If the categories and category are not specified, then categories will be set to [“sec.attack”]. The category field is deprecated by the API, so please use the categories field instead.
For a complete reference to the Extrahop detections filter fields, please refer to the ExtraHop REST API documentation at
https://docs.extrahop.com/current/rest-api-guide/		 False
Do not use by default Select to disable running commands through the Cortex XSOAR CLI on this instance of the integration. False
Log Level Specifies the level of logging to enable for this instance of the integration. False
Run on Specifies whether to run the instance of the integration on a single engine. False
  1. Click Test to validate the URL, credentials, and connection.

Commands

You can run the following commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully run a command, a DBot message appears in the War Room with the command details.

  • Get detections from ExtraHop Reveal(x): extrahop-detections-list
  • Link an ExtraHop Reveal(x) detection to a Cortex XSOAR incident: extrahop-ticket-track
  • Search for devices in ExtraHop Reveal(x): extrahop-devices-search
  • Get all active network protocols for a device from ExtraHop Reveal(x): extrahop-protocols-get
  • Get all peers for a device from ExtraHop Reveal(x): extrahop-peers-get
  • Get a link to a live activity map in ExtraHop Reveal(x): extrahop-activity-map-get
  • Get all devices on the Advanced Analysis watchlist in ExtraHop Reveal(x): extrahop-watchlist-get
  • Add or remove devices from the Advanced Analysis watchlist in ExtraHop Reveal(x): extrahop-watchlist-edit
  • Add or remove a tag from devices in ExtraHop Reveal(x): extrahop-devices-tag
  • Get all alert rules from ExtraHop Reveal(x): extrahop-alert-rules-get
  • Create a new alert rule in ExtraHop Reveal(x): extrahop-alert-rule-create
  • Modify an alert rule in ExtraHop Reveal(x): extrahop-alert-rule-edit
  • Get metrics for specified objects from ExtraHop Reveal(x): extrahop-metrics-list
  • Search for specific packets in ExtraHop Reveal(x): extrahop-packets-search

extrahop-watchlist-get

Get all devices on the advanced analysis watchlist in ExtraHop Reveal(x).

Base Command

extrahop-watchlist-get

Input

There are no input arguments for this command.

Context Output

Path Type Description
ExtraHop.Device.Macaddr String The MAC Address of the device.
ExtraHop.Device.DeviceClass String The class of this device.
ExtraHop.Device.UserModTime Number The time of the most recent update, expressed in milliseconds since the epoch.
ExtraHop.Device.AutoRole String The role automatically detected by the ExtraHop system.
ExtraHop.Device.ParentId Number The ID of the parent device.
ExtraHop.Device.Vendor String The device vendor.
ExtraHop.Device.Analysis string The level of analysis received by the device.
ExtraHop.Device.DiscoveryId String The UUID for this device.
ExtraHop.Device.DefaultName String The default name for this device.
ExtraHop.Device.DisplayName String The display name of device.
ExtraHop.Device.OnWatchlist Boolean Whether the device is on the advanced analysis watch list.
ExtraHop.Device.ModTime Number The time of the most recent update, expressed in milliseconds since the epoch.
ExtraHop.Device.IsL3 Boolean Indicates whether the device is a layer 3 device.
ExtraHop.Device.Role String The role of the device.
ExtraHop.Device.DiscoverTime Number The time that the device was discovered.
ExtraHop.Device.Id Number The ID of the device.
ExtraHop.Device.Ipaddr4 String The IPv4 address for this device.
ExtraHop.Device.Vlanid Number The unique identifier for the VLAN associated with the device.
ExtraHop.Device.Ipaddr6 string The IPv6 address of the device.
ExtraHop.Device.NodeId number The node ID of the sensor associated with this device.
ExtraHop.Device.Description string A user customizable description of the device.
ExtraHop.Device.DnsName string The DNS name associated with the device.
ExtraHop.Device.DhcpName string The DHCP name associated with the device.
ExtraHop.Device.CdpName string The Cisco Discovery Protocol name associated with the device.
ExtraHop.Device.NetbiosName string The NetBIOS name associated with the device.
ExtraHop.Device.Url string Link to the device details page in ExtraHop Reveal(x).

Command example


#### Context Example

```json
{
    "ExtraHop": {
        "Device": [
            {
                "analysis": "advanced",
                "analysis_level": 2,
                "auto_role": "other",
                "critical": false,
                "default_name": "VM9",
                "device_class": "node",
                "dhcp_name": "test",
                "discover_time": 1635499650000,
                "discovery_id": "0000000000000000",
                "display_name": "test",
                "extrahop_id": "0000000000000000",
                "id": 25769803982,
                "ipaddr4": "0.0.0.0",
                "is_l3": false,
                "macaddr": "00:00:00:00:00:00",
                "mod_time": 1676638611398,
                "model": "vmware_vm",
                "node_id": 6,
                "on_watchlist": true,
                "role": "other",
                "url": "https://dummy_url/extrahop/#/metrics/devices/overview/",
                "user_mod_time": 1676290306316,
                "vendor": "VMware",
                "vlanid": 0
            },
            {
                "analysis": "advanced",
                "analysis_level": 2,
                "auto_role": "other",
                "critical": false,
                "default_name": "VM8",
                "device_class": "node",
                "discover_time": 1675318050000,
                "discovery_id": "0000000000000000",
                "display_name": "VM8",
                "extrahop_id": "0000000000000000",
                "id": 25769808133,
                "ipaddr4": "0.0.0.0",
                "is_l3": false,
                "last_seen_time": 1675319010000,
                "macaddr": "00:00:00:00:00:00",
                "mod_time": 1675425919964,
                "model": "vmware_vm",
                "node_id": 6,
                "on_watchlist": true,
                "role": "other",
                "url": "https://dummy_url/extrahop/#/metrics/devices/00000000000000000000000000000000.0000000000000000/overview/",
                "user_mod_time": 0,
                "vendor": "VMware",
                "vlanid": 0
            }
        ]
    }
}

Human Readable Output

Device Details

Display Name IP Address MAC Address Role Vendor URL
test 0.0.0.0 00:00:00:00:00:00 other VMware View Device in ExtraHop
VM 8 0.0.0.0 00:00:00:00:00:00 other VMware View Device in ExtraHop

extrahop-peers-get

Get all peers for a device from ExtraHop Reveal(x).

Base Command

extrahop-peers-get

Input

Argument Name Description Required
ip_or_id The IP address or ExtraHop API ID of the source device to get peer devices. Required
query_from The beginning timestamp of the time range the query will search, expressed in milliseconds since the epoch. A negative value is evaluated relative to the current time. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. See https://docs.extrahop.com/current/rest-api-guide/#supported-time-units- for more details on supported time units and suffixes. Default is -30m. Optional
query_until The ending timestamp of the time range the query will search, expressed in milliseconds since the epoch. 0 indicates the time of the request. A negative value is evaluated relative to the current time. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. See https://docs.extrahop.com/current/rest-api-guide/#supported-time-units- for more details on supported time units and suffixes. Optional
peer_role The role of the peer device in relation to the origin device. Possible values are: any, client, server. Default is any. Optional
protocol A filter to only return peers that the source device has communicated with over this protocol. If no value is set, the object includes any protocol. Possible values are: any, AAA, ActiveMQ, AJP, amf, CIFS, DB, DHCP, DICOM, DNS, FIX, FTP, HL7, HTTP, IBMMQ, ICA, IKE/ISAKMP, IMAP, IPFIX, IPsec NAT-T, IRC, iSCSI, Kerberos, L2TP, LDAP, lync-compress, memcache, Modbus, MongoDB, MSMQ, MSN, MSRPC, NetFlow, NFS, NTP, OpenVPN, PCoIP, Perforce, POP3, RDP, Redis, RFB, RTCP, RTP, sFlow, SIP, SMPP, SMTP, SNMP, SSH, SSL, Syslog, TCP, telnet, UDP, WebSocket. Default is any. Optional

Context Output

Path Type Description
ExtraHop.Device.Macaddr String The MAC address of the device.
ExtraHop.Device.DeviceClass String The class of the device.
ExtraHop.Device.UserModTime Number The time of the most recent update, expressed in milliseconds since the epoch.
ExtraHop.Device.AutoRole String The role automatically detected by the ExtraHop system.
ExtraHop.Device.ParentId Number The ID of the parent device.
ExtraHop.Device.Vendor String The device vendor.
ExtraHop.Device.Analysis string The level of analysis received by the device.
ExtraHop.Device.DiscoveryId String The UUID given of the device.
ExtraHop.Device.DefaultName String The default name for this device.
ExtraHop.Device.DisplayName String The display name of device.
ExtraHop.Device.OnWatchlist Boolean Whether the device is on the advanced analysis watch list.
ExtraHop.Device.ModTime Number The time of the most recent update, expressed in milliseconds since the epoch.
ExtraHop.Device.IsL3 Boolean Indicates whether the device is a layer 3 device.
ExtraHop.Device.Role String The role of the device.
ExtraHop.Device.DiscoverTime Number The time that the device was discovered.
ExtraHop.Device.Id Number The ID of the device.
ExtraHop.Device.Ipaddr4 String The IPv4 address for this device.
ExtraHop.Device.Vlanid Number The unique identifier for the VLAN associated with the device.
ExtraHop.Device.Ipaddr6 string The IPv6 address of the device.
ExtraHop.Device.NodeId number The node ID of the sensor associated with the device.
ExtraHop.Device.Description string A user customizable description of the device.
ExtraHop.Device.DnsName string The DNS name associated with the device.
ExtraHop.Device.DhcpName string The DHCP name associated with the device.
ExtraHop.Device.CdpName string The Cisco Discovery Protocol name associated with the device.
ExtraHop.Device.NetbiosName string The NetBIOS name associated with the device.
ExtraHop.Device.Url string Link to the device details page in ExtraHop Reveal(x).

Command example

!extrahop-peers-get ip_or_id=0.0.0.0 peer_role=server protocol=any query_from=-60m query_until=0

Context Example

{
    "ExtraHop": {
        "Device": {
            "analysis": "advanced",
            "analysis_level": 1,
            "auto_role": "gateway",
            "critical": true,
            "default_name": "Cisco Meraki 23D27A",
            "device_class": "gateway",
            "discover_time": 1655102100000,
            "discovery_id": "0000000000000000",
            "display_name": "Cisco Meraki 23D27A",
            "extrahop_id": "0000000000000000",
            "id": 25769805776,
            "ipaddr4": "0.0.0.0",
            "is_l3": false,
            "macaddr": "00:00:00:00:00:00",
            "mod_time": 1676638911830,
            "node_id": 6,
            "on_watchlist": false,
            "role": "gateway",
            "server_protocols": [
                "UDP:NTP"
            ],
            "url": "https://dummy_url/extrahop/#/metrics/devices/overview/",
            "user_mod_time": 0,
            "vendor": "Cisco Meraki",
            "vlanid": 0
        }
    }
}

Human Readable Output

Device Details

Display Name IP Address MAC Address Role Protocols URL Vendor
Cisco Meraki 23D27A 0.0.0.0 00:00:00:00:00:00 gateway Server: UDP:NTP View Device in ExtraHop Cisco Meraki

extrahop-devices-search

Search for devices in ExtraHop Reveal(x).

Base Command

extrahop-devices-search

Input

Argument Name Description Required
name The name of the device. This searches for matches on all ExtraHop Reveal(x) name fields (DHCP, DNS, NetBIOS, Cisco Discovery Protocol, etc). Optional
ip The IP address of the device. Optional
mac The MAC address of the device. Optional
role The role of the device. Possible values are: db_server, dhcp_server, dns_server, file_server, firewall, gateway, http_server, domain_controller, web_proxy, load_balancer, pc, medical_device, mobile_device, printer, scanner, custom, voip_phone, other. Optional
software The OS of the device. Possible values are: android, apple_ios, arista_eos, cisco_ios, cisco_nx-os, chrome_os, linux, mac_os, windows, windows_server, windows_server_2008, windows_server_2008_r2, windows_server_2012, windows_server_2012_r2, windows_server_2016, windows_vista, windows_7, windows_8, windows_8.1, windows_10. Optional
tag A tag present on the device. Optional
vendor The vendor of the device, based on MAC address via OUI lookup. Possible values are: alcatel-lucent, apple, arista, asus, brother, canon, cisco, cisco-linksys, citrix, dell, dellemc, d-link, emc, f5, google, hp, htc, huawei, ibm, juniper, kyocera, microsoft, netapp, netgear, nokia, nortel, oracle, paloalto, samsung, 3com, toshiba, virtualbox, vmware, zte. Optional
discover_time The time that device was first seen by the ExtraHop system, expressed in milliseconds since the epoch. A negative value is evaluated relative to the current time. The default unit for a negative value is milliseconds, but other units can be specified with the following unit suffixes: ms, s, m, h, d, w, M, y. For example, to look one day back enter -1d or -24h. See https://docs.extrahop.com/current/rest-api-guide/#supported-time-units- for more details on supported time units and suffixes. Optional
vlan The VLAN ID of the Virtual LAN that the device is on. Optional
activity The activity of the device. Possible values are: aaa_client, aaa_server, ajp_client, ajp_server, amf_client, amf_server, cifs_client, cifs_server, db_client, db_server, dhcp_client, dhcp_server, dicom_client, dicom_server, dns_client, dns_server, fix_client, fix_server, ftp_client, ftp_server, hl7_client, hl7_server, http_client, http_server, ibmmq_client, ibmmq_server, ica_client, ica_server, icmp, iscsi_client, iscsi_server, kerberos_client, kerberos_server, ldap_client, ldap_server, llmnr_client, llmnr_server, memcache_client, memcache_server, modbus_client, modbus_server, mongo_client, mongo_server, msmq, nbns_client, nbns_server, nfs_client, nfs_server, pcoip_client, pcoip_server, pop3_client, pop3_server, rdp_client, rdp_server, redis_client, redis_server, rfb_client, rfb_server, rpc_client, rpc_server, rtcp, rtp, scanner, sip_client, sip_server, smpp_client, smpp_server, smtp_client, smtp_server, ssh_client, ssh_server, ssl_client, ssl_server, tcp, telnet_client, telnet_server, udp, websocket_client, websocket_server, wsman_client, wsman_server. Optional
operator The compare method applied when matching the fields against their values. For example, to find devices with names that begin with ‘SEA1’ (set name=SEA1, operator=startswith). Possible values are: >, <, <=, >=, =, !=, startswith, exists, not_exists, ~, !~. Default is =. Optional
match_type The match operator to use when chaining the search fields together. For example, to find all HTTP servers running Windows on the network (set match_type=and, role=http_server, software=windows). Possible values are: and, or, not. Default is and. Optional
active_from The beginning timestamp for the request. Return only devices active after this time. Time is expressed in milliseconds since the epoch. 0 indicates the time of the request. A negative value is evaluated relative to the current time. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. See https://docs.extrahop.com/current/rest-api-guide/#supported-time-units- for more details on supported time units and suffixes. Optional
active_until The ending timestamp for the request. Return only devices active before this time. Time is expressed in milliseconds since the epoch. 0 indicates the time of the request. A negative value is evaluated relative to the current time. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. See https://docs.extrahop.com/current/rest-api-guide/#supported-time-units- for more details on supported time units and suffixes. Optional
limit The maximum number of devices to return. Default is 10. Optional
l3_only Only returns layer 3 devices by filtering out any layer 2 parent devices. Possible values are: true, false. Default is true. Optional

Context Output

Path Type Description
ExtraHop.Device.Macaddr String The MAC address of the device.
ExtraHop.Device.DeviceClass String The class of the device.
ExtraHop.Device.UserModTime Number The time of the most recent update, expressed in milliseconds since the epoch.
ExtraHop.Device.AutoRole String The role automatically detected by the ExtraHop system.
ExtraHop.Device.ParentId Number The ID of the parent device.
ExtraHop.Device.Vendor String The device vendor.
ExtraHop.Device.Analysis string The level of analysis received by the device.
ExtraHop.Device.DiscoveryId String The UUID of the device.
ExtraHop.Device.DefaultName String The default name of the device.
ExtraHop.Device.DisplayName String The display name of device.
ExtraHop.Device.OnWatchlist Boolean Whether the device is on the advanced analysis watch list.
ExtraHop.Device.ModTime Number The time of the most recent update, expressed in milliseconds since the epoch.
ExtraHop.Device.IsL3 Boolean Indicates whether the device is a layer 3 device.
ExtraHop.Device.Role String The role of the device.
ExtraHop.Device.DiscoverTime Number The time that the device was discovered.
ExtraHop.Device.Id Number The ID of the device.
ExtraHop.Device.Ipaddr4 String The IPv4 address of the device.
ExtraHop.Device.Vlanid Number The ID of the VLAN associated with the device.
ExtraHop.Device.Ipaddr6 String The IPv6 address of the device.
ExtraHop.Device.NodeId Number The node ID of the sensor associated with the device.
ExtraHop.Device.Description String A user customizable description of the device.
ExtraHop.Device.DnsName String The DNS name associated with the device.
ExtraHop.Device.DhcpName String The DHCP name associated with the device.
ExtraHop.Device.CdpName String The Cisco Discovery Protocol name associated with the device.
ExtraHop.Device.NetbiosName String The NetBIOS name associated with the device.
ExtraHop.Device.Url String Link to the device details page in ExtraHop Reveal(x).

Command example

!extrahop-devices-search activity=aaa_client discover_time=-10m ip=0.0.0.0 l3_only=true limit=2 mac=00:00:00:00:00:00 match_type=or name=DNS operator=!= role=file_server software=linux tag=tag1 vendor=cisco

Context Example

{
    "ExtraHop": {
        "Device": [
            {
                "analysis": "advanced",
                "analysis_level": 1,
                "auto_role": "other",
                "critical": false,
                "default_name": "VMware 8",
                "device_class": "node",
                "discover_time": 1676633640000,
                "discovery_id": "0000000000000000",
                "display_name": "VMware 8",
                "extrahop_id": "0000000000000000",
                "id": 25769808421,
                "ipaddr4": "0.0.0.0",
                "is_l3": false,
                "last_seen_time": 1676634840000,
                "macaddr": "00:00:00:00:00:00",
                "mod_time": 1676634890174,
                "model": "vmware_vm",
                "node_id": 6,
                "on_watchlist": false,
                "role": "other",
                "url": "https://dummy_url/extrahop/#/metrics/devices/overview/",
                "user_mod_time": 0,
                "vendor": "VMware",
                "vlanid": 0
            },
            {
                "analysis": "advanced",
                "analysis_level": 1,
                "auto_role": "other",
                "critical": false,
                "default_name": "VMware 3",
                "device_class": "node",
                "discover_time": 1676614620000,
                "discovery_id": "0000000000000000",
                "display_name": "VMware 3",
                "extrahop_id": "0000000000000000",
                "id": 25769808417,
                "ipaddr4": "0.0.0.0",
                "is_l3": false,
                "last_seen_time": 1676616960000,
                "macaddr": "00:00:00:00:00:00",
                "mod_time": 1676616977189,
                "model": "vmware_vm",
                "node_id": 6,
                "on_watchlist": false,
                "role": "other",
                "url": "https://dummy_url/extrahop/#/metrics/devices/overview/",
                "user_mod_time": 0,
                "vendor": "VMware",
                "vlanid": 0
            }
        ]
    }
}

Human Readable Output

Device Details

Display Name IP Address MAC Address Role Vendor URL
VMware 8 0.0.0.0 00:00:00:00:00:00 other VMware View Device in ExtraHop
VMware 3 0.0.0.0 00:00:00:00:00:00 other VMware View Device in ExtraHop

extrahop-protocols-get

Get all active network protocols for a device from ExtraHop Reveal(x).

Base Command

extrahop-protocols-get

Input

Argument Name Description Required
ip_or_id The IP address or ExtraHop API ID of the device to get all active network protocols. Required
query_from The beginning timestamp of the time range the query will search, expressed in milliseconds since the epoch. A negative value is evaluated relative to the current time. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. See https://docs.extrahop.com/current/rest-api-guide/#supported-time-units- for more details on supported time units and suffixes. Default is -30m. Optional
query_until The ending timestamp of the time range the query will search, expressed in milliseconds since the epoch. 0 indicates the time of the request. A negative value is evaluated relative to the current time. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. See https://docs.extrahop.com/current/rest-api-guide/#supported-time-units- for more details on supported time units and suffixes. Optional

Context Output

Path Type Description
ExtraHop.Device.Macaddr String The MAC address of the device.
ExtraHop.Device.DeviceClass String The class of the device.
ExtraHop.Device.UserModTime Number The time of the most recent update, expressed in milliseconds since the epoch.
ExtraHop.Device.AutoRole String The role automatically detected by the ExtraHop system.
ExtraHop.Device.ParentId Number The ID of the parent device.
ExtraHop.Device.Vendor String The device vendor.
ExtraHop.Device.Analysis String The level of analysis received by the device.
ExtraHop.Device.DiscoveryId String The UUID of the device.
ExtraHop.Device.DefaultName String The default name of the device.
ExtraHop.Device.DisplayName String The display name of device.
ExtraHop.Device.OnWatchlist Boolean Whether the device is on the advanced analysis watch list.
ExtraHop.Device.ModTime Number The time of the most recent update, expressed in milliseconds since the epoch.
ExtraHop.Device.IsL3 Boolean Indicates whether the device is a layer 3 device.
ExtraHop.Device.Role String The role of the device.
ExtraHop.Device.DiscoverTime Number The time that the device was discovered.
ExtraHop.Device.Id Number The ID of the device.
ExtraHop.Device.Ipaddr4 String The IPv4 address of the device.
ExtraHop.Device.Vlanid Number The ID of the VLAN associated with the device.
ExtraHop.Device.Ipaddr6 String The IPv6 address of the device.
ExtraHop.Device.NodeId Number The node ID of the sensor associated with the device.
ExtraHop.Device.Description String A user customizable description of the device.
ExtraHop.Device.DnsName String The DNS name associated with the device.
ExtraHop.Device.DhcpName String The DHCP name associated with the device.
ExtraHop.Device.CdpName String The Cisco Discovery Protocol name associated with the device.
ExtraHop.Device.NetbiosName String The NetBIOS name associated with the device.
ExtraHop.Device.Url String Link to the device details page in ExtraHop Reveal(x).
ExtraHop.Device.ClientProtocols String The list of protocols the peer device is communicating on as a client.
ExtraHop.Device.ServerProtocols String The list of protocols the peer device is communicating on as a server.

Command example

!extrahop-protocols-get ip_or_id=0.0.0.0 query_from=-20m query_until=0

Context Example

{
    "ExtraHop": {
        "Device": {
            "analysis": "advanced",
            "analysis_level": 2,
            "auto_role": "other",
            "client_protocols": [
                "UDP:NTP"
            ],
            "critical": false,
            "default_name": "VMware 9",
            "device_class": "node",
            "dhcp_name": "test",
            "discover_time": 1635499650000,
            "discovery_id": "0000000000000000",
            "display_name": "test",
            "extrahop_id": "0000000000000000",
            "id": 10000000000,
            "ipaddr4": "0.0.0.0",
            "is_l3": false,
            "macaddr": "00:00:00:00:00:000",
            "mod_time": 1676638611398,
            "model": "vmware_vm",
            "node_id": 6,
            "on_watchlist": true,
            "role": "other",
            "url": "https://dummy_url/extrahop/#/metrics/devices/overview/",
            "user_mod_time": 1676290306316,
            "vendor": "VMware",
            "vlanid": 0
        }
    }
}

Human Readable Output

Device Activity Found

Display Name IP Address MAC Address Protocols (Client) Role Vendor URL
test 0.0.0.0 00:00:00:00:00:000 UDP:NTP other VMware View Device in ExtraHop

extrahop-activity-map-get

Get a link to a live activity map in ExtraHop Reveal(x).

Base Command

extrahop-activity-map-get

Input

Argument Name Description Required
ip_or_id The IP address or ExtraHop API ID of the source device to get an activity map. Required
time_interval The time interval of the live activity map, expressed as the “Last” 30 minutes. For example, specify a value of 30 minutes to get an activity map showing the time range of the last 30 minutes. This field is ignored if from_time and until_time are provided. Possible values are: 30 minutes, 6 hours, 1 day, 1 week. Default is 30 minutes. Optional
from_time The beginning timestamp of a fixed time range the activity map will display, expressed in seconds since the epoch. Optional
until_time The ending timestamp of a fixed time range the activity map will display, expressed in seconds since the epoch. Optional
peer_role The role of the peer devices in relation to the source device. For example, specifying a peer_role of client will show All Clients communicating with the source device. Additionally specifying a protocol of HTTP will result in further filtering and only showing HTTP Clients communicating with the source device. Possible values are: any, client, server. Default is any. Optional
protocol The protocol over which the source device is communicating. For example, specifying a protocol of HTTP show only HTTP Clients and HTTP Servers communicating with the source device. Additionally specifying a peer_role of client will result in further filtering and only showing HTTP Clients communicating with the source device. Possible values are: any, AAA, ActiveMQ, AJP, amf, CIFS, DB, DHCP, DICOM, DNS, FIX, FTP, HL7, HTTP, IBMMQ, ICA, IKE/ISAKMP, IMAP, IPFIX, IPsec NAT-T, IRC, iSCSI, Kerberos, L2TP, LDAP, lync-compress, memcache, Modbus, MongoDB, MSMQ, MSN, MSRPC, NetFlow, NFS, NTP, OpenVPN, PCoIP, Perforce, POP3, RDP, Redis, RFB, RTCP, RTP, sFlow, SIP, SMPP, SMTP, SNMP, SSH, SSL, Syslog, TCP, telnet, UDP, WebSocket. Default is any. Optional

Context Output

Path Type Description
ExtraHop.ActivityMap.url String The link to a visual activity map in ExtraHop Reveal(x).

Command example

!extrahop-activity-map-get ip_or_id=0.0.0.0 peer_role=server protocol=any time_interval="30 minutes"

Context Example

{
    "ExtraHop": {
        "ActivityMap": {
            "url": "https://dummy_url/extrahop/#/activitymaps?appliance_id=00000000000000000000000000000000&discovery_id=0000000000000000&from=30&interval_type=MIN&object_type=device&protocol=any&role=server&until=0"
        }
    }
}

Human Readable Output

View Live Activity Map in ExtraHop

extrahop-alert-rules-get

Get all alert rules from ExtraHop Reveal(x).

Base Command

extrahop-alert-rules-get

Input

There are no input arguments for this command.

Context Output

Path Type Description
ExtraHop.Alert.Operator String The logical operator applied when comparing the value of the operand field to alert conditions.
ExtraHop.Alert.FieldName String The name of the monitored metric.
ExtraHop.Alert.NotifySnmp Boolean Indicates whether to send an SNMP trap when an alert is generated.
ExtraHop.Alert.Operand String The value to compare against alert conditions.
ExtraHop.Alert.IntervalLength Number The length of the alert interval, expressed in seconds.
ExtraHop.Alert.Author String The name of the user that created the alert.
ExtraHop.Alert.Name String The unique, friendly name for the alert.
ExtraHop.Alert.FieldName2 String The second monitored metric when applying a ratio.
ExtraHop.Alert.RefireInterval Number The time interval in which alert conditions are monitored, expressed in seconds.
ExtraHop.Alert.ModTime Number The time of the most recent update, expressed in milliseconds since the epoch.
ExtraHop.Alert.Units String The interval in which to evaluate the alert condition.
ExtraHop.Alert.ApplyAll Boolean Indicates whether the alert is assigned to all available data sources.
ExtraHop.Alert.Type String The type of alert.
ExtraHop.Alert.FieldOp String The type of comparison between the “field_name” and “field_name2” fields when applying a ratio.
ExtraHop.Alert.Id Number The unique identifier for the alert.
ExtraHop.Alert.Disabled Boolean Indicates whether the alert is disabled.
ExtraHop.Alert.Description String An optional description for the alert.
ExtraHop.Alert.Severity Number The severity level of the alert.
ExtraHop.Alert.StatName String The statistic name for the alert.

Command example


#### Context Example

```json
{
    "ExtraHop": {
        "Alert": [
            {
                "apply_all": false,
                "author": "ExtraHop",
                "description": "Alert triggered when ratio of DB errors is greater than 1%.",
                "disabled": false,
                "field_name": "rsp_error",
                "field_name2": "rsp",
                "field_op": "/",
                "id": 15,
                "interval_length": 30,
                "mod_time": 1617887147538,
                "name": "DB Error Ratio - Orange",
                "notify_snmp": false,
                "operand": "0.01",
                "operator": ">",
                "refire_interval": 300,
                "severity": 3,
                "stat_name": "extrahop.application.db",
                "type": "threshold",
                "units": "none"
            },
            {
                "apply_all": false,
                "author": "ExtraHop",
                "description": "Alert triggered when ratio of DB errors is greater than 5%.",
                "disabled": false,
                "field_name": "rsp_error",
                "field_name2": "rsp",
                "field_op": "/",
                "id": 14,
                "interval_length": 30,
                "mod_time": 1617887147615,
                "name": "DB Error Ratio - Red",
                "notify_snmp": false,
                "operand": "0.05",
                "operator": ">",
                "refire_interval": 300,
                "severity": 1,
                "stat_name": "extrahop.application.db",
                "type": "threshold",
                "units": "none"
            },
            {
                "apply_all": false,
                "author": "ExtraHop",
                "description": "Alert triggered when ratio of DNS errors is greater than 0.1%.",
                "disabled": false,
                "field_name": "rsp_error",
                "field_name2": "rsp",
                "field_op": "/",
                "id": 19,
                "interval_length": 30,
                "mod_time": 1617887147785,
                "name": "DNS Error Ratio - Yellow",
                "notify_snmp": false,
                "operand": "0.001",
                "operator": ">",
                "refire_interval": 300,
                "severity": 5,
                "stat_name": "extrahop.application.dns",
                "type": "threshold",
                "units": "none"
            }
        ]
    }
}

Human Readable Output

Found 3 Alert(s)

Apply All Author Description Disabled Field Name Field Name2 Field Op Id Interval Length Mod Time Name Notify Snmp Operand Operator Refire Interval Severity Stat Name Type Units
false ExtraHop Alert triggered when ratio of DB errors is greater than 1%. false rsp_error rsp / 15 30 1617887147538 DB Error Ratio - Orange false 0.01 > 300 3 extrahop.application.db threshold none
false ExtraHop Alert triggered when ratio of DB errors is greater than 5%. false rsp_error rsp / 14 30 1617887147615 DB Error Ratio - Red false 0.05 > 300 1 extrahop.application.db threshold none
false ExtraHop Alert triggered when ratio of DNS errors is greater than 0.1%. false rsp_error rsp / 19 30 1617887147785 DNS Error Ratio - Yellow false 0.001 > 300 5 extrahop.application.dns threshold none

extrahop-packets-search

Search for specific packets in ExtraHop Reveal(x).

Base Command

extrahop-packets-search

Input

Argument Name Description Required
output The output format. A pcap file, A keylog.txt file that can be loaded in wireshark to decode ssl packets, or a zip file containing both a packets.pcap and keylog.txt. Possible values are: pcap, keylog_txt, zip. Default is pcap. Optional
limit_bytes The maximum number of bytes to return. Default is 10MB. Optional
limit_search_duration The maximum amount of time to run the packet search. The default unit is milliseconds, but other units can be specified with a unit suffix. Default is 5m. Optional
query_from The beginning timestamp of the time range the search will include, expressed in milliseconds since the epoch. A negative value specifies that the search will begin with packets captured at a time in the past relative to the current time. For example, specify -10m to begin the search with packets captured 10 minutes before the time of the request. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. See https://docs.extrahop.com/current/rest-api-guide/#supported-time-units- for more details on supported time units and suffixes. Default is -10m. Optional
query_until The ending timestamp of the time range the search will include, expressed in milliseconds since the epoch. A 0 value specifies that the search will end with packets captured at the time of the search. A negative value specifies that the search will end with packets captured at a time in the past relative to the current time. For example, specify -5m to end the search with packets captured 5 minutes before the time of the request. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. See https://docs.extrahop.com/current/rest-api-guide/#supported-time-units- for more details on supported time units and suffixes. Optional
bpf The Berkeley Packet Filter (BPF) syntax for the packet search. Optional
ip1 Returns packets sent to or received by the specified IP address. Optional
port1 Returns packets sent from or received on the specified port. Optional
ip2 Returns packets sent to or received by the specified IP address. Optional
port2 Returns packets sent from or received on the specified port. Optional

Context Output

Path Type Description
File.Size Number The size of the file.
File.SHA1 String The SHA1 hash of the file.
File.SHA256 String The SHA256 hash of the file.
File.Name String The name of the file.
File.SSDeep String The SSDeep hash of the file.
File.EntryID String The entry ID of the file.
File.Info String File information.
File.Type String The file type.
File.MD5 String The MD5 hash of the file.
File.Extension String The file extension.

Command example

!extrahop-packets-search ip1=0.0.0.0 ip2=0.0.0.0 limit_bytes=10MB limit_search_duration=10m output=pcap port1=8000 port2=8000 query_from=-15m query_until=0

Human Readable Output

Uploaded file: extrahop 2022-12-15 21.12.29 to 21.27.29 IST.pcapDownload.

Property Value
Type pcap
Size 1,122,020 bytes
Info data
MD5 710737f2d9874690f130da14da38e7cb
SHA1 a89d4696c11ee0a8890d8f4effba8fad891cf05d
SHA256 433f238d350d8eb19979f0f513974d97b9e9f3445f99deb75c0a1f46e54de111
SHA512 fbb914a425d324e4d50bdcf15fc31499720e48d9242005c796d91c345dcb44e1f2fb1435d6bf44c89e0f8256dbae43638f5d8175872bcd29e5bf4fbcba4124cb
SSDeep 12288:WzC9IOFcF8jgBXx00uMOsOFtKu1R4mF48f6G2GeXCuX:Wgo8cNx3QsODKugmnfjcPX

extrahop-devices-tag

Add or remove a tag from devices in ExtraHop Reveal(x).

Base Command

extrahop-devices-tag

Input

Argument Name Description Required
tag The case-sensitive value of the tag. Required
add The list of IP addresses or ExtraHop API IDs of the devices to tag, comma separated. Optional
remove The list of IP addresses or ExtraHop API IDs of the devices to remove the tag from, comma separated. Optional

Context Output

There is no context output for this command.

Command example

!extrahop-devices-tag tag=MyTag add=0.0.0.0 remove=0.0.0.0

Human Readable Output

Successfully tagged untagged the device/s.

extrahop-alert-rule-create

Create a new alert rule in ExtraHop Reveal(x).

Base Command

extrahop-alert-rule-create

Input

Argument Name Description Required
apply_all Indicates whether the alert is assigned to all available data sources. Possible values are: true, false. Required
disabled Indicates whether the alert is disabled. Possible values are: true, false. Required
field_name The name of the monitored metric. Only applicable to threshold alerts. Optional
field_name2 The second monitored metric when applying a ratio. Only applicable to threshold alerts. Optional
field_op The type of comparison between the field_name and field_name2 fields when applying a ratio. Only applicable to threshold alerts. Possible values are: /, null. Optional
interval_length The length of the alert interval, expressed in seconds. Only applicable to threshold alerts. Possible values are: 30, 60, 120, 300, 600, 900, 1200, 1800. Default is 30. Optional
name The unique, friendly name for the alert. Required
notify_snmp Indicates whether to send an SNMP trap when an alert is generated. Possible values are: true, false. Required
object_type The type of metric source monitored by the alert configuration. Only applicable to detection alerts. Possible values are: application, device. Optional
operand The value to compare against alert conditions. The compare method is specified by the value of the operator field. Only applicable to threshold alerts. Optional
operator The logical operator applied when comparing the value of the operand field to alert conditions. Only applicable to threshold alerts. Possible values are: ==, >, <, >=, <=. Optional
param The first alert parameter, which is either a key pattern or a data point. Only applicable to threshold alerts. Optional
param2 The second alert parameter, which is either a key pattern or a data point. Only applicable to threshold alerts. Optional
protocols The list of monitored protocols. Only applicable to detection alerts. Optional
refire_interval The time interval in which alert conditions are monitored, expressed in seconds. Possible values are: 300, 600, 900, 1800, 3600, 7200, 14400. Required
severity The severity level of the alert, which is displayed in the Alert History, email notifications, and SNMP traps. Possible values are: 0, 1, 2, 3, 4, 5, 6, 7. Required
stat_name The statistic name for the alert. Only applicable to threshold alerts. Optional
type The type of alert. Possible values are: detection, threshold. Required
units The interval in which to evaluate the alert condition. Only applicable to threshold alerts. Possible values are: none, period, 1 sec, 1 min, 1 hr. Optional

Context Output

There is no context output for this command.

Command example

!extrahop-alert-rule-create apply_all=true interval_length=30 disabled=false name="test10" notify_snmp=false refire_interval=300 severity=4 type=detection object_type=device protocols="udp"

Human Readable Output

Successfully created alert rule.

extrahop-ticket-track

Link an ExtraHop Reveal(x) detection to a Cortex XSOAR incident.

Base Command

extrahop-ticket-track

Input

Argument Name Description Required
incident_id The ID of the Cortex XSOAR incident to track. Required
detection_id The ID of the ExtraHop Reveal(x) detection to track. Required
incident_owner Owner of the incident. Optional
incident_status Status of the incident. Possible values are: 0, 1, 2, 3. Optional
incident_close_reason Reason the incident was closed. Optional

Context Output

Path Type Description
ExtraHop.TicketId String Cortex XSOAR incident ID successfully tracked to the ExtraHop Reveal(x) detection.

Command example

!extrahop-ticket-track detection_id=1234 incident_id=1 incident_owner=John incident_status=1

Context Example

{
    "ExtraHop": {
        "ExtraHop": {
            "TicketId": "1"
        }
    }
}

Human Readable Output

Successfully linked detection(1234) with incident(1)

extrahop-alert-rule-edit

Modify an alert rule in ExtraHop Reveal(x).

Base Command

extrahop-alert-rule-edit

Input

Argument Name Description Required
alert_id The unique identifier for the alert. Required
apply_all Indicates whether the alert is assigned to all available data sources. Possible values are: true, false. Required
disabled Indicates whether the alert is disabled. Possible values are: true, false. Required
field_name The name of the monitored metric. Only applicable to threshold alerts. Optional
field_name2 The second monitored metric when applying a ratio. Only applicable to threshold alerts. Optional
field_op The type of comparison between the field_name and field_name2 fields when applying a ratio. Only applicable to threshold alerts. Possible values are: /, null. Optional
interval_length The length of the alert interval, expressed in seconds. Only applicable to threshold alerts. Possible values are: 30, 60, 120, 300, 600, 900, 1200, 1800. Default is 30. Optional
name The unique, friendly name for the alert. Required
notify_snmp Indicates whether to send an SNMP trap when an alert is generated. Possible values are: true, false. Required
object_type The type of metric source monitored by the alert configuration. Only applicable to detection alerts. Possible values are: application, device. Optional
operand The value to compare against alert conditions. The compare method is specified by the value of the operator field. Only applicable to threshold alerts. Optional
operator The logical operator applied when comparing the value of the operand field to alert conditions. Only applicable to threshold alerts. Possible values are: ==, >, <, >=, <=. Optional
param The first alert parameter, which is either a key pattern or a data point. Only applicable to threshold alerts. Optional
param2 The second alert parameter, which is either a key pattern or a data point. Only applicable to threshold alerts. Optional
protocols The list of monitored protocols. Only applicable to detection alerts. Optional
refire_interval The time interval in which alert conditions are monitored, expressed in seconds. Possible values are: 300, 600, 900, 1800, 3600, 7200, 14400. Required
severity The severity level of the alert, which is displayed in the Alert History, email notifications, and SNMP traps. Possible values are: 0, 1, 2, 3, 4, 5, 6, 7. Required
stat_name The statistic name for the alert. Only applicable to threshold alerts. Optional
type The type of alert. Possible values are: detection, threshold. Required
units The interval in which to evaluate the alert condition. Only applicable to threshold alerts. Possible values are: none, period, 1 sec, 1 min, 1 hr. Optional

Context Output

There is no context output for this command.

Command example

!extrahop-alert-rule-edit interval_length=30 alert_id=36 apply_all=true disabled=false name="t127" notify_snmp=false refire_interval=300 severity=4 type=detection protocols="udp" object_type=device

Human Readable Output

Successfully updated alert rule.

extrahop-watchlist-edit

Add or remove devices from the advanced analysis watchlist in ExtraHop Reveal(x).

Base Command

extrahop-watchlist-edit

Input

Argument Name Description Required
add The list of IP addresses or ExtraHop API IDs of the devices to add, comma separated. Optional
remove The list of IP addresses or ExtraHop API IDs of the devices to remove, comma separated. Optional

Context Output

There is no context output for this command.

Command example

!extrahop-watchlist-edit add=0.0.0.0 remove=0.0.0.0

Human Readable Output

Successfully added new devices(0.0.0.0) in the watchlist
Successfully removed devices(0.0.0.0) from the watchlist

extrahop-metrics-list

Get metrics for specified objects from ExtraHop Reveal(x).

Base Command

extrahop-metrics-list

Input

Argument Name Description Required
cycle The aggregation period for metrics.
Supported values: “auto”, “1sec”, “30sec”, “5min”, “1hr”, “24hr”. Possible values are: auto, 1sec, 30sec, 5min, 1hr, 24hr.		 Required
from_time The beginning timestamp for the request. Return only metrics collected after this time. Time is expressed in milliseconds since the epoch. 0 indicates the time of the request. A negative value is evaluated relative to the current time. The default unit for a negative value is milliseconds, but other units can be specified with a unit suffix.
For example, to request devices active in the last 30 minutes, specify the following parameter value: “-30m”.		 Required
metric_category The group of metrics that are searchable in the metric catalog. Required
object_ids The list of numeric values that represent unique identifiers. Unique identifiers can be retrieved through the /networks, /devices, /applications, /vlans, /devicegroups, /activitygroups, and /appliances resources. For system health metrics, specify the ID of the sensor or console and set the object_type parameter to “system”. Required
object_type Indicates the object type of unique identifiers specified in the object_ids property.
Supported values: “network”, “device”, “application”, “vlan”, “device_group”, “system”. Possible values are: network, device, application, vlan, device_group, system.		 Required
until_time The ending timestamp for the request. Return only metrics collected before this time. Time is expressed in milliseconds since the epoch. 0 indicates the time of the request. A negative value is evaluated relative to the current time. The default unit for a negative value is milliseconds, but other units can be specified with a unit suffix.
For example, to request devices active in the last 30 minutes, specify the following parameter value: “-30m”.		 Required
metric_specs An array of metric specification objects.
Refer to the ExtraHop REST API Guide at https://docs.extrahop.com/current/rest-api-guide/.		 Required

Context Output

Path Type Description
ExtraHop.Metrics.cycle String The aggregation period for metrics.
ExtraHop.Metrics.node_id Number Node ID of the sensor associated with the object.
ExtraHop.Metrics.clock Number The current time.
ExtraHop.Metrics.from Number The beginning time from which metrics were collected.
ExtraHop.Metrics.until Number The ending time that metrics were collected.
ExtraHop.Metrics.stats.oid Number The ID of the object.
ExtraHop.Metrics.stats.time Number The time for which metrics were collected.
ExtraHop.Metrics.stats.duration Number The duration that metrics were collected.
ExtraHop.Metrics.stats.values Unknown The count value of the metrics that were collected.

Command example

!extrahop-metrics-list cycle=auto from_time=0 metric_category=http object_ids=0 object_type=application until_time=0 metric_specs="[{\"name\": \"req\", \"key\": \"/GET/\"}]"

Context Example

{
    "ExtraHop": {
        "Metrics": {
            "clock": 1676883600000,
            "cycle": "1hr",
            "from": 0,
            "node_id": 0,
            "stats": [
                {
                    "duration": 3600000,
                    "oid": 0,
                    "time": 1637740800000,
                    "values": [
                        345
                    ]
                },
                {
                    "duration": 3600000,
                    "oid": 0,
                    "time": 1637744400000,
                    "values": [
                        178
                    ]
                },
                {
                    "duration": 3600000,
                    "oid": 0,
                    "time": 1637751600000,
                    "values": [
                        744
                    ]
                }
            ],
            "until": 1676883600000
        }
    }
}

Human Readable Output

Metrics Found:

Cycle 30 sec
Node Id 0
Clock 1676873250000
From Time 1676871390000
Until Time 1676871990000
Stats {‘oid’: 0, ‘time’: 1637740800000, ‘duration’: 30000, ‘values’: [4]},
{‘oid’: 0, ‘time’: 1676871420000, ‘duration’: 30000, ‘values’: [9]},
{‘oid’: 0, ‘time’: 1676871450000, ‘duration’: 30000, ‘values’: [4]},

extrahop-detections-list

Get detections from ExtraHop Reveal(x).

Base Command

extrahop-detections-list

Input

Argument Name Description Required
filter Detection-specific filters.
For eg:
{
“categories”: [“sec.attack”],
“risk_score_min”: 51
}

If the categories and category are not specified, then categories will be set to [“sec.attack”]. The category field is deprecated by the API, so please use the categories field instead.
Refer to the ExtraHop REST API guide at https://docs.extrahop.com/current/rest-api-guide/.		 Optional
from Returns detections that occurred after the specified date, expressed in milliseconds since the epoch. Detections that started before the specified date are returned if the detection was ongoing at that time.

For eg:
from=1673508360001.		 Optional
limit Returns no more than the specified number of detections.

For eg:
limit=10. Default is 200.		 Optional
offset The number of detections to skip for pagination.

For eg:
offset=100.		 Optional
sort Sorts returned detections by the specified fields.
Comma separated “field” “direction” is the accepted format.
By default, detections are sorted by most recent update time and then id in ascending order.

For eg:
sort=”end_time asc,id desc”.		 Optional
until Return detections that ended before the specified date, expressed in milliseconds since the epoch.

For eg:
until=1673509360001.		 Optional
mod_time Return detections that were modified on or after the specified date, expressed in milliseconds since the epoch.

For eg: 1675416916102 .		 Optional

Context Output

Path Type Description
ExtraHop.Detections.id Number The unique detection ID of the detection.
ExtraHop.Detections.start_time Number The timestamp when the detection was identified.
ExtraHop.Detections.mod_time Number The timestamp when the detection was last modified.
ExtraHop.Detections.end_time Number The timestamp when the detection was completed.
ExtraHop.Detections.title String The title of the detection.
ExtraHop.Detections.description String The description of the event for which the detection was created.
ExtraHop.Detections.categories Unknown The categories associated with the detection.
ExtraHop.Detections.risk_score Number The risk level of the event.
ExtraHop.Detections.type String The detection type.
ExtraHop.Detections.properties Unknown The detection properties.
ExtraHop.Detections.participants Unknown The participants involved in the event.
ExtraHop.Detections.ticket_id String The unique ticket ID for the detection that is being tracked.
ExtraHop.Detections.assignee String The user assigned to the detection.
ExtraHop.Detections.status String The status of the detection.
ExtraHop.Detections.resolution String The resolution status of the detection.
ExtraHop.Detections.mitre_tactics Unknown The MITRE tactics associated with the attack.
ExtraHop.Detections.mitre_techniques Unknown The MITRE techniques associated with the attack.
ExtraHop.Detections.appliance_id Number The unique identifier of the sensor on which the attack was detected.
ExtraHop.Detections.is_user_created Boolean Indicates whether the detection is user-created.

Command example

!extrahop-detections-list limit=3

Context Example

{
    "ExtraHop": {
        "Detections": [
            {
                "appliance_id": 0,
                "categories": [
                    "sec",
                    "sec.exploit"
                ],
                "description": "The offender was recently observed carrying out a TCP SYN Scan and has now made a successful TCP 3-way handshake to the victim device. Investigate to determine if this is the result of the SYN Scan.",
                "end_time": 1676895361452,
                "id": 1110161,
                "is_user_created": true,
                "participants": [
                    {
                        "external": false,
                        "id": 2187135,
                        "object_type": "ipaddr",
                        "object_value": "0.0.0.0",
                        "role": "offender"
                    },
                    {
                        "external": true,
                        "id": 2187136,
                        "object_type": "ipaddr",
                        "object_value": "0.0.0.2",
                        "role": "victim"
                    }
                ],
                "risk_score": 50,
                "start_time": 1676895361452,
                "title": "Test_Detection_1_1676895361452",
                "type": "Test_Detection_1_1676895361452",
                "mod_time": 1676895361452
            },
            {
                "appliance_id": 0,
                "categories": [
                    "sec",
                    "sec.exploit"
                ],
                "description": "The offender was recently observed carrying out a TCP SYN Scan and has now made a successful TCP 3-way handshake to the victim device. Investigate to determine if this is the result of the SYN Scan.",
                "end_time": 1676895331451,
                "id": 1110160,
                "is_user_created": true,
                "participants": [
                    {
                        "external": false,
                        "id": 2187133,
                        "object_type": "ipaddr",
                        "object_value": "0.0.0.0",
                        "role": "offender"
                    },
                    {
                        "external": true,
                        "id": 2187134,
                        "object_type": "ipaddr",
                        "object_value": "0.0.0.2",
                        "role": "victim"
                    }
                ],
                "risk_score": 50,
                "start_time": 1676895331451,
                "title": "Test_Detection_1_1676895331451",
                "type": "Test_Detection_1_1676895331451",
                "mod_time": 1676895331451
            },
            {
                "appliance_id": 0,
                "categories": [
                    "sec",
                    "sec.exploit"
                ],
                "description": "The offender was recently observed carrying out a TCP SYN Scan and has now made a successful TCP 3-way handshake to the victim device. Investigate to determine if this is the result of the SYN Scan.",
                "end_time": 1676895301451,
                "id": 1110159,
                "is_user_created": true,
                "participants": [
                    {
                        "external": false,
                        "id": 2187131,
                        "object_type": "ipaddr",
                        "object_value": "0.0.0.0",
                        "role": "offender"
                    },
                    {
                        "external": true,
                        "id": 2187132,
                        "object_type": "ipaddr",
                        "object_value": "0.0.0.2",
                        "role": "victim"
                    }
                ],
                "risk_score": 50,
                "start_time": 1676895301451,
                "title": "Test_Detection_1_1676895301451",
                "type": "Test_Detection_1_1676895301451",
                "mod_time": 1676895301451
            }
        ]
    }
}

Human Readable Output

Found 3 Detection(s)

Detection ID Risk Score Description Categories Start Time
1110161 50 The offender was recently observed carrying out a TCP SYN Scan and has now made a successful TCP 3-way handshake to the victim device. Investigate to determine if this is the result of the SYN Scan. sec,
sec.exploit		 1676895361452
1110160 50 The offender was recently observed carrying out a TCP SYN Scan and has now made a successful TCP 3-way handshake to the victim device. Investigate to determine if this is the result of the SYN Scan. sec,
sec.exploit		 1676895331451
1110159 50 The offender was recently observed carrying out a TCP SYN Scan and has now made a successful TCP 3-way handshake to the victim device. Investigate to determine if this is the result of the SYN Scan. sec,
sec.exploit		 1676895301451

Additional Information

ExtraHop Reveal(x) Playbooks

  • ExtraHop - Default
  • ExtraHop - CVE-2019-0708 (BlueKeep)
  • ExtraHop - Ticket Tracking
  • ExtraHop - Get Peers by Host

Use Cases

  • Create incidents for every detection that ExtraHop Reveal(x) surfaces in real-time.
  • Enable guided investigation and response through playbooks and automation scripts.
  • Query the ExtraHop Reveal(x) REST API using the simple and powerful Cortex XSOAR CLI.

Configuration parameters

  • isFetch — Fetch incidents
  • incidentType — Incident type
  • incidentFetchInterval — Incidents Fetch Interval
  • on_cloud — On Cloud
  • url — URL (required)
  • apikey — API Key
  • client_id — Client ID
  • client_secret — Client Secret
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • first_fetch — First fetch time
  • max_fetch — How many incidents to fetch each time
  • advanced_filter — Advanced Filter

Commands (30)

  • extrahop-activity-map-get

    Get a link to a live activity map in ExtraHop Reveal(x).

  • extrahop-alert-rule-create

    Create a new alert rule in ExtraHop Reveal(x).

  • extrahop-alert-rule-edit

    Modify an alert rule in ExtraHop Reveal(x).

  • extrahop-alert-rules-get

    Get all alert rules from ExtraHop Reveal(x).

  • extrahop-create-alert Deprecated

    Use extrahop-alert-rule-create instead. Create a new alert rule in Reveal(x).

  • extrahop-create-alert-rule Deprecated

    Use extrahop-alert-rule-create instead. Create a new alert rule in Reveal(x).

  • extrahop-detections-list

    Get detections from ExtraHop Reveal(x).

  • extrahop-device-search Deprecated

    Use extrahop-devices-search instead. Search for devices in Reveal(x).

  • extrahop-devices-search

    Search for devices in ExtraHop Reveal(x).

  • extrahop-devices-tag

    Add or remove a tag from devices in ExtraHop Reveal(x).

  • extrahop-edit-alert Deprecated

    Use extrahop-alert-rule-edit instead. Modify an alert rule in Reveal(x).

  • extrahop-edit-alert-rule Deprecated

    Use extrahop-alert-rule-edit instead. Modify an alert rule in Reveal(x).

  • extrahop-edit-watchlist Deprecated

    Use extrahop-watchlist-edit instead. Add or remove devices from the watchlist in Reveal(x).

  • extrahop-get-activity-map Deprecated

    Use extrahop-activity-map-get instead. Get a link to a live activity map in Reveal(x).

  • extrahop-get-alert-rules Deprecated

    Use extrahop-alert-rules-get instead. Get all alert rules from Reveal(x).

  • extrahop-get-alerts Deprecated

    Use extrahop-alert-rules-get instead. Get all alert rules from Reveal(x).

  • extrahop-get-peers Deprecated

    Use extrahop-peers-get instead. Get all peers for a device from Reveal(x).

  • extrahop-get-protocols Deprecated

    Use extrahop-protocols-get instead. Get all active network protocols for a device from Reveal(x).

  • extrahop-get-watchlist Deprecated

    Use extrahop-watchlist-get instead. Get all devices on the watchlist in Reveal(x).

  • extrahop-metrics-list

    Get metrics for specified objects from ExtraHop Reveal(x).

  • extrahop-packets-search

    Search for specific packets in ExtraHop Reveal(x).

  • extrahop-peers-get

    Get all peers for a device from ExtraHop Reveal(x).

  • extrahop-protocols-get

    Get all active network protocols for a device from ExtraHop Reveal(x).

  • extrahop-query-records Deprecated

    No available replacement. Query records from Reveal(x).

  • extrahop-search-packets Deprecated

    Use extrahop-packets-search instead. Search for specific packets in Reveal(x).

  • extrahop-tag-devices Deprecated

    Use extrahop-devices-tag instead. Add or remove a tag from devices in Reveal(x).

  • extrahop-ticket-track

    Link an ExtraHop Reveal(x) detection to a Cortex XSOAR incident.

  • extrahop-track-ticket Deprecated

    Use extrahop-ticket-track instead. Link a Reveal(x) detection to a Demisto Investigation.

  • extrahop-watchlist-edit

    Add or remove devices from the advanced analysis watchlist in ExtraHop Reveal(x).

  • extrahop-watchlist-get

    Get all devices on the advanced analysis watchlist in ExtraHop Reveal(x).

Source

ExtraHop_v2.py ExtraHop_v2_test.py ExtraHop_v2.yml ExtraHop_v2_description.md
Download History Raw 
category: Network Security
provider: Bain Capital Private Equity
commonfields:
  id: ExtraHop v2
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
  supportedModules:
  - agentix
  - xsiam
- additionalinfo: Select if the instance connects to an ExtraHop Reveal(x) 360 system. Leave unselected if connecting to ExtraHop Reveal(x) Enterprise. Default value is false.
  display: On Cloud
  name: on_cloud
  type: 8
  required: false
  section: Connect
- additionalinfo: The URL of the ExtraHop system this instance will connect to.
  display: URL
  name: url
  required: true
  type: 0
  section: Connect
- additionalinfo: The API key required for authentication if connecting to ExtraHop Reveal(x) Enterprise.
  display: API Key
  name: apikey
  type: 4
  required: false
  section: Connect
- additionalinfo: The client ID generated on your ExtraHop system that is required for authentication if connecting to ExtraHop Reveal(x) 360.
  display: Client ID
  name: client_id
  type: 0
  required: false
  section: Connect
- additionalinfo: The client secret generated on your ExtraHop system that is required for authentication if connecting to ExtraHop Reveal(x) 360.
  display: Client Secret
  name: client_secret
  type: 4
  required: false
  section: Connect
- defaultvalue: 'false'
  display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- defaultvalue: 'false'
  display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- additionalinfo: |-
    The UTC date or relative timestamp from where to start fetching incidents.

    Supported formats: N minutes, N hours, N days, N weeks, N months, N years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ

    For example: 10 minutes, 5 hours, 8 days, 2 weeks, 8 months, 2021-12-31, 01 Mar 2021, 01 Feb 2021 04:45:33, 2022-04-17T14:05:44Z
  defaultvalue: 3 days
  display: First fetch time
  name: first_fetch
  type: 0
  required: false
  section: Collect
- defaultvalue: '200'
  display: How many incidents to fetch each time
  hidden: true
  name: max_fetch
  type: 0
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- additionalinfo: |-
    Applies a filter to the list of detections based on a JSON-specific query.

    Example for detections:
    {
      "categories": ["sec.attack"],
      "risk_score_min": 51
    }

    If the categories and category are not specified, then categories will be set to ["sec.attack"]. The category field is deprecated by the API, so please use the categories field instead.
    For a complete reference to the Extrahop detections filter fields, please refer to the ExtraHop REST API documentation at
    https://docs.extrahop.com/current/rest-api-guide/
  display: Advanced Filter
  name: advanced_filter
  type: 12
  required: false
  section: Collect
description: ExtraHop Reveal(x) for Cortex XSOAR is a network detection and response solution that provides complete visibility of network communications at enterprise scale, real-time threat detections backed by machine learning, and guided investigation workflows that simplify response.
display: ExtraHop Reveal(x)
name: ExtraHop v2
script:
  commands:
  - description: Get all devices on the advanced analysis watchlist in ExtraHop Reveal(x).
    name: extrahop-watchlist-get
    outputs:
    - contextPath: ExtraHop.Device.Macaddr
      description: The MAC address of the device.
      type: String
    - contextPath: ExtraHop.Device.DeviceClass
      description: The class of this device.
      type: String
    - contextPath: ExtraHop.Device.UserModTime
      description: The time of the most recent update, expressed in milliseconds since the epoch.
      type: Number
    - contextPath: ExtraHop.Device.AutoRole
      description: The role automatically detected by the ExtraHop system.
      type: String
    - contextPath: ExtraHop.Device.ParentId
      description: The ID of the parent device.
      type: Number
    - contextPath: ExtraHop.Device.Vendor
      description: The device vendor.
      type: String
    - contextPath: ExtraHop.Device.Analysis
      description: The level of analysis received by the device.
      type: string
    - contextPath: ExtraHop.Device.DiscoveryId
      description: The UUID for this device.
      type: String
    - contextPath: ExtraHop.Device.DefaultName
      description: The default name for this device.
      type: String
    - contextPath: ExtraHop.Device.DisplayName
      description: The display name of device.
      type: String
    - contextPath: ExtraHop.Device.OnWatchlist
      description: Whether the device is on the advanced analysis watch list.
      type: Boolean
    - contextPath: ExtraHop.Device.ModTime
      description: The time of the most recent update, expressed in milliseconds since the epoch.
      type: Number
    - contextPath: ExtraHop.Device.IsL3
      description: Indicates whether the device is a layer 3 device.
      type: Boolean
    - contextPath: ExtraHop.Device.Role
      description: The role of the device.
      type: String
    - contextPath: ExtraHop.Device.DiscoverTime
      description: The time that the device was discovered.
      type: Number
    - contextPath: ExtraHop.Device.Id
      description: The ID of the device.
      type: Number
    - contextPath: ExtraHop.Device.Ipaddr4
      description: The IPv4 address for this device.
      type: String
    - contextPath: ExtraHop.Device.Vlanid
      description: The unique identifier for the VLAN associated with this device.
      type: Number
    - contextPath: ExtraHop.Device.Ipaddr6
      description: The IPv6 address of the device.
      type: string
    - contextPath: ExtraHop.Device.NodeId
      description: The Node ID of the Discover appliance.
      type: number
    - contextPath: ExtraHop.Device.Description
      description: A user customizable description of the device.
      type: string
    - contextPath: ExtraHop.Device.DnsName
      description: The DNS name associated with the device.
      type: string
    - contextPath: ExtraHop.Device.DhcpName
      description: The DHCP name associated with the device.
      type: string
    - contextPath: ExtraHop.Device.CdpName
      description: The Cisco Discovery Protocol name associated with the device.
      type: string
    - contextPath: ExtraHop.Device.NetbiosName
      description: The NetBIOS name associated with the device.
      type: string
    - contextPath: ExtraHop.Device.Url
      description: Link to the device details page in ExtraHop.
      type: string
  - arguments:
    - description: The IP address or ExtraHop API ID of the source device to get peer devices.
      name: ip_or_id
      required: true
    - defaultValue: -30m
      description: 'The beginning timestamp of the time range the query will search, expressed in milliseconds since the epoch. A negative value is evaluated relative to the current time. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. See https://docs.extrahop.com/current/rest-api-guide/#supported-time-units- for more details on supported time units and suffixes.'
      name: query_from
    - description: 'The ending timestamp of the time range the query will search, expressed in milliseconds since the epoch. 0 indicates the time of the request. A negative value is evaluated relative to the current time. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. See https://docs.extrahop.com/current/rest-api-guide/#supported-time-units- for more details on supported time units and suffixes.'
      name: query_until
    - auto: PREDEFINED
      defaultValue: any
      description: The role of the peer device in relation to the origin device.
      name: peer_role
      predefined:
      - any
      - client
      - server
    - auto: PREDEFINED
      defaultValue: any
      description: A filter to only return peers that the source device has communicated with over this protocol. If no value is set, the object includes any protocol.
      name: protocol
      predefined:
      - any
      - AAA
      - ActiveMQ
      - AJP
      - amf
      - CIFS
      - DB
      - DHCP
      - DICOM
      - DNS
      - FIX
      - FTP
      - HL7
      - HTTP
      - IBMMQ
      - ICA
      - IKE/ISAKMP
      - IMAP
      - IPFIX
      - IPsec NAT-T
      - IRC
      - iSCSI
      - Kerberos
      - L2TP
      - LDAP
      - lync-compress
      - memcache
      - Modbus
      - MongoDB
      - MSMQ
      - MSN
      - MSRPC
      - NetFlow
      - NFS
      - NTP
      - OpenVPN
      - PCoIP
      - Perforce
      - POP3
      - RDP
      - Redis
      - RFB
      - RTCP
      - RTP
      - sFlow
      - SIP
      - SMPP
      - SMTP
      - SNMP
      - SSH
      - SSL
      - Syslog
      - TCP
      - telnet
      - UDP
      - WebSocket
    description: Get all peers for a device from ExtraHop Reveal(x).
    name: extrahop-peers-get
    outputs:
    - contextPath: ExtraHop.Device.Macaddr
      description: The MAC address of the device.
      type: String
    - contextPath: ExtraHop.Device.DeviceClass
      description: The class of this device.
      type: String
    - contextPath: ExtraHop.Device.UserModTime
      description: The time of the most recent update, expressed in milliseconds since the epoch.
      type: Number
    - contextPath: ExtraHop.Device.AutoRole
      description: The role automatically detected by the ExtraHop system.
      type: String
    - contextPath: ExtraHop.Device.ParentId
      description: The ID of the parent device.
      type: Number
    - contextPath: ExtraHop.Device.Vendor
      description: The device vendor.
      type: String
    - contextPath: ExtraHop.Device.Analysis
      description: The level of analysis received by the device.
      type: string
    - contextPath: ExtraHop.Device.DiscoveryId
      description: The UUID of the device.
      type: String
    - contextPath: ExtraHop.Device.DefaultName
      description: The default name for this device.
      type: String
    - contextPath: ExtraHop.Device.DisplayName
      description: The display name of device.
      type: String
    - contextPath: ExtraHop.Device.OnWatchlist
      description: Whether the device is on the advanced analysis watch list.
      type: Boolean
    - contextPath: ExtraHop.Device.ModTime
      description: The time of the most recent update, expressed in milliseconds since the epoch.
      type: Number
    - contextPath: ExtraHop.Device.IsL3
      description: Indicates whether the device is a layer 3 device.
      type: Boolean
    - contextPath: ExtraHop.Device.Role
      description: The role of the device.
      type: String
    - contextPath: ExtraHop.Device.DiscoverTime
      description: The time that the device was discovered.
      type: Number
    - contextPath: ExtraHop.Device.Id
      description: The ID of the device.
      type: Number
    - contextPath: ExtraHop.Device.Ipaddr4
      description: The IPv4 address for this device.
      type: String
    - contextPath: ExtraHop.Device.Vlanid
      description: The unique identifier for the VLAN associated with this device.
      type: Number
    - contextPath: ExtraHop.Device.Ipaddr6
      description: The IPv6 address of the device.
      type: string
    - contextPath: ExtraHop.Device.NodeId
      description: The node ID of the sensor associated with this device.
      type: number
    - contextPath: ExtraHop.Device.Description
      description: A user customizable description of the device.
      type: string
    - contextPath: ExtraHop.Device.DnsName
      description: The DNS name associated with the device.
      type: string
    - contextPath: ExtraHop.Device.DhcpName
      description: The DHCP name associated with the device.
      type: string
    - contextPath: ExtraHop.Device.CdpName
      description: The Cisco Discovery Protocol name associated with the device.
      type: string
    - contextPath: ExtraHop.Device.NetbiosName
      description: The NetBIOS name associated with the device.
      type: string
    - contextPath: ExtraHop.Device.Url
      description: Link to the device details page in ExtraHop Reveal(x).
      type: string
  - arguments:
    - description: The name of the device. This searches for matches on all ExtraHop name fields (DHCP, DNS, NetBIOS, Cisco Discovery Protocol, etc).
      name: name
    - description: The IP address of the device.
      name: ip
    - description: The MAC address of the device.
      name: mac
    - auto: PREDEFINED
      description: The role of the device.
      name: role
      predefined:
      - db_server
      - dhcp_server
      - dns_server
      - file_server
      - firewall
      - gateway
      - http_server
      - domain_controller
      - web_proxy
      - load_balancer
      - pc
      - medical_device
      - mobile_device
      - printer
      - scanner
      - custom
      - voip_phone
      - other
    - auto: PREDEFINED
      description: The OS of the device.
      name: software
      predefined:
      - android
      - apple_ios
      - arista_eos
      - cisco_ios
      - cisco_nx-os
      - chrome_os
      - linux
      - mac_os
      - windows
      - windows_server
      - windows_server_2008
      - windows_server_2008_r2
      - windows_server_2012
      - windows_server_2012_r2
      - windows_server_2016
      - windows_vista
      - windows_7
      - windows_8
      - windows_8.1
      - windows_10
    - description: A tag present on the device.
      name: tag
    - auto: PREDEFINED
      description: The vendor of the device, based on MAC address via OUI lookup.
      name: vendor
      predefined:
      - alcatel-lucent
      - apple
      - arista
      - asus
      - brother
      - canon
      - cisco
      - cisco-linksys
      - citrix
      - dell
      - dellemc
      - d-link
      - emc
      - f5
      - google
      - hp
      - htc
      - huawei
      - ibm
      - juniper
      - kyocera
      - microsoft
      - netapp
      - netgear
      - nokia
      - nortel
      - oracle
      - paloalto
      - samsung
      - 3com
      - toshiba
      - virtualbox
      - vmware
      - zte
    - description: 'The time that device was first seen by ExtraHop, expressed in milliseconds since the epoch. A negative value is evaluated relative to the current time. The default unit for a negative value is milliseconds, but other units can be specified with the following unit suffixes: ms, s, m, h, d, w, M, y. For example, to look one day back enter -1d or -24h. See https://docs.extrahop.com/current/rest-api-guide/#supported-time-units- for more details on supported time units and suffixes.'
      name: discover_time
    - description: The VLAN ID of the Virtual LAN that the device is on.
      name: vlan
    - auto: PREDEFINED
      description: The activity of the device.
      name: activity
      predefined:
      - aaa_client
      - aaa_server
      - ajp_client
      - ajp_server
      - amf_client
      - amf_server
      - cifs_client
      - cifs_server
      - db_client
      - db_server
      - dhcp_client
      - dhcp_server
      - dicom_client
      - dicom_server
      - dns_client
      - dns_server
      - fix_client
      - fix_server
      - ftp_client
      - ftp_server
      - hl7_client
      - hl7_server
      - http_client
      - http_server
      - ibmmq_client
      - ibmmq_server
      - ica_client
      - ica_server
      - icmp
      - iscsi_client
      - iscsi_server
      - kerberos_client
      - kerberos_server
      - ldap_client
      - ldap_server
      - llmnr_client
      - llmnr_server
      - memcache_client
      - memcache_server
      - modbus_client
      - modbus_server
      - mongo_client
      - mongo_server
      - msmq
      - nbns_client
      - nbns_server
      - nfs_client
      - nfs_server
      - pcoip_client
      - pcoip_server
      - pop3_client
      - pop3_server
      - rdp_client
      - rdp_server
      - redis_client
      - redis_server
      - rfb_client
      - rfb_server
      - rpc_client
      - rpc_server
      - rtcp
      - rtp
      - scanner
      - sip_client
      - sip_server
      - smpp_client
      - smpp_server
      - smtp_client
      - smtp_server
      - ssh_client
      - ssh_server
      - ssl_client
      - ssl_server
      - tcp
      - telnet_client
      - telnet_server
      - udp
      - websocket_client
      - websocket_server
      - wsman_client
      - wsman_server
    - auto: PREDEFINED
      defaultValue: '='
      description: The compare method applied when matching the fields against their values. For example, to find devices with names that begin with 'SEA1' (set name=SEA1, operator=startswith).
      name: operator
      predefined:
      - '>'
      - '<'
      - '<='
      - '>='
      - '='
      - '!='
      - startswith
      - exists
      - not_exists
      - '~'
      - '!~'
    - auto: PREDEFINED
      defaultValue: and
      description: The match operator to use when chaining the search fields together. For example, to find all HTTP servers running Windows on the network (set match_type=and, role=http_server, software=windows).
      name: match_type
      predefined:
      - and
      - or
      - not
    - description: 'The beginning timestamp for the request. Return only devices active after this time. Time is expressed in milliseconds since the epoch. 0 indicates the time of the request. A negative value is evaluated relative to the current time. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. See https://docs.extrahop.com/current/rest-api-guide/#supported-time-units- for more details on supported time units and suffixes.'
      name: active_from
    - description: 'The ending timestamp for the request. Return only devices active before this time. Time is expressed in milliseconds since the epoch. 0 indicates the time of the request. A negative value is evaluated relative to the current time. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. See https://docs.extrahop.com/current/rest-api-guide/#supported-time-units- for more details on supported time units and suffixes.'
      name: active_until
    - defaultValue: '10'
      description: The maximum number of devices to return.
      name: limit
    - auto: PREDEFINED
      defaultValue: 'true'
      description: Only returns layer 3 devices by filtering out any layer 2 parent devices.
      name: l3_only
      predefined:
      - 'true'
      - 'false'
    description: Search for devices in ExtraHop Reveal(x).
    name: extrahop-devices-search
    outputs:
    - contextPath: ExtraHop.Device.Macaddr
      description: The MAC address of the device.
      type: String
    - contextPath: ExtraHop.Device.DeviceClass
      description: The class of the device.
      type: String
    - contextPath: ExtraHop.Device.UserModTime
      description: The time of the most recent update, expressed in milliseconds since the epoch.
      type: Number
    - contextPath: ExtraHop.Device.AutoRole
      description: The role automatically detected by the ExtraHop.
      type: String
    - contextPath: ExtraHop.Device.ParentId
      description: The ID of the parent device.
      type: Number
    - contextPath: ExtraHop.Device.Vendor
      description: The device vendor.
      type: String
    - contextPath: ExtraHop.Device.Analysis
      description: The level of analysis received by the device.
      type: string
    - contextPath: ExtraHop.Device.DiscoveryId
      description: The UUID of the device.
      type: String
    - contextPath: ExtraHop.Device.DefaultName
      description: The default name of the device.
      type: String
    - contextPath: ExtraHop.Device.DisplayName
      description: The display name of device.
      type: String
    - contextPath: ExtraHop.Device.OnWatchlist
      description: Whether the device is on the advanced analysis watch list.
      type: Boolean
    - contextPath: ExtraHop.Device.ModTime
      description: The time of the most recent update, expressed in milliseconds since the epoch.
      type: Number
    - contextPath: ExtraHop.Device.IsL3
      description: Indicates whether the device is a layer 3 device.
      type: Boolean
    - contextPath: ExtraHop.Device.Role
      description: The role of the device.
      type: String
    - contextPath: ExtraHop.Device.DiscoverTime
      description: The time that the device was discovered.
      type: Number
    - contextPath: ExtraHop.Device.Id
      description: The ID of the device.
      type: Number
    - contextPath: ExtraHop.Device.Ipaddr4
      description: The IPv4 address of the device.
      type: String
    - contextPath: ExtraHop.Device.Vlanid
      description: The ID of the VLAN associated with the device.
      type: Number
    - contextPath: ExtraHop.Device.Ipaddr6
      description: The IPv6 address of the device.
      type: String
    - contextPath: ExtraHop.Device.NodeId
      description: The node ID of the sensor associated with the device..
      type: Number
    - contextPath: ExtraHop.Device.Description
      description: A user customizable description of the device.
      type: String
    - contextPath: ExtraHop.Device.DnsName
      description: The DNS name associated with the device.
      type: String
    - contextPath: ExtraHop.Device.DhcpName
      description: The DHCP name associated with the device.
      type: String
    - contextPath: ExtraHop.Device.CdpName
      description: The Cisco Discovery Protocol name associated with the device.
      type: String
    - contextPath: ExtraHop.Device.NetbiosName
      description: The NetBIOS name associated with the device.
      type: String
    - contextPath: ExtraHop.Device.Url
      description: Link to the device details page in ExtraHop Reveal(x).
      type: String
  - arguments:
    - description: The IP address or ExtraHop API ID of the device to get all active network protocols.
      name: ip_or_id
      required: true
    - defaultValue: -30m
      description: 'The beginning timestamp of the time range the query will search, expressed in milliseconds since the epoch. A negative value is evaluated relative to the current time. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. See https://docs.extrahop.com/current/rest-api-guide/#supported-time-units- for more details on supported time units and suffixes.'
      name: query_from
    - description: 'The ending timestamp of the time range the query will search, expressed in milliseconds since the epoch. 0 indicates the time of the request. A negative value is evaluated relative to the current time. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. See https://docs.extrahop.com/current/rest-api-guide/#supported-time-units- for more details on supported time units and suffixes.'
      name: query_until
    description: Get all active network protocols for a device from ExtraHop Reveal(x).
    name: extrahop-protocols-get
    outputs:
    - contextPath: ExtraHop.Device.Macaddr
      description: The MAC address of the device.
      type: String
    - contextPath: ExtraHop.Device.DeviceClass
      description: The class of the device.
      type: String
    - contextPath: ExtraHop.Device.UserModTime
      description: The time of the most recent update, expressed in milliseconds since the epoch.
      type: Number
    - contextPath: ExtraHop.Device.AutoRole
      description: The role automatically detected by the ExtraHop system.
      type: String
    - contextPath: ExtraHop.Device.ParentId
      description: The ID of the parent device.
      type: Number
    - contextPath: ExtraHop.Device.Vendor
      description: The device vendor.
      type: String
    - contextPath: ExtraHop.Device.Analysis
      description: The level of analysis received by the device.
      type: String
    - contextPath: ExtraHop.Device.DiscoveryId
      description: The UUID of the device.
      type: String
    - contextPath: ExtraHop.Device.DefaultName
      description: The default name of the device.
      type: String
    - contextPath: ExtraHop.Device.DisplayName
      description: The display name of device.
      type: String
    - contextPath: ExtraHop.Device.OnWatchlist
      description: Whether the device is on the advanced analysis watch list.
      type: Boolean
    - contextPath: ExtraHop.Device.ModTime
      description: The time of the most recent update, expressed in milliseconds since the epoch.
      type: Number
    - contextPath: ExtraHop.Device.IsL3
      description: Indicates whether the device is a layer 3 device.
      type: Boolean
    - contextPath: ExtraHop.Device.Role
      description: The role of the device.
      type: String
    - contextPath: ExtraHop.Device.DiscoverTime
      description: The time that the device was discovered.
      type: Number
    - contextPath: ExtraHop.Device.Id
      description: The ID of the device.
      type: Number
    - contextPath: ExtraHop.Device.Ipaddr4
      description: The IPv4 address of the device.
      type: String
    - contextPath: ExtraHop.Device.Vlanid
      description: The ID of the VLAN associated with the device.
      type: Number
    - contextPath: ExtraHop.Device.Ipaddr6
      description: The IPv6 address of the device.
      type: String
    - contextPath: ExtraHop.Device.NodeId
      description: The node ID of the sensor associated with the device..
      type: Number
    - contextPath: ExtraHop.Device.Description
      description: A user customizable description of the device.
      type: String
    - contextPath: ExtraHop.Device.DnsName
      description: The DNS name associated with the device.
      type: String
    - contextPath: ExtraHop.Device.DhcpName
      description: The DHCP name associated with the device.
      type: String
    - contextPath: ExtraHop.Device.CdpName
      description: The Cisco Discovery Protocol name associated with the device.
      type: String
    - contextPath: ExtraHop.Device.NetbiosName
      description: The NetBIOS name associated with the device.
      type: String
    - contextPath: ExtraHop.Device.Url
      description: Link to the device details page in ExtraHop Reveal(x).
      type: String
    - contextPath: ExtraHop.Device.ClientProtocols
      description: The list of protocols the peer device is communicating on as a client.
      type: String
    - contextPath: ExtraHop.Device.ServerProtocols
      description: The list of protocols the peer device is communicating on as a server.
      type: String
  - arguments:
    - description: The IP address or ExtraHop API ID of the source device to get an activity map.
      name: ip_or_id
      required: true
    - auto: PREDEFINED
      defaultValue: 30 minutes
      description: The time interval of the live activity map, expressed as the "Last" 30 minutes. For example, specify a value of 30 minutes to get an activity map showing the time range of the last 30 minutes. This field is ignored if from_time and until_time are provided.
      name: time_interval
      predefined:
      - 30 minutes
      - 6 hours
      - 1 day
      - 1 week
    - description: The beginning timestamp of a fixed time range the activity map will display, expressed in seconds since the epoch.
      name: from_time
    - description: The ending timestamp of a fixed time range the activity map will display, expressed in seconds since the epoch.
      name: until_time
    - auto: PREDEFINED
      defaultValue: any
      description: The role of the peer devices in relation to the source device. For example, specifying a peer_role of client will show All Clients communicating with the source device. Additionally specifying a protocol of HTTP will result in further filtering and only showing HTTP Clients communicating with the source device.
      name: peer_role
      predefined:
      - any
      - client
      - server
    - auto: PREDEFINED
      defaultValue: any
      description: The protocol over which the source device is communicating. For example, specifying a protocol of HTTP show only HTTP Clients and HTTP Servers communicating with the source device. Additionally specifying a peer_role of client will result in further filtering and only showing HTTP Clients communicating with the source device.
      name: protocol
      predefined:
      - any
      - AAA
      - ActiveMQ
      - AJP
      - amf
      - CIFS
      - DB
      - DHCP
      - DICOM
      - DNS
      - FIX
      - FTP
      - HL7
      - HTTP
      - IBMMQ
      - ICA
      - IKE/ISAKMP
      - IMAP
      - IPFIX
      - IPsec NAT-T
      - IRC
      - iSCSI
      - Kerberos
      - L2TP
      - LDAP
      - lync-compress
      - memcache
      - Modbus
      - MongoDB
      - MSMQ
      - MSN
      - MSRPC
      - NetFlow
      - NFS
      - NTP
      - OpenVPN
      - PCoIP
      - Perforce
      - POP3
      - RDP
      - Redis
      - RFB
      - RTCP
      - RTP
      - sFlow
      - SIP
      - SMPP
      - SMTP
      - SNMP
      - SSH
      - SSL
      - Syslog
      - TCP
      - telnet
      - UDP
      - WebSocket
    description: Get a link to a live activity map in ExtraHop Reveal(x).
    name: extrahop-activity-map-get
    outputs:
    - contextPath: ExtraHop.ActivityMap.url
      description: The link to a visual activity map in ExtraHop.
      type: String
  - description: Get all alert rules from ExtraHop Reveal(x).
    name: extrahop-alert-rules-get
    outputs:
    - contextPath: ExtraHop.Alert.Operator
      description: The logical operator applied when comparing the value of the operand field to alert conditions.
      type: String
    - contextPath: ExtraHop.Alert.FieldName
      description: The name of the monitored metric.
      type: String
    - contextPath: ExtraHop.Alert.NotifySnmp
      description: Indicates whether to send an SNMP trap when an alert is generated.
      type: Boolean
    - contextPath: ExtraHop.Alert.Operand
      description: The value to compare against alert conditions.
      type: String
    - contextPath: ExtraHop.Alert.IntervalLength
      description: The length of the alert interval, expressed in seconds.
      type: Number
    - contextPath: ExtraHop.Alert.Author
      description: The name of the user that created the alert.
      type: String
    - contextPath: ExtraHop.Alert.Name
      description: The unique, friendly name for the alert.
      type: String
    - contextPath: ExtraHop.Alert.FieldName2
      description: The second monitored metric when applying a ratio.
      type: String
    - contextPath: ExtraHop.Alert.RefireInterval
      description: The time interval in which alert conditions are monitored, expressed in seconds.
      type: Number
    - contextPath: ExtraHop.Alert.ModTime
      description: The time of the most recent update, expressed in milliseconds since the epoch.
      type: Number
    - contextPath: ExtraHop.Alert.Units
      description: The interval in which to evaluate the alert condition.
      type: String
    - contextPath: ExtraHop.Alert.ApplyAll
      description: Indicates whether the alert is assigned to all available data sources.
      type: Boolean
    - contextPath: ExtraHop.Alert.Type
      description: The type of alert.
      type: String
    - contextPath: ExtraHop.Alert.FieldOp
      description: The type of comparison between the "field_name" and "field_name2" fields when applying a ratio.
      type: String
    - contextPath: ExtraHop.Alert.Id
      description: The unique identifier for the alert.
      type: Number
    - contextPath: ExtraHop.Alert.Disabled
      description: Indicates whether the alert is disabled.
      type: Boolean
    - contextPath: ExtraHop.Alert.Description
      description: An optional description for the alert.
      type: String
    - contextPath: ExtraHop.Alert.Severity
      description: The severity level of the alert.
      type: Number
    - contextPath: ExtraHop.Alert.StatName
      description: The statistic name for the alert.
      type: String
  - arguments:
    - auto: PREDEFINED
      defaultValue: pcap
      description: The output format. A pcap file, A keylog.txt file that can be loaded in wireshark to decode ssl packets, or a zip file containing both a packets.pcap and keylog.txt.
      name: output
      predefined:
      - pcap
      - keylog_txt
      - zip
    - defaultValue: 10MB
      description: The maximum number of bytes to return.
      name: limit_bytes
    - defaultValue: 5m
      description: The maximum amount of time to run the packet search. The default unit is milliseconds, but other units can be specified with a unit suffix.
      name: limit_search_duration
    - defaultValue: -10m
      description: 'The beginning timestamp of the time range the search will include, expressed in milliseconds since the epoch. A negative value specifies that the search will begin with packets captured at a time in the past relative to the current time. For example, specify -10m to begin the search with packets captured 10 minutes before the time of the request. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. See https://docs.extrahop.com/current/rest-api-guide/#supported-time-units- for more details on supported time units and suffixes.'
      name: query_from
    - description: 'The ending timestamp of the time range the search will include, expressed in milliseconds since the epoch. A 0 value specifies that the search will end with packets captured at the time of the search. A negative value specifies that the search will end with packets captured at a time in the past relative to the current time. For example, specify -5m to end the search with packets captured 5 minutes before the time of the request. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. See https://docs.extrahop.com/current/rest-api-guide/#supported-time-units- for more details on supported time units and suffixes.'
      name: query_until
    - description: The Berkeley Packet Filter (BPF) syntax for the packet search.
      name: bpf
    - description: Returns packets sent to or received by the specified IP address.
      name: ip1
    - description: Returns packets sent from or received on the specified port.
      name: port1
    - description: Returns packets sent to or received by the specified IP address.
      name: ip2
    - description: Returns packets sent from or received on the specified port.
      name: port2
    description: Search for specific packets in ExtraHop Reveal(x).
    name: extrahop-packets-search
    outputs:
    - contextPath: File.Size
      description: The size of the file.
      type: Number
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.Name
      description: The name of the file.
      type: String
    - contextPath: File.SSDeep
      description: The SSDeep hash of the file.
      type: String
    - contextPath: File.EntryID
      description: The entry ID of the file.
      type: String
    - contextPath: File.Info
      description: File information.
      type: String
    - contextPath: File.Type
      description: The file type.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.Extension
      description: The file extension.
      type: String
  - arguments:
    - description: The case-sensitive value of the tag.
      name: tag
      required: true
    - description: The list of IP addresses or ExtraHop API IDs of the devices to tag, comma separated.
      isArray: true
      name: add
    - description: The list of IP addresses or ExtraHop API IDs of the devices to remove the tag from, comma separated.
      isArray: true
      name: remove
    description: Add or remove a tag from devices in ExtraHop Reveal(x).
    name: extrahop-devices-tag
  - arguments:
    - auto: PREDEFINED
      description: Indicates whether the alert is assigned to all available data sources.
      name: apply_all
      predefined:
      - 'true'
      - 'false'
      required: true
    - auto: PREDEFINED
      description: Indicates whether the alert is disabled.
      name: disabled
      predefined:
      - 'true'
      - 'false'
      required: true
    - description: The name of the monitored metric. Only applicable to threshold alerts.
      name: field_name
    - description: The second monitored metric when applying a ratio. Only applicable to threshold alerts.
      name: field_name2
    - auto: PREDEFINED
      description: The type of comparison between the field_name and field_name2 fields when applying a ratio. Only applicable to threshold alerts.
      name: field_op
      predefined:
      - /
      - 'null'
    - auto: PREDEFINED
      default: true
      defaultValue: '30'
      description: The length of the alert interval, expressed in seconds. Only applicable to threshold alerts.
      name: interval_length
      predefined:
      - '30'
      - '60'
      - '120'
      - '300'
      - '600'
      - '900'
      - '1200'
      - '1800'
    - description: The unique, friendly name for the alert.
      name: name
      required: true
    - auto: PREDEFINED
      description: Indicates whether to send an SNMP trap when an alert is generated.
      name: notify_snmp
      predefined:
      - 'true'
      - 'false'
      required: true
    - auto: PREDEFINED
      description: The type of metric source monitored by the alert configuration. Only applicable to detection alerts.
      name: object_type
      predefined:
      - application
      - device
    - description: The value to compare against alert conditions. The compare method is specified by the value of the operator field. Only applicable to threshold alerts.
      name: operand
    - auto: PREDEFINED
      description: The logical operator applied when comparing the value of the operand field to alert conditions. Only applicable to threshold alerts.
      name: operator
      predefined:
      - ==
      - '>'
      - <
      - '>='
      - <=
    - description: The first alert parameter, which is either a key pattern or a data point. Only applicable to threshold alerts.
      name: param
    - description: The second alert parameter, which is either a key pattern or a data point. Only applicable to threshold alerts.
      name: param2
    - description: The list of monitored protocols. Only applicable to detection alerts.
      isArray: true
      name: protocols
    - auto: PREDEFINED
      description: The time interval in which alert conditions are monitored, expressed in seconds.
      name: refire_interval
      predefined:
      - '300'
      - '600'
      - '900'
      - '1800'
      - '3600'
      - '7200'
      - '14400'
      required: true
    - auto: PREDEFINED
      description: The severity level of the alert, which is displayed in the Alert History, email notifications, and SNMP traps.
      name: severity
      predefined:
      - '0'
      - '1'
      - '2'
      - '3'
      - '4'
      - '5'
      - '6'
      - '7'
      required: true
    - description: The statistic name for the alert. Only applicable to threshold alerts.
      name: stat_name
    - auto: PREDEFINED
      description: The type of alert.
      name: type
      predefined:
      - detection
      - threshold
      required: true
    - auto: PREDEFINED
      description: The interval in which to evaluate the alert condition. Only applicable to threshold alerts.
      name: units
      predefined:
      - none
      - period
      - 1 sec
      - 1 min
      - 1 hr
    description: Create a new alert rule in ExtraHop Reveal(x).
    name: extrahop-alert-rule-create
  - arguments:
    - description: The ID of the Cortex XSOAR incident to track.
      name: incident_id
      required: true
    - description: The ID of the ExtraHop Reveal(x) detection to track.
      name: detection_id
      required: true
    - description: Owner of the incident.
      name: incident_owner
    - auto: PREDEFINED
      description: Status of the incident.
      name: incident_status
      predefined:
      - '0'
      - '1'
      - '2'
      - '3'
    - description: Reason the incident was closed.
      name: incident_close_reason
    description: Link an ExtraHop Reveal(x) detection to a Cortex XSOAR incident.
    name: extrahop-ticket-track
    outputs:
    - contextPath: ExtraHop.TicketId
      description: Cortex XSOAR incident ID successfully tracked to the ExtraHop Reveal(x) detection.
      type: String
  - arguments:
    - auto: PREDEFINED
      description: The unique identifier for the alert.
      name: alert_id
      required: true
    - auto: PREDEFINED
      description: Indicates whether the alert is assigned to all available data sources.
      name: apply_all
      predefined:
      - 'true'
      - 'false'
      required: true
    - auto: PREDEFINED
      description: Indicates whether the alert is disabled.
      name: disabled
      predefined:
      - 'true'
      - 'false'
      required: true
    - description: The name of the monitored metric. Only applicable to threshold alerts.
      name: field_name
    - description: The second monitored metric when applying a ratio. Only applicable to threshold alerts.
      name: field_name2
    - auto: PREDEFINED
      description: The type of comparison between the field_name and field_name2 fields when applying a ratio. Only applicable to threshold alerts.
      name: field_op
      predefined:
      - /
      - 'null'
    - auto: PREDEFINED
      default: true
      defaultValue: '30'
      description: The length of the alert interval, expressed in seconds. Only applicable to threshold alerts.
      name: interval_length
      predefined:
      - '30'
      - '60'
      - '120'
      - '300'
      - '600'
      - '900'
      - '1200'
      - '1800'
    - description: The unique, friendly name for the alert.
      name: name
      required: true
    - auto: PREDEFINED
      description: Indicates whether to send an SNMP trap when an alert is generated.
      name: notify_snmp
      predefined:
      - 'true'
      - 'false'
      required: true
    - auto: PREDEFINED
      description: The type of metric source monitored by the alert configuration. Only applicable to detection alerts.
      name: object_type
      predefined:
      - application
      - device
    - description: The value to compare against alert conditions. The compare method is specified by the value of the operator field. Only applicable to threshold alerts.
      name: operand
    - auto: PREDEFINED
      description: The logical operator applied when comparing the value of the operand field to alert conditions. Only applicable to threshold alerts.
      name: operator
      predefined:
      - ==
      - '>'
      - <
      - '>='
      - <=
    - description: The first alert parameter, which is either a key pattern or a data point. Only applicable to threshold alerts.
      name: param
    - description: The second alert parameter, which is either a key pattern or a data point. Only applicable to threshold alerts.
      name: param2
    - description: The list of monitored protocols. Only applicable to detection alerts.
      isArray: true
      name: protocols
    - auto: PREDEFINED
      description: The time interval in which alert conditions are monitored, expressed in seconds.
      name: refire_interval
      predefined:
      - '300'
      - '600'
      - '900'
      - '1800'
      - '3600'
      - '7200'
      - '14400'
      required: true
    - auto: PREDEFINED
      description: The severity level of the alert, which is displayed in the Alert History, email notifications, and SNMP traps.
      name: severity
      predefined:
      - '0'
      - '1'
      - '2'
      - '3'
      - '4'
      - '5'
      - '6'
      - '7'
      required: true
    - description: The statistic name for the alert. Only applicable to threshold alerts.
      name: stat_name
    - auto: PREDEFINED
      description: The type of alert.
      name: type
      predefined:
      - detection
      - threshold
      required: true
    - auto: PREDEFINED
      description: The interval in which to evaluate the alert condition. Only applicable to threshold alerts.
      name: units
      predefined:
      - none
      - period
      - 1 sec
      - 1 min
      - 1 hr
    description: Modify an alert rule in ExtraHop Reveal(x).
    name: extrahop-alert-rule-edit
  - arguments:
    - description: The list of IP addresses or ExtraHop API IDs of the devices to add, comma separated.
      isArray: true
      name: add
    - description: The list of IP addresses or ExtraHop API IDs of the devices to remove, comma separated.
      isArray: true
      name: remove
    description: Add or remove devices from the advanced analysis watchlist in ExtraHop Reveal(x).
    name: extrahop-watchlist-edit
  - arguments:
    - auto: PREDEFINED
      description: |-
        The aggregation period for metrics.
        Supported values: "auto", "1sec", "30sec", "5min", "1hr", "24hr".
      name: cycle
      predefined:
      - auto
      - 1sec
      - 30sec
      - 5min
      - 1hr
      - 24hr
      required: true
    - description: |-
        The beginning timestamp for the request. Return only metrics collected after this time. Time is expressed in milliseconds since the epoch. 0 indicates the time of the request. A negative value is evaluated relative to the current time. The default unit for a negative value is milliseconds, but other units can be specified with a unit suffix.
        For example, to request devices active in the last 30 minutes, specify the following parameter value: "-30m".
      name: from_time
      required: true
    - description: The group of metrics that are searchable in the metric catalog.
      name: metric_category
      required: true
    - description: The list of numeric values that represent unique identifiers. Unique identifiers can be retrieved through the /networks, /devices, /applications, /vlans, /devicegroups, /activitygroups, and /appliances resources. For system health metrics, specify the ID of the sensor or console and set the object_type parameter to "system".
      isArray: true
      name: object_ids
      required: true
    - auto: PREDEFINED
      description: |-
        Indicates the object type of unique identifiers specified in the object_ids property.
        Supported values: "network", "device", "application", "vlan", "device_group", "system".
      name: object_type
      predefined:
      - network
      - device
      - application
      - vlan
      - device_group
      - system
      required: true
    - description: |-
        The ending timestamp for the request. Return only metrics collected before this time. Time is expressed in milliseconds since the epoch. 0 indicates the time of the request. A negative value is evaluated relative to the current time. The default unit for a negative value is milliseconds, but other units can be specified with a unit suffix.
        For example, to request devices active in the last 30 minutes, specify the following parameter value: "-30m".
      name: until_time
      required: true
    - description: "An array of metric specification objects. \nRefer to the ExtraHop REST API Guide at https://docs.extrahop.com/current/rest-api-guide/"
      name: metric_specs
      required: true
    description: Get metrics for specified objects from ExtraHop Reveal(x).
    name: extrahop-metrics-list
    outputs:
    - contextPath: ExtraHop.Metrics.cycle
      description: The aggregation period for metrics.
      type: String
    - contextPath: ExtraHop.Metrics.node_id
      description: Node ID of the sensor associated with the object.
      type: Number
    - contextPath: ExtraHop.Metrics.clock
      description: The current time.
      type: Number
    - contextPath: ExtraHop.Metrics.from
      description: The beginning time from which metrics were collected.
      type: Number
    - contextPath: ExtraHop.Metrics.until
      description: The ending time that metrics were collected.
      type: Number
    - contextPath: ExtraHop.Metrics.stats.oid
      description: The ID of the object.
      type: Number
    - contextPath: ExtraHop.Metrics.stats.time
      description: The time for which metrics were collected.
      type: Number
    - contextPath: ExtraHop.Metrics.stats.duration
      description: The duration that metrics were collected.
      type: Number
    - contextPath: ExtraHop.Metrics.stats.values
      description: The count value of the metrics that were collected.
      type: Unknown
  - arguments:
    - description: |-
        Detection-specific filters.
        For eg:
        {
          "categories": ["sec.attack"],
          "risk_score_min": 51
        }

        If the categories and category are not specified, then categories will be set to ["sec.attack"]. The category field is deprecated by the API, so please use the categories field instead.
        Refer to the ExtraHop REST API guide at https://docs.extrahop.com/current/rest-api-guide/
      name: filter
    - description: |-
        Returns detections that occurred after the specified date, expressed in milliseconds since the epoch. Detections that started before the specified date are returned if the detection was ongoing at that time.

        For eg:
        from=1673508360001.
      name: from
    - defaultValue: '200'
      description: |-
        Returns no more than the specified number of detections.

        For eg:
        limit=10.
      name: limit
    - description: |-
        The number of detections to skip for pagination.

        For eg:
        offset=100.
      name: offset
    - description: "Sorts returned detections by the specified fields. \nComma separated \"field\" \"direction\" is the accepted format.\nBy default, detections are sorted by most recent update time and then id in ascending order.\n\nFor eg:\nsort=\"end_time asc,id desc\"."
      name: sort
    - description: |-
        Return detections that ended before the specified date, expressed in milliseconds since the epoch.

        For eg:
        until=1673509360001.
      name: until
    - description: "Return detections that were modified on or after the specified date, expressed in milliseconds since the epoch.\n\nFor eg: 1675416916102."
      name: mod_time
    description: Get detections from ExtraHop Reveal(x).
    name: extrahop-detections-list
    outputs:
    - contextPath: ExtraHop.Detections.id
      description: The unique detection ID of the detection.
      type: Number
    - contextPath: ExtraHop.Detections.start_time
      description: The timestamp when the detection was identified.
      type: Number
    - contextPath: ExtraHop.Detections.mod_time
      description: The timestamp when the detection was last modified.
      type: Number
    - contextPath: ExtraHop.Detections.end_time
      description: The timestamp when the detection was completed.
      type: Number
    - contextPath: ExtraHop.Detections.title
      description: The title of the detection.
      type: String
    - contextPath: ExtraHop.Detections.description
      description: The description of the event for which the detection was created.
      type: String
    - contextPath: ExtraHop.Detections.categories
      description: The categories associated with the detection.
      type: Unknown
    - contextPath: ExtraHop.Detections.risk_score
      description: The risk level of the event.
      type: Number
    - contextPath: ExtraHop.Detections.type
      description: The detection type.
      type: String
    - contextPath: ExtraHop.Detections.properties
      description: The detection properties.
      type: Unknown
    - contextPath: ExtraHop.Detections.participants
      description: The participants involved in the event.
      type: Unknown
    - contextPath: ExtraHop.Detections.ticket_id
      description: The unique ticket ID for the detection that is being tracked.
      type: String
    - contextPath: ExtraHop.Detections.assignee
      description: The user assigned to the detection.
      type: String
    - contextPath: ExtraHop.Detections.status
      description: The status of the detection.
      type: String
    - contextPath: ExtraHop.Detections.resolution
      description: The resolution state of the detection.
      type: String
    - contextPath: ExtraHop.Detections.mitre_tactics
      description: The MITRE tactics associated with the attack.
      type: Unknown
    - contextPath: ExtraHop.Detections.mitre_techniques
      description: The MITRE techniques associated with the attack.
      type: Unknown
    - contextPath: ExtraHop.Detections.appliance_id
      description: The unique identifier of the sensor on which the attack was detected.
      type: Number
    - contextPath: ExtraHop.Detections.is_user_created
      description: Indicates whether the detection is user-created.
      type: Boolean
  - deprecated: true
    description: Use extrahop-alert-rules-get instead. Get all alert rules from Reveal(x).
    name: extrahop-get-alerts
    outputs:
    - contextPath: Extrahop.Alert.Operator
      description: The logical operator applied when comparing the value of the operand field to alert conditions.
      type: String
    - contextPath: Extrahop.Alert.FieldName
      description: The name of the monitored metric.
      type: String
    - contextPath: Extrahop.Alert.NotifySnmp
      description: 'Indicates whether to send an SNMP trap when an alert is generated. '
      type: Boolean
    - contextPath: Extrahop.Alert.Operand
      description: The value to compare against alert conditions.
      type: String
    - contextPath: Extrahop.Alert.IntervalLength
      description: The length of the alert interval, expressed in seconds.
      type: Number
    - contextPath: Extrahop.Alert.Author
      description: 'The name of the user that created the alert. '
      type: String
    - contextPath: Extrahop.Alert.Name
      description: The unique, friendly name for the alert.
      type: String
    - contextPath: Extrahop.Alert.FieldName2
      description: The second monitored metric when applying a ratio.
      type: String
    - contextPath: Extrahop.Alert.RefireInterval
      description: The time interval in which alert conditions are monitored, expressed in seconds.
      type: Number
    - contextPath: Extrahop.Alert.ModTime
      description: 'The time of the most recent update, expressed in milliseconds since the epoch. '
      type: Number
    - contextPath: Extrahop.Alert.Units
      description: The interval in which to evaluate the alert condition.
      type: String
    - contextPath: Extrahop.Alert.ApplyAll
      description: Indicates whether the alert is assigned to all available data sources.
      type: Boolean
    - contextPath: Extrahop.Alert.Type
      description: The type of alert.
      type: String
    - contextPath: Extrahop.Alert.FieldOp
      description: The type of comparison between the "field_name" and "field_name2" fields when applying a ratio.
      type: String
    - contextPath: Extrahop.Alert.Id
      description: The unique identifier for the alert.
      type: Number
    - contextPath: Extrahop.Alert.Disabled
      description: Indicates whether the alert is disabled.
      type: Boolean
    - contextPath: Extrahop.Alert.Description
      description: An optional description for the alert.
      type: String
    - contextPath: Extrahop.Alert.Severity
      description: The severity level of the alert.
      type: Number
    - contextPath: Extrahop.Alert.StatName
      description: The statistic name for the alert.
      type: String
  - deprecated: true
    description: Use extrahop-alert-rules-get instead. Get all alert rules from Reveal(x).
    name: extrahop-get-alert-rules
    outputs:
    - contextPath: Extrahop.Alert.Operator
      description: The logical operator applied when comparing the value of the operand field to alert conditions.
      type: String
    - contextPath: Extrahop.Alert.FieldName
      description: The name of the monitored metric.
      type: String
    - contextPath: Extrahop.Alert.NotifySnmp
      description: 'Indicates whether to send an SNMP trap when an alert is generated. '
      type: Boolean
    - contextPath: Extrahop.Alert.Operand
      description: The value to compare against alert conditions.
      type: String
    - contextPath: Extrahop.Alert.IntervalLength
      description: The length of the alert interval, expressed in seconds.
      type: Number
    - contextPath: Extrahop.Alert.Author
      description: 'The name of the user that created the alert. '
      type: String
    - contextPath: Extrahop.Alert.Name
      description: The unique, friendly name for the alert.
      type: String
    - contextPath: Extrahop.Alert.FieldName2
      description: The second monitored metric when applying a ratio.
      type: String
    - contextPath: Extrahop.Alert.RefireInterval
      description: The time interval in which alert conditions are monitored, expressed in seconds.
      type: Number
    - contextPath: Extrahop.Alert.ModTime
      description: 'The time of the most recent update, expressed in milliseconds since the epoch. '
      type: Number
    - contextPath: Extrahop.Alert.Units
      description: The interval in which to evaluate the alert condition.
      type: String
    - contextPath: Extrahop.Alert.ApplyAll
      description: Indicates whether the alert is assigned to all available data sources.
      type: Boolean
    - contextPath: Extrahop.Alert.Type
      description: The type of alert.
      type: String
    - contextPath: Extrahop.Alert.FieldOp
      description: The type of comparison between the "field_name" and "field_name2" fields when applying a ratio.
      type: String
    - contextPath: Extrahop.Alert.Id
      description: The unique identifier for the alert.
      type: Number
    - contextPath: Extrahop.Alert.Disabled
      description: Indicates whether the alert is disabled.
      type: Boolean
    - contextPath: Extrahop.Alert.Description
      description: An optional description for the alert.
      type: String
    - contextPath: Extrahop.Alert.Severity
      description: The severity level of the alert.
      type: Number
    - contextPath: Extrahop.Alert.StatName
      description: The statistic name for the alert.
      type: String
  - arguments:
    - defaultValue: -30m
      description: 'The beginning timestamp of the time range the query will search, expressed in milliseconds since the epoch. A negative value specifies that the search will begin with records created at a time in the past relative to the current time. For example, specify -10m to begin the search with records created 10 minutes before the time of the request. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. See https://docs.extrahop.com/current/rest-api-guide/#supported-time-units- for more details on supported time units and suffixes.'
      name: query_from
      required: true
    - description: 'The ending timestamp of the time range the query will search, expressed in milliseconds since the epoch. A 0 value specifies that the search will end with records created at the time of the request. A negative value specifies that the search will end with records created at a time in the past relative to the current time. For example, specify -5m to end the search with records created 5 minutes before the time of the request. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. See https://docs.extrahop.com/current/rest-api-guide/#supported-time-units- for more details on supported time units and suffixes.'
      name: query_until
    - defaultValue: '20'
      description: The maximum number of entries to return.
      name: limit
    - description: The number of records to skip in the query results.
      name: offset
    - auto: PREDEFINED
      description: The name of the field in the record to be filtered. The query compares field1 to value1 and applies the compare method specified by the operator1 parameter. If the specified field name is ".any", the union of all field values will be searched. If the specified field name is ".ipaddr" or ".port", the client, server, sender, and receiver roles are included in the search.
      name: field1
      predefined:
      - .any
      - .ipaddr
      - .port
      - accessTime
      - ackCode
      - ackId
      - adminQueue
      - age
      - alertCode
      - alertLevel
      - answer
      - answers
      - appName
      - application
      - args
      - authDomain
      - authMethod
      - authResult
      - authType
      - authenticator
      - bindDN
      - bytes
      - cName
      - cNameType
      - cNames
      - cRealm
      - callId
      - certificateFingerprint
      - certificateIsSelfSigned
      - certificateIssuer
      - certificateKeySize
      - certificateNotAfter
      - certificateNotBefore
      - certificateSignatureAlgorithm
      - certificateSubject
      - certificateSubjectAlternativeNames
      - channel
      - cipherSuite
      - client
      - clientAddr
      - clientBuild
      - clientBytes
      - clientCGPMsgCount
      - clientCertificateRequested
      - clientCipherAlgorithm
      - clientCompressionAlgorithm
      - clientImplementation
      - clientL2Bytes
      - clientLatency
      - clientMacAlgorithm
      - clientMachine
      - clientMsgCount
      - clientName
      - clientPkts
      - clientPort
      - clientPrincipalName
      - clientRTO
      - clientReqDelay
      - clientType
      - clientVersion
      - clientZeroWnd
      - collection
      - command
      - contentType
      - conversationId
      - cookie
      - correlationId
      - cwd
      - dataSize
      - database
      - deltaBytes
      - deltaPkts
      - desktopHeight
      - desktopWidth
      - destination
      - dn
      - domain
      - drops
      - dscpName
      - dstQueueMgr
      - dups
      - duration
      - egressInterface
      - error
      - errorDetail
      - expiration
      - first
      - flowId
      - format
      - frameCutDuration
      - frameSendDuration
      - from
      - functionId
      - functionName
      - fwdReqClientAddr
      - fwdReqHost
      - fwdReqIsEncrypted
      - fwdReqServerName
      - fwdReqServerPort
      - gwAddr
      - handshakeTime
      - hasSDP
      - hassh
      - hasshServer
      - heartbeatPayloadLength
      - heartbeatType
      - hitCount
      - hopLimit
      - host
      - htype
      - ingressInterface
      - interface
      - isAborted
      - isAuthoritative
      - isBinaryProtocol
      - isCheckingDisabled
      - isCleanShutdown
      - isClientDiskRead
      - isClientDiskWrite
      - isCommandCreate
      - isCommandDelete
      - isCommandFileInfo
      - isCommandLock
      - isCommandRead
      - isCommandRename
      - isCommandWrite
      - isCompressed
      - isEncrypted
      - isNoReply
      - isPipelined
      - isRecursionAvailable
      - isRecursionDesired
      - isRenegotiate
      - isReqAborted
      - isReqTimeout
      - isReqTruncated
      - isRspAborted
      - isRspChunked
      - isRspCompressed
      - isRspImplicit
      - isRspTruncated
      - isSQLi
      - isSharedSession
      - isSubOperation
      - isWeakCipherSuite
      - isXSS
      - ja3Hash
      - ja3sHash
      - jitter
      - kexAlgorithm
      - keyboardLayout
      - l2Bytes
      - l7proto
      - label
      - last
      - launchParams
      - loadTime
      - loginTime
      - method
      - missCount
      - mos
      - msgClass
      - msgCode
      - msgFormat
      - msgId
      - msgLength
      - msgSize
      - msgText
      - msgType
      - network
      - networkAddr
      - networkLatency
      - nextHop
      - nextHopMTU
      - notAfter
      - offeredAddr
      - offset
      - opcode
      - operation
      - option
      - origin
      - outOfOrder
      - path
      - payloadType
      - payloadTypeId
      - persistent
      - pkts
      - pointer
      - printerName
      - priority
      - procedure
      - processingTime
      - program
      - proto
      - protocol
      - putAppName
      - qname
      - qtype
      - query
      - queue
      - queueMgr
      - rFactor
      - realm
      - receiver
      - receiverAddr
      - receiverAsn
      - receiverBytes
      - receiverIsBroker
      - receiverL2Bytes
      - receiverPkts
      - receiverPort
      - receiverPrefixLength
      - receiverRTO
      - receiverZeroWnd
      - recipient
      - recipientList
      - redeliveryCount
      - referer
      - renameDirChanged
      - replyTo
      - reqBytes
      - reqKey
      - reqL2Bytes
      - reqPdu
      - reqPkts
      - reqRTO
      - reqSize
      - reqTimeToLastByte
      - reqTransferTime
      - requestedColorDepth
      - requestedProtocols
      - resolvedQueue
      - resolvedQueueMgr
      - resource
      - responseQueue
      - roundTripTime
      - rspBytes
      - rspL2Bytes
      - rspPdu
      - rspPkts
      - rspRTO
      - rspSize
      - rspTimeToFirstByte
      - rspTimeToFirstHeader
      - rspTimeToFirstPayload
      - rspTimeToLastByte
      - rspTransferTime
      - rspVersion
      - rto
      - sNameType
      - sNames
      - saslMechanism
      - searchFilter
      - searchScope
      - selectedProtocol
      - sender
      - senderAddr
      - senderAsn
      - senderBytes
      - senderIsBroker
      - senderL2Bytes
      - senderPkts
      - senderPort
      - senderPrefixLength
      - senderRTO
      - senderZeroWnd
      - seqNum
      - server
      - serverAddr
      - serverBytes
      - serverCGPMsgCount
      - serverCipherAlgorithm
      - serverCompressionAlgorithm
      - serverImplementation
      - serverL2Bytes
      - serverMacAlgorithm
      - serverMsgCount
      - serverPkts
      - serverPort
      - serverPrincipalName
      - serverRTO
      - serverVersion
      - serverZeroWnd
      - share
      - source
      - sqli
      - srcQueueMgr
      - ssrc
      - statement
      - status
      - statusCode
      - statusText
      - table
      - target
      - tcpFlags
      - thinkTime
      - tickChannel
      - ticketHash
      - till
      - title
      - to
      - totalMsgLength
      - transferBytes
      - txId
      - type
      - unitId
      - uri
      - user
      - userAgent
      - vbucket
      - version
      - vlan
      - vxlanVNI
      - warning
      - xss
    - auto: PREDEFINED
      defaultValue: "="
      description: The compare method applied when matching value1 against the field1 contents.
      name: operator1
      predefined:
      - '>'
      - "<"
      - <=
      - '>='
      - "="
      - '!='
      - startswith
      - exists
      - not_exists
    - description: The value that the query attempts to match. The query compares this value to the contents of the field1 parameter and applies the compare method specified by the operator1 parameter.
      name: value1
    - auto: PREDEFINED
      description: The name of the field in the record to be filtered. The query compares field2 to value2 and applies the compare method specified by the operator2 parameter. If the specified field name is ".any", the union of all field values will be searched. If the specified field name is ".ipaddr" or ".port", the client, server, sender, and receiver roles are included in the search.
      name: field2
      predefined:
      - .any
      - .ipaddr
      - .port
      - accessTime
      - ackCode
      - ackId
      - adminQueue
      - age
      - alertCode
      - alertLevel
      - answer
      - answers
      - appName
      - application
      - args
      - authDomain
      - authMethod
      - authResult
      - authType
      - authenticator
      - bindDN
      - bytes
      - cName
      - cNameType
      - cNames
      - cRealm
      - callId
      - certificateFingerprint
      - certificateIsSelfSigned
      - certificateIssuer
      - certificateKeySize
      - certificateNotAfter
      - certificateNotBefore
      - certificateSignatureAlgorithm
      - certificateSubject
      - certificateSubjectAlternativeNames
      - channel
      - cipherSuite
      - client
      - clientAddr
      - clientBuild
      - clientBytes
      - clientCGPMsgCount
      - clientCertificateRequested
      - clientCipherAlgorithm
      - clientCompressionAlgorithm
      - clientImplementation
      - clientL2Bytes
      - clientLatency
      - clientMacAlgorithm
      - clientMachine
      - clientMsgCount
      - clientName
      - clientPkts
      - clientPort
      - clientPrincipalName
      - clientRTO
      - clientReqDelay
      - clientType
      - clientVersion
      - clientZeroWnd
      - collection
      - command
      - contentType
      - conversationId
      - cookie
      - correlationId
      - cwd
      - dataSize
      - database
      - deltaBytes
      - deltaPkts
      - desktopHeight
      - desktopWidth
      - destination
      - dn
      - domain
      - drops
      - dscpName
      - dstQueueMgr
      - dups
      - duration
      - egressInterface
      - error
      - errorDetail
      - expiration
      - first
      - flowId
      - format
      - frameCutDuration
      - frameSendDuration
      - from
      - functionId
      - functionName
      - fwdReqClientAddr
      - fwdReqHost
      - fwdReqIsEncrypted
      - fwdReqServerName
      - fwdReqServerPort
      - gwAddr
      - handshakeTime
      - hasSDP
      - hassh
      - hasshServer
      - heartbeatPayloadLength
      - heartbeatType
      - hitCount
      - hopLimit
      - host
      - htype
      - ingressInterface
      - interface
      - isAborted
      - isAuthoritative
      - isBinaryProtocol
      - isCheckingDisabled
      - isCleanShutdown
      - isClientDiskRead
      - isClientDiskWrite
      - isCommandCreate
      - isCommandDelete
      - isCommandFileInfo
      - isCommandLock
      - isCommandRead
      - isCommandRename
      - isCommandWrite
      - isCompressed
      - isEncrypted
      - isNoReply
      - isPipelined
      - isRecursionAvailable
      - isRecursionDesired
      - isRenegotiate
      - isReqAborted
      - isReqTimeout
      - isReqTruncated
      - isRspAborted
      - isRspChunked
      - isRspCompressed
      - isRspImplicit
      - isRspTruncated
      - isSQLi
      - isSharedSession
      - isSubOperation
      - isWeakCipherSuite
      - isXSS
      - ja3Hash
      - ja3sHash
      - jitter
      - kexAlgorithm
      - keyboardLayout
      - l2Bytes
      - l7proto
      - label
      - last
      - launchParams
      - loadTime
      - loginTime
      - method
      - missCount
      - mos
      - msgClass
      - msgCode
      - msgFormat
      - msgId
      - msgLength
      - msgSize
      - msgText
      - msgType
      - network
      - networkAddr
      - networkLatency
      - nextHop
      - nextHopMTU
      - notAfter
      - offeredAddr
      - offset
      - opcode
      - operation
      - option
      - origin
      - outOfOrder
      - path
      - payloadType
      - payloadTypeId
      - persistent
      - pkts
      - pointer
      - printerName
      - priority
      - procedure
      - processingTime
      - program
      - proto
      - protocol
      - putAppName
      - qname
      - qtype
      - query
      - queue
      - queueMgr
      - rFactor
      - realm
      - receiver
      - receiverAddr
      - receiverAsn
      - receiverBytes
      - receiverIsBroker
      - receiverL2Bytes
      - receiverPkts
      - receiverPort
      - receiverPrefixLength
      - receiverRTO
      - receiverZeroWnd
      - recipient
      - recipientList
      - redeliveryCount
      - referer
      - renameDirChanged
      - replyTo
      - reqBytes
      - reqKey
      - reqL2Bytes
      - reqPdu
      - reqPkts
      - reqRTO
      - reqSize
      - reqTimeToLastByte
      - reqTransferTime
      - requestedColorDepth
      - requestedProtocols
      - resolvedQueue
      - resolvedQueueMgr
      - resource
      - responseQueue
      - roundTripTime
      - rspBytes
      - rspL2Bytes
      - rspPdu
      - rspPkts
      - rspRTO
      - rspSize
      - rspTimeToFirstByte
      - rspTimeToFirstHeader
      - rspTimeToFirstPayload
      - rspTimeToLastByte
      - rspTransferTime
      - rspVersion
      - rto
      - sNameType
      - sNames
      - saslMechanism
      - searchFilter
      - searchScope
      - selectedProtocol
      - sender
      - senderAddr
      - senderAsn
      - senderBytes
      - senderIsBroker
      - senderL2Bytes
      - senderPkts
      - senderPort
      - senderPrefixLength
      - senderRTO
      - senderZeroWnd
      - seqNum
      - server
      - serverAddr
      - serverBytes
      - serverCGPMsgCount
      - serverCipherAlgorithm
      - serverCompressionAlgorithm
      - serverImplementation
      - serverL2Bytes
      - serverMacAlgorithm
      - serverMsgCount
      - serverPkts
      - serverPort
      - serverPrincipalName
      - serverRTO
      - serverVersion
      - serverZeroWnd
      - share
      - source
      - sqli
      - srcQueueMgr
      - ssrc
      - statement
      - status
      - statusCode
      - statusText
      - table
      - target
      - tcpFlags
      - thinkTime
      - tickChannel
      - ticketHash
      - till
      - title
      - to
      - totalMsgLength
      - transferBytes
      - txId
      - type
      - unitId
      - uri
      - user
      - userAgent
      - vbucket
      - version
      - vlan
      - vxlanVNI
      - warning
      - xss
    - auto: PREDEFINED
      defaultValue: "="
      description: The compare method applied when matching value2 against the field2 contents.
      name: operator2
      predefined:
      - '>'
      - "<"
      - "<="
      - '>='
      - "="
      - '!='
      - startswith
      - exists
      - not_exists
    - description: The value that the query attempts to match. The query compares this value to the contents of the field2 parameter and applies the compare method specified by the operator2 parameter.
      name: value2
    - auto: PREDEFINED
      defaultValue: and
      description: The match operator to use when chaining the search fields of 1 and 2 together. For example, to find HTTP records with status code 500 or a processing time greater than 100ms (set match_type=or, field1=statusCode, operator1==, value1=500, field2=processingTime, operator2=> value2=100, types=http).
      name: match_type
      predefined:
      - and
      - or
      - not
    - auto: PREDEFINED
      description: A list of one or more record formats for the query to filter on, comma separated. The query returns only records that match the specified formats.
      isArray: true
      name: types
      predefined:
      - aaa_request
      - aaa_response
      - activemq
      - ajp
      - cifs
      - db
      - dhcp_request
      - dhcp_response
      - dicom_request
      - dicom_response
      - dns_request
      - dns_response
      - fix_request
      - fix_response
      - flow
      - ftp
      - hl7
      - http
      - ibmmq_request
      - ibmmq_response
      - ica_close
      - ica_open
      - ica_tick
      - icmp
      - kerberos_request
      - kerberos_response
      - ldap_request
      - ldap_response
      - llmnr_request
      - llmnr_response
      - memcache_request
      - memcache_response
      - modbus
      - mongodb_request
      - mongodb_response
      - msmq
      - nfs
      - pop3
      - rdp_close
      - rdp_open
      - rdp_tick
      - redis_request
      - redis_response
      - rfb_close
      - rfb_open
      - rfb_tick
      - rpc_request
      - rpc_response
      - rtcp
      - rtp
      - sccp
      - sip_request
      - sip_response
      - smpp
      - smtp
      - ssh_close
      - ssh_open
      - ssh_tick
      - ssl_alert
      - ssl_close
      - ssl_heartbeat
      - ssl_open
      - telnet
    deprecated: true
    description: No available replacement. Query records from Reveal(x).
    name: extrahop-query-records
    outputs:
    - contextPath: ExtraHop.Record.Type
      description: The record format.
      type: string
    - contextPath: ExtraHop.Record.Source.timestamp
      description: The timestamp of the item.
      type: Number
    - contextPath: ExtraHop.Record.Source.detection
      description: The detection type that committed the record.
      type: string
    - contextPath: ExtraHop.Record.Source.ex.isSuspicious
      description: Marked as suspicious by Threat Intelligence.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.accessTime
      description: Access Time.
      type: Number
    - contextPath: ExtraHop.Record.Source.ackCode
      description: Ack Code.
      type: String
    - contextPath: ExtraHop.Record.Source.ackId
      description: Ack ID.
      type: String
    - contextPath: ExtraHop.Record.Source.adminQueue
      description: Admin Queue.
      type: String
    - contextPath: ExtraHop.Record.Source.age
      description: Age.
      type: Number
    - contextPath: ExtraHop.Record.Source.alertCode
      description: Alert Code.
      type: Number
    - contextPath: ExtraHop.Record.Source.alertLevel
      description: Alert Level.
      type: String
    - contextPath: ExtraHop.Record.Source.answer
      description: Answer.
      type: Unknown
    - contextPath: ExtraHop.Record.Source.answers
      description: Answers.
      type: Unknown
    - contextPath: ExtraHop.Record.Source.appName
      description: Application Name.
      type: String
    - contextPath: ExtraHop.Record.Source.application
      description: Application.
      type: Unknown
    - contextPath: ExtraHop.Record.Source.args
      description: Arguments.
      type: String
    - contextPath: ExtraHop.Record.Source.authDomain
      description: Authentication Domain.
      type: String
    - contextPath: ExtraHop.Record.Source.authMethod
      description: Authentication Method.
      type: String
    - contextPath: ExtraHop.Record.Source.authResult
      description: Auth Result.
      type: Number
    - contextPath: ExtraHop.Record.Source.authType
      description: Auth Type.
      type: Number
    - contextPath: ExtraHop.Record.Source.authenticator
      description: Authenticator.
      type: String
    - contextPath: ExtraHop.Record.Source.bindDN
      description: Bind Distinguished Name.
      type: String
    - contextPath: ExtraHop.Record.Source.bytes
      description: Bytes.
      type: Number
    - contextPath: ExtraHop.Record.Source.cName
      description: Canonical Endpoint.
      type: String
    - contextPath: ExtraHop.Record.Source.cNameType
      description: Client Name Type.
      type: String
    - contextPath: ExtraHop.Record.Source.cNames
      description: Client Name Components.
      type: String
    - contextPath: ExtraHop.Record.Source.cRealm
      description: Client Realm.
      type: String
    - contextPath: ExtraHop.Record.Source.callId
      description: Call ID.
      type: String
    - contextPath: ExtraHop.Record.Source.certificateFingerprint
      description: Certificate Fingerprint.
      type: String
    - contextPath: ExtraHop.Record.Source.certificateIsSelfSigned
      description: Certificate Self Signed.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.certificateIssuer
      description: Certificate Issuer.
      type: String
    - contextPath: ExtraHop.Record.Source.certificateKeySize
      description: Certificate Key Size.
      type: Number
    - contextPath: ExtraHop.Record.Source.certificateNotAfter
      description: Certificate Not After.
      type: Number
    - contextPath: ExtraHop.Record.Source.certificateNotBefore
      description: Certificate Not Before.
      type: Number
    - contextPath: ExtraHop.Record.Source.certificateSignatureAlgorithm
      description: Certificate Signature Algorithm.
      type: String
    - contextPath: ExtraHop.Record.Source.certificateSubject
      description: Certificate Subject.
      type: String
    - contextPath: ExtraHop.Record.Source.certificateSubjectAlternativeNames
      description: Certificate Subject Alternative Names.
      type: String
    - contextPath: ExtraHop.Record.Source.channel
      description: Channel.
      type: String
    - contextPath: ExtraHop.Record.Source.cipherSuite
      description: Cipher Suite.
      type: String
    - contextPath: ExtraHop.Record.Source.client.type
      description: Client Type.
      type: String
    - contextPath: ExtraHop.Record.Source.client.value
      description: Client Discovery ID.
      type: String
    - contextPath: ExtraHop.Record.Source.clientAddr.type
      description: Client IP Address Type.
      type: String
    - contextPath: ExtraHop.Record.Source.clientAddr.value
      description: Client IP Address Value.
      type: String
    - contextPath: ExtraHop.Record.Source.clientBuild
      description: Client Build.
      type: String
    - contextPath: ExtraHop.Record.Source.clientBytes
      description: Client Bytes.
      type: Number
    - contextPath: ExtraHop.Record.Source.clientCGPMsgCount
      description: Client CGP Messages.
      type: Number
    - contextPath: ExtraHop.Record.Source.clientCertificateRequested
      description: Client Certificate Requested.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.clientCipherAlgorithm
      description: Client Cipher Algorithm.
      type: String
    - contextPath: ExtraHop.Record.Source.clientCompressionAlgorithm
      description: Client Compression Algorithm.
      type: String
    - contextPath: ExtraHop.Record.Source.clientImplementation
      description: Client Implementation.
      type: String
    - contextPath: ExtraHop.Record.Source.clientL2Bytes
      description: Client L2 Bytes.
      type: Number
    - contextPath: ExtraHop.Record.Source.clientLatency
      description: Client Latency.
      type: Number
    - contextPath: ExtraHop.Record.Source.clientMacAlgorithm
      description: Client MAC Algorithm.
      type: String
    - contextPath: ExtraHop.Record.Source.clientMachine
      description: Client Machine.
      type: String
    - contextPath: ExtraHop.Record.Source.clientMsgCount
      description: Client Messages.
      type: Number
    - contextPath: ExtraHop.Record.Source.clientName
      description: Client Name.
      type: String
    - contextPath: ExtraHop.Record.Source.clientPkts
      description: Client Packets.
      type: Number
    - contextPath: ExtraHop.Record.Source.clientPort
      description: Client Port.
      type: Number
    - contextPath: ExtraHop.Record.Source.clientPrincipalName
      description: Client Principal Name.
      type: String
    - contextPath: ExtraHop.Record.Source.clientRTO
      description: Client RTO.
      type: Number
    - contextPath: ExtraHop.Record.Source.clientReqDelay
      description: Client Request Delay.
      type: Number
    - contextPath: ExtraHop.Record.Source.clientType
      description: ICA Client Type.
      type: String
    - contextPath: ExtraHop.Record.Source.clientVersion
      description: Client Version.
      type: String
    - contextPath: ExtraHop.Record.Source.clientZeroWnd
      description: Client Zero Windows.
      type: Number
    - contextPath: ExtraHop.Record.Source.collection
      description: Collection.
      type: String
    - contextPath: ExtraHop.Record.Source.command
      description: Command.
      type: String
    - contextPath: ExtraHop.Record.Source.contentType
      description: Content Type.
      type: String
    - contextPath: ExtraHop.Record.Source.conversationId
      description: Conversation ID.
      type: Number
    - contextPath: ExtraHop.Record.Source.cookie
      description: Cookie.
      type: String
    - contextPath: ExtraHop.Record.Source.correlationId
      description: Correlation ID.
      type: String
    - contextPath: ExtraHop.Record.Source.cwd
      description: Current Working Directory.
      type: String
    - contextPath: ExtraHop.Record.Source.dataSize
      description: Data Size.
      type: Number
    - contextPath: ExtraHop.Record.Source.database
      description: Database.
      type: String
    - contextPath: ExtraHop.Record.Source.deltaBytes
      description: Delta Bytes.
      type: Number
    - contextPath: ExtraHop.Record.Source.deltaPkts
      description: Delta Packets.
      type: Number
    - contextPath: ExtraHop.Record.Source.desktopHeight
      description: Desktop Height.
      type: Number
    - contextPath: ExtraHop.Record.Source.desktopWidth
      description: Desktop Width.
      type: Number
    - contextPath: ExtraHop.Record.Source.destination
      description: Destination.
      type: String
    - contextPath: ExtraHop.Record.Source.dn
      description: Distinguished Name.
      type: String
    - contextPath: ExtraHop.Record.Source.domain
      description: Domain.
      type: String
    - contextPath: ExtraHop.Record.Source.drops
      description: Drops.
      type: Number
    - contextPath: ExtraHop.Record.Source.dscpName
      description: DSCP.
      type: String
    - contextPath: ExtraHop.Record.Source.dstQueueMgr
      description: Destination Queue Manager.
      type: String
    - contextPath: ExtraHop.Record.Source.dups
      description: Dups.
      type: Number
    - contextPath: ExtraHop.Record.Source.duration
      description: Duration.
      type: Number
    - contextPath: ExtraHop.Record.Source.egressInterface
      description: Egress Interface.
      type: Unknown
    - contextPath: ExtraHop.Record.Source.error
      description: Error.
      type: String
    - contextPath: ExtraHop.Record.Source.errorDetail
      description: Error Detail.
      type: String
    - contextPath: ExtraHop.Record.Source.expiration
      description: Expiration.
      type: Number
    - contextPath: ExtraHop.Record.Source.first
      description: First.
      type: Number
    - contextPath: ExtraHop.Record.Source.flowId
      description: Flow.
      type: String
    - contextPath: ExtraHop.Record.Source.format
      description: Format.
      type: String
    - contextPath: ExtraHop.Record.Source.frameCutDuration
      description: Frame Cut Duration.
      type: Number
    - contextPath: ExtraHop.Record.Source.frameSendDuration
      description: Frame Send Duration.
      type: Number
    - contextPath: ExtraHop.Record.Source.from
      description: From.
      type: String
    - contextPath: ExtraHop.Record.Source.functionId
      description: Function ID.
      type: Number
    - contextPath: ExtraHop.Record.Source.functionName
      description: Function Name.
      type: String
    - contextPath: ExtraHop.Record.Source.fwdReqClientAddr.type
      description: Forwarded Request Client IP Address Type.
      type: String
    - contextPath: ExtraHop.Record.Source.fwdReqClientAddr.value
      description: Forwarded Request Client IP Address Value.
      type: String
    - contextPath: ExtraHop.Record.Source.fwdReqHost
      description: Forwarded Request Host.
      type: String
    - contextPath: ExtraHop.Record.Source.fwdReqIsEncrypted
      description: Forwarded Request Is Encrypted.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.fwdReqServerName
      description: Forwarded Request Server Name.
      type: String
    - contextPath: ExtraHop.Record.Source.fwdReqServerPort
      description: Forwarded Request Server Port.
      type: Number
    - contextPath: ExtraHop.Record.Source.gwAddr.type
      description: Gateway IP Address Type.
      type: String
    - contextPath: ExtraHop.Record.Source.gwAddr.value
      description: Gateway IP Address Value.
      type: String
    - contextPath: ExtraHop.Record.Source.handshakeTime
      description: Handshake Time.
      type: Number
    - contextPath: ExtraHop.Record.Source.hasSDP
      description: Has SDP.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.hassh
      description: HASSH.
      type: String
    - contextPath: ExtraHop.Record.Source.hasshServer
      description: HASSH Server.
      type: String
    - contextPath: ExtraHop.Record.Source.heartbeatPayloadLength
      description: Heartbeat Payload Length.
      type: Number
    - contextPath: ExtraHop.Record.Source.heartbeatType
      description: Heartbeat Type.
      type: Number
    - contextPath: ExtraHop.Record.Source.hitCount
      description: Hit Count.
      type: Number
    - contextPath: ExtraHop.Record.Source.hopLimit
      description: Hop Limit.
      type: Number
    - contextPath: ExtraHop.Record.Source.host
      description: Host.
      type: String
    - contextPath: ExtraHop.Record.Source.htype
      description: Hardware Address Type.
      type: Number
    - contextPath: ExtraHop.Record.Source.ingressInterface
      description: Ingress Interface.
      type: Unknown
    - contextPath: ExtraHop.Record.Source.interface
      description: Interface.
      type: String
    - contextPath: ExtraHop.Record.Source.isAborted
      description: Aborted.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.isAuthoritative
      description: Authoritative.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.isBinaryProtocol
      description: Binary Protocol.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.isCheckingDisabled
      description: Checking Disabled.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.isCleanShutdown
      description: Clean Shutdown.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.isClientDiskRead
      description: Client Disk Read.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.isClientDiskWrite
      description: Client Disk Write.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.isCommandCreate
      description: Create Command.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.isCommandDelete
      description: Delete Command.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.isCommandFileInfo
      description: FileInfo Command.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.isCommandLock
      description: Lock Command.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.isCommandRead
      description: Read Command.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.isCommandRename
      description: Rename Command.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.isCommandWrite
      description: Write Command.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.isCompressed
      description: Compressed.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.isEncrypted
      description: Encrypted.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.isNoReply
      description: No Reply.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.isPipelined
      description: Pipelined.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.isRecursionAvailable
      description: Recursion Available.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.isRecursionDesired
      description: Recursion Desired.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.isRenegotiate
      description: Renegotiate.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.isReqAborted
      description: Request Aborted.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.isReqTimeout
      description: Request Timed Out.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.isReqTruncated
      description: Request Truncated.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.isRspAborted
      description: Response Aborted.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.isRspChunked
      description: Chunked.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.isRspCompressed
      description: Rsp Compressed.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.isRspImplicit
      description: Response Implicit.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.isRspTruncated
      description: Response Truncated.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.isSQLi
      description: Contains SQLi.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.isSharedSession
      description: Shared Session.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.isSubOperation
      description: Is a suboperation.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.isWeakCipherSuite
      description: Weak Cipher Suite.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.isXSS
      description: Contains XSS.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.ja3Hash
      description: JA3 Hash.
      type: String
    - contextPath: ExtraHop.Record.Source.ja3sHash
      description: JA3S Hash.
      type: String
    - contextPath: ExtraHop.Record.Source.jitter
      description: Jitter.
      type: Number
    - contextPath: ExtraHop.Record.Source.kexAlgorithm
      description: KEX Algorithm.
      type: String
    - contextPath: ExtraHop.Record.Source.keyboardLayout
      description: Keyboard Layout.
      type: String
    - contextPath: ExtraHop.Record.Source.l2Bytes
      description: L2 Bytes.
      type: Number
    - contextPath: ExtraHop.Record.Source.l7proto
      description: L7 Protocol.
      type: String
    - contextPath: ExtraHop.Record.Source.label
      description: Label.
      type: String
    - contextPath: ExtraHop.Record.Source.last
      description: Last.
      type: Number
    - contextPath: ExtraHop.Record.Source.launchParams
      description: Parameters.
      type: String
    - contextPath: ExtraHop.Record.Source.loadTime
      description: Load Time.
      type: Number
    - contextPath: ExtraHop.Record.Source.loginTime
      description: Login Time.
      type: Number
    - contextPath: ExtraHop.Record.Source.method
      description: Method.
      type: String
    - contextPath: ExtraHop.Record.Source.missCount
      description: Miss Count.
      type: Number
    - contextPath: ExtraHop.Record.Source.mos
      description: MOS.
      type: Number
    - contextPath: ExtraHop.Record.Source.msgClass
      description: Message Class.
      type: String
    - contextPath: ExtraHop.Record.Source.msgCode
      description: Message Code.
      type: Number
    - contextPath: ExtraHop.Record.Source.msgFormat
      description: Message Format.
      type: String
    - contextPath: ExtraHop.Record.Source.msgId
      description: Message ID.
      type: Number
    - contextPath: ExtraHop.Record.Source.msgLength
      description: Message Length.
      type: Number
    - contextPath: ExtraHop.Record.Source.msgSize
      description: Message Size.
      type: Number
    - contextPath: ExtraHop.Record.Source.msgText
      description: Message Text.
      type: String
    - contextPath: ExtraHop.Record.Source.msgType
      description: Message Type.
      type: String
    - contextPath: ExtraHop.Record.Source.network
      description: Flow Network.
      type: Unknown
    - contextPath: ExtraHop.Record.Source.networkAddr.type
      description: Flow Network IP Address Type.
      type: String
    - contextPath: ExtraHop.Record.Source.networkAddr.value
      description: Flow Network IP Address Value.
      type: String
    - contextPath: ExtraHop.Record.Source.networkLatency
      description: Network Latency.
      type: Number
    - contextPath: ExtraHop.Record.Source.nextHop.type
      description: Next Hop IP Address Type.
      type: String
    - contextPath: ExtraHop.Record.Source.nextHop.value
      description: Next Hop IP Address Value.
      type: String
    - contextPath: ExtraHop.Record.Source.nextHopMTU
      description: Next Hop MTU.
      type: Number
    - contextPath: ExtraHop.Record.Source.notAfter
      description: Certificate Not After.
      type: Number
    - contextPath: ExtraHop.Record.Source.offeredAddr.type
      description: Offered IP Address Type.
      type: String
    - contextPath: ExtraHop.Record.Source.offeredAddr.value
      description: Offered IP Address Value.
      type: String
    - contextPath: ExtraHop.Record.Source.offset
      description: Offset.
      type: Number
    - contextPath: ExtraHop.Record.Source.opcode
      description: Opcode.
      type: String
    - contextPath: ExtraHop.Record.Source.operation
      description: Operation.
      type: String
    - contextPath: ExtraHop.Record.Source.option
      description: Options.
      type: String
    - contextPath: ExtraHop.Record.Source.origin
      description: Origin.
      type: String
    - contextPath: ExtraHop.Record.Source.outOfOrder
      description: Out Of Order.
      type: Number
    - contextPath: ExtraHop.Record.Source.path
      description: Path.
      type: String
    - contextPath: ExtraHop.Record.Source.payloadType
      description: Payload Type.
      type: String
    - contextPath: ExtraHop.Record.Source.payloadTypeId
      description: Payload Type ID.
      type: Number
    - contextPath: ExtraHop.Record.Source.persistent
      description: Persistent.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.pkts
      description: Packets.
      type: Number
    - contextPath: ExtraHop.Record.Source.pointer
      description: Pointer.
      type: Number
    - contextPath: ExtraHop.Record.Source.printerName
      description: Printer Name.
      type: String
    - contextPath: ExtraHop.Record.Source.priority
      description: Priority.
      type: Number
    - contextPath: ExtraHop.Record.Source.procedure
      description: Procedure.
      type: String
    - contextPath: ExtraHop.Record.Source.processingTime
      description: Processing Time.
      type: Number
    - contextPath: ExtraHop.Record.Source.program
      description: Program.
      type: String
    - contextPath: ExtraHop.Record.Source.proto
      description: IP Protocol.
      type: String
    - contextPath: ExtraHop.Record.Source.protocol
      description: Protocol.
      type: String
    - contextPath: ExtraHop.Record.Source.putAppName
      description: Put Application Name.
      type: String
    - contextPath: ExtraHop.Record.Source.qname
      description: Query Name.
      type: String
    - contextPath: ExtraHop.Record.Source.qtype
      description: Query Type.
      type: String
    - contextPath: ExtraHop.Record.Source.query
      description: Query.
      type: String
    - contextPath: ExtraHop.Record.Source.queue
      description: Queue.
      type: String
    - contextPath: ExtraHop.Record.Source.queueMgr
      description: Queue Manager.
      type: String
    - contextPath: ExtraHop.Record.Source.rFactor
      description: R Factor.
      type: Number
    - contextPath: ExtraHop.Record.Source.realm
      description: Server Realm.
      type: String
    - contextPath: ExtraHop.Record.Source.receiver.type
      description: Receiver Type.
      type: String
    - contextPath: ExtraHop.Record.Source.receiver.value
      description: Receiver Discovery ID.
      type: String
    - contextPath: ExtraHop.Record.Source.receiverAddr.type
      description: Receiver IP Address Type.
      type: String
    - contextPath: ExtraHop.Record.Source.receiverAddr.value
      description: Receiver IP Address Value.
      type: String
    - contextPath: ExtraHop.Record.Source.receiverAsn
      description: Receiver ASN.
      type: Number
    - contextPath: ExtraHop.Record.Source.receiverBytes
      description: Receiver Bytes.
      type: Number
    - contextPath: ExtraHop.Record.Source.receiverIsBroker
      description: To Broker.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.receiverL2Bytes
      description: Receiver L2 Bytes.
      type: Number
    - contextPath: ExtraHop.Record.Source.receiverPkts
      description: Receiver Packets.
      type: Number
    - contextPath: ExtraHop.Record.Source.receiverPort
      description: Receiver Port.
      type: Number
    - contextPath: ExtraHop.Record.Source.receiverPrefixLength
      description: Receiver Prefix Length.
      type: Number
    - contextPath: ExtraHop.Record.Source.receiverRTO
      description: Receiver RTO.
      type: Number
    - contextPath: ExtraHop.Record.Source.receiverZeroWnd
      description: Receiver Zero Windows.
      type: Number
    - contextPath: ExtraHop.Record.Source.recipient
      description: Recipient.
      type: String
    - contextPath: ExtraHop.Record.Source.recipientList
      description: Recipient List.
      type: String
    - contextPath: ExtraHop.Record.Source.redeliveryCount
      description: Redelivery Count.
      type: Number
    - contextPath: ExtraHop.Record.Source.referer
      description: Referer.
      type: String
    - contextPath: ExtraHop.Record.Source.renameDirChanged
      description: Rename Directory Changed.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.replyTo
      description: Reply To.
      type: String
    - contextPath: ExtraHop.Record.Source.reqBytes
      description: Request Bytes.
      type: Number
    - contextPath: ExtraHop.Record.Source.reqKey
      description: Request Key.
      type: String
    - contextPath: ExtraHop.Record.Source.reqL2Bytes
      description: Request L2 Bytes.
      type: Number
    - contextPath: ExtraHop.Record.Source.reqPdu
      description: Request PDU Type.
      type: String
    - contextPath: ExtraHop.Record.Source.reqPkts
      description: Request Packets.
      type: Number
    - contextPath: ExtraHop.Record.Source.reqRTO
      description: Request RTO.
      type: Number
    - contextPath: ExtraHop.Record.Source.reqSize
      description: Request Size.
      type: Number
    - contextPath: ExtraHop.Record.Source.reqTimeToLastByte
      description: Req Time To Last Byte.
      type: Number
    - contextPath: ExtraHop.Record.Source.reqTransferTime
      description: Request Transfer Time.
      type: Number
    - contextPath: ExtraHop.Record.Source.requestedColorDepth
      description: Requested Color Depth.
      type: String
    - contextPath: ExtraHop.Record.Source.requestedProtocols
      description: Requested Protocols.
      type: String
    - contextPath: ExtraHop.Record.Source.resolvedQueue
      description: Resolved Queue.
      type: String
    - contextPath: ExtraHop.Record.Source.resolvedQueueMgr
      description: Resolved Queue Manager.
      type: String
    - contextPath: ExtraHop.Record.Source.resource
      description: Resource.
      type: String
    - contextPath: ExtraHop.Record.Source.responseQueue
      description: Response Queue.
      type: String
    - contextPath: ExtraHop.Record.Source.roundTripTime
      description: Round Trip Time.
      type: Number
    - contextPath: ExtraHop.Record.Source.rspBytes
      description: Response Bytes.
      type: Number
    - contextPath: ExtraHop.Record.Source.rspL2Bytes
      description: Response L2 Bytes.
      type: Number
    - contextPath: ExtraHop.Record.Source.rspPdu
      description: Response PDU Type.
      type: String
    - contextPath: ExtraHop.Record.Source.rspPkts
      description: Response Packets.
      type: Number
    - contextPath: ExtraHop.Record.Source.rspRTO
      description: Response RTO.
      type: Number
    - contextPath: ExtraHop.Record.Source.rspSize
      description: Response Size.
      type: Number
    - contextPath: ExtraHop.Record.Source.rspTimeToFirstByte
      description: Rsp Time To First Byte.
      type: Number
    - contextPath: ExtraHop.Record.Source.rspTimeToFirstHeader
      description: Rsp Time To First Header.
      type: Number
    - contextPath: ExtraHop.Record.Source.rspTimeToFirstPayload
      description: Rsp Time To First Payload.
      type: Number
    - contextPath: ExtraHop.Record.Source.rspTimeToLastByte
      description: Rsp Time To Last Byte.
      type: Number
    - contextPath: ExtraHop.Record.Source.rspTransferTime
      description: Response Transfer Time.
      type: Number
    - contextPath: ExtraHop.Record.Source.rspVersion
      description: Response Version.
      type: String
    - contextPath: ExtraHop.Record.Source.rto
      description: RTO.
      type: Number
    - contextPath: ExtraHop.Record.Source.sNameType
      description: Server Name Type.
      type: String
    - contextPath: ExtraHop.Record.Source.sNames
      description: Server Name Components.
      type: String
    - contextPath: ExtraHop.Record.Source.saslMechanism
      description: SASL Mechanism.
      type: String
    - contextPath: ExtraHop.Record.Source.searchFilter
      description: Search Filter.
      type: String
    - contextPath: ExtraHop.Record.Source.searchScope
      description: Search Scope.
      type: String
    - contextPath: ExtraHop.Record.Source.selectedProtocol
      description: Selected Protocol.
      type: String
    - contextPath: ExtraHop.Record.Source.sender.type
      description: Sender Type.
      type: String
    - contextPath: ExtraHop.Record.Source.sender.value
      description: Sender Discovery ID.
      type: String
    - contextPath: ExtraHop.Record.Source.senderAddr.type
      description: Sender IP Address Type.
      type: String
    - contextPath: ExtraHop.Record.Source.senderAddr.value
      description: Sender IP Address Value.
      type: String
    - contextPath: ExtraHop.Record.Source.senderAsn
      description: Sender ASN.
      type: Number
    - contextPath: ExtraHop.Record.Source.senderBytes
      description: Sender Bytes.
      type: Number
    - contextPath: ExtraHop.Record.Source.senderIsBroker
      description: From Broker.
      type: Boolean
    - contextPath: ExtraHop.Record.Source.senderL2Bytes
      description: Sender L2 Bytes.
      type: Number
    - contextPath: ExtraHop.Record.Source.senderPkts
      description: Sender Packets.
      type: Number
    - contextPath: ExtraHop.Record.Source.senderPort
      description: Sender Port.
      type: Number
    - contextPath: ExtraHop.Record.Source.senderPrefixLength
      description: Sender Prefix Length.
      type: Number
    - contextPath: ExtraHop.Record.Source.senderRTO
      description: Sender RTO.
      type: Number
    - contextPath: ExtraHop.Record.Source.senderZeroWnd
      description: Sender Zero Windows.
      type: Number
    - contextPath: ExtraHop.Record.Source.seqNum
      description: Sequence Number.
      type: Number
    - contextPath: ExtraHop.Record.Source.server.type
      description: Server Type.
      type: String
    - contextPath: ExtraHop.Record.Source.server.value
      description: Server Discovery ID.
      type: String
    - contextPath: ExtraHop.Record.Source.serverAddr.type
      description: Server IPv4 Address Type.
      type: String
    - contextPath: ExtraHop.Record.Source.serverAddr.value
      description: Server IPv4 Address Value.
      type: String
    - contextPath: ExtraHop.Record.Source.serverBytes
      description: Server Bytes.
      type: Number
    - contextPath: ExtraHop.Record.Source.serverCGPMsgCount
      description: Server CGP Messages.
      type: Number
    - contextPath: ExtraHop.Record.Source.serverCipherAlgorithm
      description: Server Cipher Algorithm.
      type: String
    - contextPath: ExtraHop.Record.Source.serverCompressionAlgorithm
      description: Server Compression Algorithm.
      type: String
    - contextPath: ExtraHop.Record.Source.serverImplementation
      description: Server Implementation.
      type: String
    - contextPath: ExtraHop.Record.Source.serverL2Bytes
      description: Server L2 Bytes.
      type: Number
    - contextPath: ExtraHop.Record.Source.serverMacAlgorithm
      description: Server MAC Algorithm.
      type: String
    - contextPath: ExtraHop.Record.Source.serverMsgCount
      description: Server Messages.
      type: Number
    - contextPath: ExtraHop.Record.Source.serverPkts
      description: Server Packets.
      type: Number
    - contextPath: ExtraHop.Record.Source.serverPort
      description: Server Port.
      type: Number
    - contextPath: ExtraHop.Record.Source.serverPrincipalName
      description: Server Principal Name.
      type: String
    - contextPath: ExtraHop.Record.Source.serverRTO
      description: Server RTO.
      type: Number
    - contextPath: ExtraHop.Record.Source.serverVersion
      description: Server Version.
      type: String
    - contextPath: ExtraHop.Record.Source.serverZeroWnd
      description: Server Zero Windows.
      type: Number
    - contextPath: ExtraHop.Record.Source.share
      description: Share.
      type: String
    - contextPath: ExtraHop.Record.Source.source
      description: Source.
      type: String
    - contextPath: ExtraHop.Record.Source.sqli
      description: Potential SQLi.
      type: String
    - contextPath: ExtraHop.Record.Source.srcQueueMgr
      description: Source Queue Manager.
      type: String
    - contextPath: ExtraHop.Record.Source.ssrc
      description: Sender SSRC.
      type: Number
    - contextPath: ExtraHop.Record.Source.statement
      description: Statement.
      type: String
    - contextPath: ExtraHop.Record.Source.status
      description: Status.
      type: String
    - contextPath: ExtraHop.Record.Source.statusCode
      description: Status Code.
      type: Number
    - contextPath: ExtraHop.Record.Source.statusText
      description: Status Text.
      type: String
    - contextPath: ExtraHop.Record.Source.table
      description: Table.
      type: String
    - contextPath: ExtraHop.Record.Source.target
      description: Target.
      type: String
    - contextPath: ExtraHop.Record.Source.tcpFlags
      description: TCP Flags.
      type: Number
    - contextPath: ExtraHop.Record.Source.thinkTime
      description: Think Time.
      type: Number
    - contextPath: ExtraHop.Record.Source.tickChannel
      description: Tick Channel.
      type: String
    - contextPath: ExtraHop.Record.Source.ticketHash
      description: Encrypted Ticket Hash.
      type: String
    - contextPath: ExtraHop.Record.Source.till
      description: Till.
      type: String
    - contextPath: ExtraHop.Record.Source.title
      description: Title.
      type: String
    - contextPath: ExtraHop.Record.Source.to
      description: To.
      type: String
    - contextPath: ExtraHop.Record.Source.totalMsgLength
      description: Total Msg Length.
      type: Number
    - contextPath: ExtraHop.Record.Source.transferBytes
      description: Bytes Transferred.
      type: Number
    - contextPath: ExtraHop.Record.Source.txId
      description: Transaction ID.
      type: Number
    - contextPath: ExtraHop.Record.Source.unitId
      description: Unit ID.
      type: Number
    - contextPath: ExtraHop.Record.Source.uri
      description: URI.
      type: String
    - contextPath: ExtraHop.Record.Source.user
      description: User.
      type: String
    - contextPath: ExtraHop.Record.Source.userAgent
      description: User Agent.
      type: String
    - contextPath: ExtraHop.Record.Source.vbucket
      description: vBucket.
      type: Number
    - contextPath: ExtraHop.Record.Source.version
      description: Version.
      type: String
    - contextPath: ExtraHop.Record.Source.vlan
      description: VLAN.
      type: Number
    - contextPath: ExtraHop.Record.Source.vxlanVNI
      description: VxLAN VNI.
      type: Number
    - contextPath: ExtraHop.Record.Source.warning
      description: Warning.
      type: String
    - contextPath: ExtraHop.Record.Source.xss
      description: Potential XSS.
      type: String
  - arguments:
    - description: The name of the device. This searches for matches on all ExtraHop name fields (DHCP, DNS, NetBIOS, Cisco Discovery Protocol, etc).
      name: name
    - description: The IP address of the device.
      name: ip
    - description: The MAC address of the device.
      name: mac
    - auto: PREDEFINED
      description: The role of the device.
      name: role
      predefined:
      - db_server
      - dhcp_server
      - dns_server
      - file_server
      - firewall
      - gateway
      - http_server
      - domain_controller
      - web_proxy
      - load_balancer
      - pc
      - medical_device
      - mobile_device
      - printer
      - scanner
      - custom
      - voip_phone
      - other
    - auto: PREDEFINED
      description: The OS of the device.
      name: software
      predefined:
      - android
      - apple_ios
      - arista_eos
      - cisco_ios
      - cisco_nx-os
      - chrome_os
      - linux
      - mac_os
      - windows
      - windows_server
      - windows_server_2008
      - windows_server_2008_r2
      - windows_server_2012
      - windows_server_2012_r2
      - windows_server_2016
      - windows_vista
      - windows_7
      - windows_8
      - windows_8.1
      - windows_10
    - description: 'A tag present on the device. '
      name: tag
    - auto: PREDEFINED
      description: The vendor of the device, based on MAC address via OUI lookup.
      name: vendor
      predefined:
      - alcatel-lucent
      - apple
      - arista
      - asus
      - brother
      - canon
      - cisco
      - cisco-linksys
      - citrix
      - dell
      - dellemc
      - d-link
      - emc
      - f5
      - google
      - hp
      - htc
      - huawei
      - ibm
      - juniper
      - kyocera
      - microsoft
      - netapp
      - netgear
      - nokia
      - nortel
      - oracle
      - paloalto
      - samsung
      - 3com
      - toshiba
      - virtualbox
      - vmware
      - zte
    - description: 'The time that device was first seen by ExtraHop, expressed in milliseconds since the epoch. A negative value is evaluated relative to the current time. The default unit for a negative value is milliseconds, but other units can be specified with the following unit suffixes: ms, s, m, h, d, w, M, y. For example, to look one day back enter -1d or -24h. See https://docs.extrahop.com/current/rest-api-guide/#supported-time-units- for more details on supported time units and suffixes.'
      name: discover_time
    - description: The VLAN ID of the Virtual LAN that the device is on.
      name: vlan
    - auto: PREDEFINED
      description: The activity of the device.
      name: activity
      predefined:
      - aaa_client
      - aaa_server
      - ajp_client
      - ajp_server
      - amf_client
      - amf_server
      - cifs_client
      - cifs_server
      - db_client
      - db_server
      - dhcp_client
      - dhcp_server
      - dicom_client
      - dicom_server
      - dns_client
      - dns_server
      - fix_client
      - fix_server
      - ftp_client
      - ftp_server
      - hl7_client
      - hl7_server
      - http_client
      - http_server
      - ibmmq_client
      - ibmmq_server
      - ica_client
      - ica_server
      - icmp
      - iscsi_client
      - iscsi_server
      - kerberos_client
      - kerberos_server
      - ldap_client
      - ldap_server
      - llmnr_client
      - llmnr_server
      - memcache_client
      - memcache_server
      - modbus_client
      - modbus_server
      - mongo_client
      - mongo_server
      - msmq
      - nbns_client
      - nbns_server
      - nfs_client
      - nfs_server
      - pcoip_client
      - pcoip_server
      - pop3_client
      - pop3_server
      - rdp_client
      - rdp_server
      - redis_client
      - redis_server
      - rfb_client
      - rfb_server
      - rpc_client
      - rpc_server
      - rtcp
      - rtp
      - scanner
      - sip_client
      - sip_server
      - smpp_client
      - smpp_server
      - smtp_client
      - smtp_server
      - ssh_client
      - ssh_server
      - ssl_client
      - ssl_server
      - tcp
      - telnet_client
      - telnet_server
      - udp
      - websocket_client
      - websocket_server
      - wsman_client
      - wsman_server
    - auto: PREDEFINED
      defaultValue: "="
      description: The compare method applied when matching the fields against their values. For example, to find devices with names that begin with 'SEA1' (set name=SEA1, operator=startswith).
      name: operator
      predefined:
      - '>'
      - '<'
      - '<='
      - '>='
      - "="
      - '!='
      - startswith
      - exists
      - not_exists
      - '~'
      - '!~'
    - auto: PREDEFINED
      defaultValue: and
      description: The match operator to use when chaining the search fields together. For example, to find all HTTP servers running Windows on the network (set match_type=and, role=http_server, software=windows).
      name: match_type
      predefined:
      - and
      - or
      - not
    - description: 'The beginning timestamp for the request. Return only devices active after this time. Time is expressed in milliseconds since the epoch. 0 indicates the time of the request. A negative value is evaluated relative to the current time. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. See https://docs.extrahop.com/current/rest-api-guide/#supported-time-units- for more details on supported time units and suffixes.'
      name: active_from
    - description: 'The ending timestamp for the request. Return only devices active before this time. Time is expressed in milliseconds since the epoch. 0 indicates the time of the request. A negative value is evaluated relative to the current time. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. See https://docs.extrahop.com/current/rest-api-guide/#supported-time-units- for more details on supported time units and suffixes.'
      name: active_until
    - defaultValue: '10'
      description: The maximum number of devices to return.
      name: limit
    - auto: PREDEFINED
      defaultValue: 'true'
      description: Only returns layer 3 devices by filtering out any layer 2 parent devices.
      name: l3_only
      predefined:
      - 'true'
      - 'false'
    deprecated: true
    description: Use extrahop-devices-search instead. Search for devices in Reveal(x).
    name: extrahop-device-search
    outputs:
    - contextPath: ExtraHop.Device.Macaddr
      description: The MAC Address of the device.
      type: String
    - contextPath: ExtraHop.Device.DeviceClass
      description: The class of the device.
      type: String
    - contextPath: ExtraHop.Device.UserModTime
      description: The time of the most recent update, expressed in milliseconds since the epoch.
      type: Number
    - contextPath: ExtraHop.Device.AutoRole
      description: The role automatically detected by the ExtraHop.
      type: String
    - contextPath: ExtraHop.Device.ParentId
      description: The ID of the parent device.
      type: Number
    - contextPath: ExtraHop.Device.Vendor
      description: The device vendor.
      type: String
    - contextPath: ExtraHop.Device.Analysis
      description: The level of analysis preformed on the device.
      type: string
    - contextPath: ExtraHop.Device.DiscoveryId
      description: The UUID given by the Discover appliance.
      type: String
    - contextPath: ExtraHop.Device.DefaultName
      description: The default name of the device.
      type: String
    - contextPath: ExtraHop.Device.DisplayName
      description: The display name of device.
      type: String
    - contextPath: ExtraHop.Device.OnWatchlist
      description: Whether the device is on the advanced analysis allow list.
      type: Boolean
    - contextPath: ExtraHop.Device.ModTime
      description: The time of the most recent update, expressed in milliseconds since the epoch.
      type: Number
    - contextPath: ExtraHop.Device.IsL3
      description: Indicates whether the device is a Layer 3 device.
      type: Boolean
    - contextPath: ExtraHop.Device.Role
      description: The role of the device.
      type: String
    - contextPath: ExtraHop.Device.DiscoverTime
      description: The time that the device was discovered.
      type: Number
    - contextPath: ExtraHop.Device.Id
      description: The ID of the device.
      type: Number
    - contextPath: ExtraHop.Device.Ipaddr4
      description: The IPv4 address of the device.
      type: String
    - contextPath: ExtraHop.Device.Vlanid
      description: The ID of VLan.
      type: Number
    - contextPath: ExtraHop.Device.Ipaddr6
      description: The IPv6 address of the device.
      type: string
    - contextPath: ExtraHop.Device.NodeId
      description: The Node ID of the Discover appliance.
      type: number
    - contextPath: ExtraHop.Device.Description
      description: A user customizable description of the device.
      type: string
    - contextPath: ExtraHop.Device.DnsName
      description: The DNS name associated with the device.
      type: string
    - contextPath: ExtraHop.Device.DhcpName
      description: The DHCP name associated with the device.
      type: string
    - contextPath: ExtraHop.Device.CdpName
      description: The Cisco Discovery Protocol name associated with the device.
      type: string
    - contextPath: ExtraHop.Device.NetbiosName
      description: The NetBIOS name associated with the device.
      type: string
    - contextPath: ExtraHop.Device.Url
      description: Link to the device details page in ExtraHop.
      type: string
  - arguments:
    - description: The list of IP Addresses or ExtraHop API IDs of the devices to add, comma separated.
      isArray: true
      name: add
    - description: The list of IP Addresses or ExtraHop API IDs of the devices to remove, comma separated.
      isArray: true
      name: remove
    deprecated: true
    description: Use extrahop-watchlist-edit instead. Add or remove devices from the watchlist in Reveal(x).
    name: extrahop-edit-watchlist
  - deprecated: true
    description: Use extrahop-watchlist-get instead. Get all devices on the watchlist in Reveal(x).
    name: extrahop-get-watchlist
    outputs:
    - contextPath: Extrahop.Device.Macaddr
      description: The MAC Address of the device.
      type: String
    - contextPath: Extrahop.Device.DeviceClass
      description: 'The class of this device. '
      type: String
    - contextPath: Extrahop.Device.UserModTime
      description: The time of the most recent update, expressed in milliseconds since the epoch.
      type: Number
    - contextPath: Extrahop.Device.AutoRole
      description: 'The role automatically detected by the ExtraHop. '
      type: String
    - contextPath: Extrahop.Device.ParentId
      description: The ID of the parent device.
      type: Number
    - contextPath: Extrahop.Device.Vendor
      description: The device vendor.
      type: String
    - contextPath: Extrahop.Device.Analysis
      description: The level of analysis preformed on the device.
      type: string
    - contextPath: Extrahop.Device.DiscoveryId
      description: The UUID given by the Discover appliance.
      type: String
    - contextPath: Extrahop.Device.DefaultName
      description: The default name for this device.
      type: String
    - contextPath: Extrahop.Device.DisplayName
      description: The display name of device.
      type: String
    - contextPath: Extrahop.Device.OnWatchlist
      description: Whether the device is on the advanced analysis allow list.
      type: Boolean
    - contextPath: Extrahop.Device.ModTime
      description: The time of the most recent update, expressed in milliseconds since the epoch.
      type: Number
    - contextPath: Extrahop.Device.IsL3
      description: Indicates whether the device is a Layer 3 device.
      type: Boolean
    - contextPath: Extrahop.Device.Role
      description: 'The role of the device. '
      type: String
    - contextPath: Extrahop.Device.DiscoverTime
      description: The time that the device was discovered.
      type: Number
    - contextPath: Extrahop.Device.Id
      description: The ID of the device.
      type: Number
    - contextPath: Extrahop.Device.Ipaddr4
      description: The IPv4 address for this device.
      type: String
    - contextPath: Extrahop.Device.Vlanid
      description: The unique identifier for the VLAN this device is associated with.
      type: Number
    - contextPath: ExtraHop.Device.Ipaddr6
      description: The IPv6 address of the device.
      type: string
    - contextPath: ExtraHop.Device.NodeId
      description: The Node ID of the Discover appliance.
      type: number
    - contextPath: ExtraHop.Device.Description
      description: A user customizable description of the device.
      type: string
    - contextPath: ExtraHop.Device.DnsName
      description: The DNS name associated with the device.
      type: string
    - contextPath: ExtraHop.Device.DhcpName
      description: The DHCP name associated with the device.
      type: string
    - contextPath: ExtraHop.Device.CdpName
      description: The Cisco Discovery Protocol name associated with the device.
      type: string
    - contextPath: ExtraHop.Device.NetbiosName
      description: The NetBIOS name associated with the device.
      type: string
    - contextPath: ExtraHop.Device.Url
      description: Link to the device details page in ExtraHop.
      type: string
  - arguments:
    - auto: PREDEFINED
      description: Indicates whether the alert is assigned to all available data sources.
      name: apply_all
      predefined:
      - 'true'
      - 'false'
      required: true
    - auto: PREDEFINED
      description: Indicates whether the alert is disabled.
      name: disabled
      predefined:
      - 'true'
      - 'false'
      required: true
    - description: The unique, friendly name for the alert.
      name: name
      required: true
    - auto: PREDEFINED
      description: Indicates whether to send an SNMP trap when an alert is generated.
      name: notify_snmp
      predefined:
      - 'true'
      - 'false'
      required: true
    - auto: PREDEFINED
      description: 'The time interval in which alert conditions are monitored, expressed in seconds. '
      name: refire_interval
      predefined:
      - '300'
      - '600'
      - '900'
      - '1800'
      - '3600'
      - '7200'
      - '14400'
      required: true
    - description: 'The severity level of the alert, which is displayed in the Alert History, email notifications, and SNMP traps. Supported values: 0, 1, 2, 3, 4, 5, 6, 7.'
      name: severity
      required: true
    - auto: PREDEFINED
      description: 'The type of alert. '
      name: type
      predefined:
      - detection
      - threshold
      required: true
    - auto: PREDEFINED
      description: 'The type of metric source monitored by the alert configuration. Only applicable to detection alerts. '
      name: object_type
      predefined:
      - application
      - device
    - description: The list of monitored protocols. Only applicable to detection alerts.
      name: protocols
    - description: The name of the monitored metric. Only applicable to threshold alerts.
      name: field_name
    - description: The second monitored metric when applying a ratio. Only applicable to threshold alerts.
      name: field_name2
    - description: The statistic name for the alert. Only applicable to threshold alerts.
      name: stat_name
    - auto: PREDEFINED
      description: "The interval in which to evaluate the alert condition. Only applicable to threshold alerts. \nSupported values: \"none\", \"period\", \"1 sec\", \"1 min\", \"1 hr\"."
      name: units
      predefined:
      - none
      - period
      - 1 sec
      - 1 min
      - 1 hr
    - auto: PREDEFINED
      defaultValue: '30'
      description: "The length of the alert interval, expressed in seconds. Only applicable to threshold alerts. \nSupported values: 30, 60, 120, 300, 600, 900, 1200, 1800."
      name: interval_length
      predefined:
      - '30'
      - '60'
      - '120'
      - '300'
      - '600'
      - '900'
      - '1200'
      - '1800'
    - description: The value to compare against alert conditions. The compare method is specified by the value of the operator field. Only applicable to threshold alerts.
      name: operand
    - auto: PREDEFINED
      description: The logical operator applied when comparing the value of the operand field to alert conditions. Only applicable to threshold alerts.
      name: operator
      predefined:
      - ==
      - '>'
      - <
      - '>='
      - <=
    - auto: PREDEFINED
      description: The type of comparison between the field_name and field_name2 fields when applying a ratio. Only applicable to threshold alerts.
      name: field_op
      predefined:
      - /
      - 'null'
    - description: The first alert parameter, which is either a key pattern or a data point. Only applicable to threshold alerts.
      name: param
    - description: The second alert parameter, which is either a key pattern or a data point. Only applicable to threshold alerts.
      name: param2
    deprecated: true
    description: Use extrahop-alert-rule-create instead. Create a new alert rule in Reveal(x).
    name: extrahop-create-alert
  - arguments:
    - auto: PREDEFINED
      description: Indicates whether the alert is assigned to all available data sources.
      name: apply_all
      predefined:
      - 'true'
      - 'false'
      required: true
    - auto: PREDEFINED
      description: Indicates whether the alert is disabled.
      name: disabled
      predefined:
      - 'true'
      - 'false'
      required: true
    - description: The unique, friendly name for the alert.
      name: name
      required: true
    - auto: PREDEFINED
      description: Indicates whether to send an SNMP trap when an alert is generated.
      name: notify_snmp
      predefined:
      - 'true'
      - 'false'
      required: true
    - auto: PREDEFINED
      description: 'The time interval in which alert conditions are monitored, expressed in seconds. '
      name: refire_interval
      predefined:
      - '300'
      - '600'
      - '900'
      - '1800'
      - '3600'
      - '7200'
      - '14400'
      required: true
    - description: 'The severity level of the alert, which is displayed in the Alert History, email notifications, and SNMP traps. Supported values: 0, 1, 2, 3, 4, 5, 6, 7.'
      name: severity
      required: true
    - auto: PREDEFINED
      description: 'The type of alert. '
      name: type
      predefined:
      - detection
      - threshold
      required: true
    - auto: PREDEFINED
      description: 'The type of metric source monitored by the alert configuration. Only applicable to detection alerts. '
      name: object_type
      predefined:
      - application
      - device
    - description: The list of monitored protocols. Only applicable to detection alerts.
      name: protocols
    - description: The name of the monitored metric. Only applicable to threshold alerts.
      name: field_name
    - description: The second monitored metric when applying a ratio. Only applicable to threshold alerts.
      name: field_name2
    - description: The statistic name for the alert. Only applicable to threshold alerts.
      name: stat_name
    - auto: PREDEFINED
      description: "The interval in which to evaluate the alert condition. Only applicable to threshold alerts. \nSupported values: \"none\", \"period\", \"1 sec\", \"1 min\", \"1 hr\"."
      name: units
      predefined:
      - none
      - period
      - 1 sec
      - 1 min
      - 1 hr
    - auto: PREDEFINED
      defaultValue: '30'
      description: "The length of the alert interval, expressed in seconds. Only applicable to threshold alerts. \nSupported values: 30, 60, 120, 300, 600, 900, 1200, 1800."
      name: interval_length
      predefined:
      - '30'
      - '60'
      - '120'
      - '300'
      - '600'
      - '900'
      - '1200'
      - '1800'
    - description: The value to compare against alert conditions. The compare method is specified by the value of the operator field. Only applicable to threshold alerts.
      name: operand
    - auto: PREDEFINED
      description: The logical operator applied when comparing the value of the operand field to alert conditions. Only applicable to threshold alerts.
      name: operator
      predefined:
      - ==
      - '>'
      - <
      - '>='
      - <=
    - auto: PREDEFINED
      description: The type of comparison between the field_name and field_name2 fields when applying a ratio. Only applicable to threshold alerts.
      name: field_op
      predefined:
      - /
      - 'null'
    - description: The first alert parameter, which is either a key pattern or a data point. Only applicable to threshold alerts.
      name: param
    - description: The second alert parameter, which is either a key pattern or a data point. Only applicable to threshold alerts.
      name: param2
    deprecated: true
    description: Use extrahop-alert-rule-create instead. Create a new alert rule in Reveal(x).
    name: extrahop-create-alert-rule
  - arguments:
    - description: The unique identifier for the alert.
      name: alert_id
      required: true
    - auto: PREDEFINED
      description: Indicates whether the alert is assigned to all available data sources.
      name: apply_all
      predefined:
      - 'true'
      - 'false'
      required: true
    - auto: PREDEFINED
      description: Indicates whether the alert is disabled.
      name: disabled
      predefined:
      - 'true'
      - 'false'
      required: true
    - description: The unique, friendly name for the alert.
      name: name
      required: true
    - auto: PREDEFINED
      description: Indicates whether to send an SNMP trap when an alert is generated.
      name: notify_snmp
      predefined:
      - 'true'
      - 'false'
      required: true
    - description: The name of the monitored metric. Only applicable to threshold alerts.
      name: field_name
    - description: The statistic name for the alert. Only applicable to threshold alerts.
      name: stat_name
    - auto: PREDEFINED
      description: The interval in which to evaluate the alert condition. Only applicable to threshold alerts.
      name: units
      predefined:
      - none
      - period
      - 1 sec
      - 1 min
      - 1 hr
    - auto: PREDEFINED
      description: The length of the alert interval, expressed in seconds. Only applicable to threshold alerts.
      name: interval_length
      predefined:
      - '30'
      - '60'
      - '120'
      - '300'
      - '600'
      - '900'
      - '1200'
      - '1800'
    - description: The value to compare against alert conditions. The compare method is specified by the value of the operator field. Only applicable to threshold alerts.
      name: operand
    - auto: PREDEFINED
      description: The time interval in which alert conditions are monitored, expressed in seconds.
      name: refire_interval
      predefined:
      - '300'
      - '600'
      - '900'
      - '1800'
      - '3600'
      - '7200'
      - '14400'
      required: true
    - auto: PREDEFINED
      description: The severity level of the alert, which is displayed in the Alert History, email notifications, and SNMP traps.
      name: severity
      predefined:
      - '0'
      - '1'
      - '2'
      - '3'
      - '4'
      - '5'
      - '6'
      - '7'
      required: true
    - auto: PREDEFINED
      description: The type of alert.
      name: type
      predefined:
      - detection
      - threshold
      required: true
    - auto: PREDEFINED
      description: The type of metric source monitored by the alert configuration. Only applicable to detection alerts.
      name: object_type
      predefined:
      - application
      - device
    - description: The list of monitored protocols. Only applicable to detection alerts.
      name: protocols
    - auto: PREDEFINED
      description: The logical operator applied when comparing the value of the operand field to alert conditions. Only applicable to threshold alerts.
      name: operator
      predefined:
      - ==
      - '>'
      - <
      - '>='
      - <=
    - description: The second monitored metric when applying a ratio. Only applicable to threshold alerts.
      name: field_name2
    - auto: PREDEFINED
      description: The type of comparison between the field_name and field_name2 fields when applying a ratio. Only applicable to threshold alerts.
      name: field_op
      predefined:
      - /
      - 'null'
    - description: The first alert parameter, which is either a key pattern or a data point. Only applicable to threshold alerts.
      name: param
    - description: The second alert parameter, which is either a key pattern or a data point. Only applicable to threshold alerts.
      name: param2
    deprecated: true
    description: Use extrahop-alert-rule-edit instead. Modify an alert rule in Reveal(x).
    name: extrahop-edit-alert
  - arguments:
    - description: The unique identifier for the alert.
      name: alert_id
      required: true
    - auto: PREDEFINED
      description: Indicates whether the alert is assigned to all available data sources.
      name: apply_all
      predefined:
      - 'true'
      - 'false'
      required: true
    - auto: PREDEFINED
      description: Indicates whether the alert is disabled.
      name: disabled
      predefined:
      - 'true'
      - 'false'
      required: true
    - description: The unique, friendly name for the alert.
      name: name
      required: true
    - auto: PREDEFINED
      description: Indicates whether to send an SNMP trap when an alert is generated.
      name: notify_snmp
      predefined:
      - 'true'
      - 'false'
      required: true
    - description: The name of the monitored metric. Only applicable to threshold alerts.
      name: field_name
    - description: The statistic name for the alert. Only applicable to threshold alerts.
      name: stat_name
    - auto: PREDEFINED
      description: The interval in which to evaluate the alert condition. Only applicable to threshold alerts.
      name: units
      predefined:
      - none
      - period
      - 1 sec
      - 1 min
      - 1 hr
    - auto: PREDEFINED
      description: The length of the alert interval, expressed in seconds. Only applicable to threshold alerts.
      name: interval_length
      predefined:
      - '30'
      - '60'
      - '120'
      - '300'
      - '600'
      - '900'
      - '1200'
      - '1800'
    - description: The value to compare against alert conditions. The compare method is specified by the value of the operator field. Only applicable to threshold alerts.
      name: operand
    - auto: PREDEFINED
      description: The time interval in which alert conditions are monitored, expressed in seconds.
      name: refire_interval
      predefined:
      - '300'
      - '600'
      - '900'
      - '1800'
      - '3600'
      - '7200'
      - '14400'
      required: true
    - auto: PREDEFINED
      description: The severity level of the alert, which is displayed in the Alert History, email notifications, and SNMP traps.
      name: severity
      predefined:
      - '0'
      - '1'
      - '2'
      - '3'
      - '4'
      - '5'
      - '6'
      - '7'
      required: true
    - auto: PREDEFINED
      description: The type of alert.
      name: type
      predefined:
      - detection
      - threshold
      required: true
    - auto: PREDEFINED
      description: The type of metric source monitored by the alert configuration. Only applicable to detection alerts.
      name: object_type
      predefined:
      - application
      - device
    - description: The list of monitored protocols. Only applicable to detection alerts.
      name: protocols
    - auto: PREDEFINED
      description: The logical operator applied when comparing the value of the operand field to alert conditions. Only applicable to threshold alerts.
      name: operator
      predefined:
      - ==
      - '>'
      - <
      - '>='
      - <=
    - description: The second monitored metric when applying a ratio. Only applicable to threshold alerts.
      name: field_name2
    - auto: PREDEFINED
      description: The type of comparison between the field_name and field_name2 fields when applying a ratio. Only applicable to threshold alerts.
      name: field_op
      predefined:
      - /
      - 'null'
    - description: The first alert parameter, which is either a key pattern or a data point. Only applicable to threshold alerts.
      name: param
    - description: The second alert parameter, which is either a key pattern or a data point. Only applicable to threshold alerts.
      name: param2
    deprecated: true
    description: Use extrahop-alert-rule-edit instead. Modify an alert rule in Reveal(x).
    name: extrahop-edit-alert-rule
  - arguments:
    - description: The ID of the Demisto Incident to ticket track.
      name: incident_id
      required: true
    - description: The ID of the ExtraHop Detection to ticket track.
      name: detection_id
      required: true
    - description: Owner of the incident.
      name: incident_owner
    - description: Status of the incident.
      name: incident_status
    - description: Reason the incident was closed.
      name: incident_close_reason
    deprecated: true
    description: Use extrahop-ticket-track instead. Link a Reveal(x) detection to a Demisto Investigation.
    name: extrahop-track-ticket
    outputs:
    - contextPath: ExtraHop.TicketId
      description: Demisto Incident ID successfully tracked to ExtraHop Detection.
      type: string
  - arguments:
    - description: The IP Address or ExtraHop API ID of the source device to get peer devices.
      name: ip_or_id
      required: true
    - defaultValue: -30m
      description: 'The beginning timestamp of the time range the query will search, expressed in milliseconds since the epoch. A negative value is evaluated relative to the current time. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. See https://docs.extrahop.com/current/rest-api-guide/#supported-time-units- for more details on supported time units and suffixes.'
      name: query_from
    - description: 'The ending timestamp of the time range the query will search, expressed in milliseconds since the epoch. 0 indicates the time of the request. A negative value is evaluated relative to the current time. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. See https://docs.extrahop.com/current/rest-api-guide/#supported-time-units- for more details on supported time units and suffixes.'
      name: query_until
    - auto: PREDEFINED
      defaultValue: any
      description: The role of the peer device in relation to the origin device.
      name: peer_role
      predefined:
      - any
      - client
      - server
    - auto: PREDEFINED
      defaultValue: any
      description: A filter to only return peers that the source device has communicated with over this protocol. If no value is set, the object includes any protocol.
      name: protocol
      predefined:
      - any
      - AAA
      - ActiveMQ
      - AJP
      - amf
      - CIFS
      - DB
      - DHCP
      - DICOM
      - DNS
      - FIX
      - FTP
      - HL7
      - HTTP
      - IBMMQ
      - ICA
      - IKE/ISAKMP
      - IMAP
      - IPFIX
      - IPsec NAT-T
      - IRC
      - iSCSI
      - Kerberos
      - L2TP
      - LDAP
      - lync-compress
      - memcache
      - Modbus
      - MongoDB
      - MSMQ
      - MSN
      - MSRPC
      - NetFlow
      - NFS
      - NTP
      - OpenVPN
      - PCoIP
      - Perforce
      - POP3
      - RDP
      - Redis
      - RFB
      - RTCP
      - RTP
      - sFlow
      - SIP
      - SMPP
      - SMTP
      - SNMP
      - SSH
      - SSL
      - Syslog
      - TCP
      - telnet
      - UDP
      - WebSocket
    deprecated: true
    description: Use extrahop-peers-get instead. Get all peers for a device from Reveal(x).
    name: extrahop-get-peers
    outputs:
    - contextPath: ExtraHop.Device.Macaddr
      description: The MAC Address of the device.
      type: string
    - contextPath: ExtraHop.Device.DeviceClass
      description: The class of the device.
      type: string
    - contextPath: ExtraHop.Device.UserModTime
      description: The time of the most recent update, expressed in milliseconds since the epoch.
      type: number
    - contextPath: ExtraHop.Device.AutoRole
      description: The role automatically detected by the ExtraHop.
      type: string
    - contextPath: ExtraHop.Device.ParentId
      description: The ID of the parent device.
      type: number
    - contextPath: ExtraHop.Device.Vendor
      description: The device vendor.
      type: string
    - contextPath: ExtraHop.Device.Analysis
      description: The level of analysis preformed on the device.
      type: string
    - contextPath: ExtraHop.Device.DiscoveryId
      description: The UUID given by the Discover appliance.
      type: string
    - contextPath: ExtraHop.Device.DefaultName
      description: The default name of the device.
      type: string
    - contextPath: ExtraHop.Device.DisplayName
      description: The display name of device.
      type: string
    - contextPath: ExtraHop.Device.OnWatchlist
      description: Whether the device is on the advanced analysis allow list.
      type: boolean
    - contextPath: ExtraHop.Device.ModTime
      description: The time of the most recent update, expressed in milliseconds since the epoch.
      type: number
    - contextPath: ExtraHop.Device.IsL3
      description: Indicates whether the device is a Layer 3 device.
      type: boolean
    - contextPath: ExtraHop.Device.Role
      description: The role of the device.
      type: string
    - contextPath: ExtraHop.Device.DiscoverTime
      description: The time that the device was discovered.
      type: number
    - contextPath: ExtraHop.Device.Id
      description: The ID of the device.
      type: number
    - contextPath: ExtraHop.Device.Ipaddr4
      description: The IPv4 address of the device.
      type: string
    - contextPath: ExtraHop.Device.Vlanid
      description: The ID of VLan.
      type: number
    - contextPath: ExtraHop.Device.Ipaddr6
      description: The IPv6 address of the device.
      type: string
    - contextPath: ExtraHop.Device.NodeId
      description: The Node ID of the Discover appliance.
      type: number
    - contextPath: ExtraHop.Device.Description
      description: A user customizable description of the device.
      type: string
    - contextPath: ExtraHop.Device.DnsName
      description: The DNS name associated with the device.
      type: string
    - contextPath: ExtraHop.Device.DhcpName
      description: The DHCP name associated with the device.
      type: string
    - contextPath: ExtraHop.Device.CdpName
      description: The Cisco Discovery Protocol name associated with the device.
      type: string
    - contextPath: ExtraHop.Device.NetbiosName
      description: The NetBIOS name associated with the device.
      type: string
    - contextPath: ExtraHop.Device.Url
      description: Link to the device details page in ExtraHop.
      type: string
    - contextPath: ExtraHop.Device.ClientProtocols
      description: The list of protocols the peer device is communicating as a client.
      type: string
    - contextPath: ExtraHop.Device.ServerProtocols
      description: The list of protocols the peer device is communicating as a server.
      type: string
  - arguments:
    - description: The IP Address or ExtraHop API ID of the device to get all active network protocols.
      name: ip_or_id
      required: true
    - defaultValue: -30m
      description: 'The beginning timestamp of the time range the query will search, expressed in milliseconds since the epoch. A negative value is evaluated relative to the current time. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. See https://docs.extrahop.com/current/rest-api-guide/#supported-time-units- for more details on supported time units and suffixes.'
      name: query_from
    - description: 'The ending timestamp of the time range the query will search, expressed in milliseconds since the epoch. 0 indicates the time of the request. A negative value is evaluated relative to the current time. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. See https://docs.extrahop.com/current/rest-api-guide/#supported-time-units- for more details on supported time units and suffixes.'
      name: query_until
    deprecated: true
    description: Use extrahop-protocols-get instead. Get all active network protocols for a device from Reveal(x).
    name: extrahop-get-protocols
    outputs:
    - contextPath: ExtraHop.Device.Macaddr
      description: The MAC Address of the device.
      type: string
    - contextPath: ExtraHop.Device.DeviceClass
      description: The class of the device.
      type: string
    - contextPath: ExtraHop.Device.UserModTime
      description: The time of the most recent update, expressed in milliseconds since the epoch.
      type: number
    - contextPath: ExtraHop.Device.AutoRole
      description: The role automatically detected by the ExtraHop.
      type: string
    - contextPath: ExtraHop.Device.ParentId
      description: The ID of the parent device.
      type: number
    - contextPath: ExtraHop.Device.Vendor
      description: The device vendor.
      type: string
    - contextPath: ExtraHop.Device.Analysis
      description: The level of analysis preformed on the device.
      type: string
    - contextPath: ExtraHop.Device.DiscoveryId
      description: The UUID given by the Discover appliance.
      type: string
    - contextPath: ExtraHop.Device.DefaultName
      description: The default name of the device.
      type: string
    - contextPath: ExtraHop.Device.DisplayName
      description: The display name of device.
      type: string
    - contextPath: ExtraHop.Device.OnWatchlist
      description: Whether the device is on the advanced analysis allow list.
      type: boolean
    - contextPath: ExtraHop.Device.ModTime
      description: The time of the most recent update, expressed in milliseconds since the epoch.
      type: number
    - contextPath: ExtraHop.Device.IsL3
      description: Indicates whether the device is a Layer 3 device.
      type: boolean
    - contextPath: ExtraHop.Device.Role
      description: The role of the device.
      type: string
    - contextPath: ExtraHop.Device.DiscoverTime
      description: The time that the device was discovered.
      type: number
    - contextPath: ExtraHop.Device.Id
      description: The ID of the device.
      type: number
    - contextPath: ExtraHop.Device.Ipaddr4
      description: The IPv4 address of the device.
      type: string
    - contextPath: ExtraHop.Device.Vlanid
      description: The ID of VLan.
      type: number
    - contextPath: ExtraHop.Device.Ipaddr6
      description: The IPv6 address of the device.
      type: string
    - contextPath: ExtraHop.Device.NodeId
      description: The Node ID of the Discover appliance.
      type: number
    - contextPath: ExtraHop.Device.Description
      description: A user customizable description of the device.
      type: string
    - contextPath: ExtraHop.Device.DnsName
      description: The DNS name associated with the device.
      type: string
    - contextPath: ExtraHop.Device.DhcpName
      description: The DHCP name associated with the device.
      type: string
    - contextPath: ExtraHop.Device.CdpName
      description: The Cisco Discovery Protocol name associated with the device.
      type: string
    - contextPath: ExtraHop.Device.NetbiosName
      description: The NetBIOS name associated with the device.
      type: string
    - contextPath: ExtraHop.Device.Url
      description: Link to the device details page in ExtraHop.
      type: string
    - contextPath: ExtraHop.Device.ClientProtocols
      description: The list of protocols the peer device is communicating as a client.
      type: string
    - contextPath: ExtraHop.Device.ServerProtocols
      description: The list of protocols the peer device is communicating as a server.
      type: string
  - arguments:
    - description: The case-sensitive value of the tag.
      name: tag
    - description: The list of IP Addresses or ExtraHop API IDs of the devices to tag, comma separated.
      isArray: true
      name: add
    - description: The list of IP Addresses or ExtraHop API IDs of the devices to remove the tag from, comma separated.
      isArray: true
      name: remove
    deprecated: true
    description: Use extrahop-devices-tag instead. Add or remove a tag from devices in Reveal(x).
    name: extrahop-tag-devices
  - arguments:
    - description: The IP Address or ExtraHop API ID of the source device to get an activity map.
      name: ip_or_id
      required: true
    - auto: PREDEFINED
      defaultValue: 30 minutes
      description: The time interval of the live activity map, expressed as the "Last" 30 minutes. For example, specify a value of 30 minutes to get an activity map showing the time range of the last 30 minutes. This field is ignored if from_time and until_time are provided.
      name: time_interval
      predefined:
      - 30 minutes
      - 6 hours
      - 1 day
      - 1 week
    - description: The beginning timestamp of a fixed time range the activity map will display, expressed in seconds since the epoch.
      name: from_time
    - description: The ending timestamp of a fixed time range the activity map will display, expressed in seconds since the epoch.
      name: until_time
    - auto: PREDEFINED
      defaultValue: any
      description: The role of the peer devices in relation to the source device. For example, specifying a peer_role of client will show All Clients communicating with the source device. Additionally specifying a protocol of HTTP will result in further filtering and only showing HTTP Clients communicating with the source device.
      name: peer_role
      predefined:
      - any
      - client
      - server
    - auto: PREDEFINED
      defaultValue: any
      description: The protocol over which the source device is communicating. For example, specifying a protocol of HTTP show only HTTP Clients and HTTP Servers communicating with the source device. Additionally specifying a peer_role of client will result in further filtering and only showing HTTP Clients communicating with the source device.
      name: protocol
      predefined:
      - any
      - AAA
      - ActiveMQ
      - AJP
      - amf
      - CIFS
      - DB
      - DHCP
      - DICOM
      - DNS
      - FIX
      - FTP
      - HL7
      - HTTP
      - IBMMQ
      - ICA
      - IKE/ISAKMP
      - IMAP
      - IPFIX
      - IPsec NAT-T
      - IRC
      - iSCSI
      - Kerberos
      - L2TP
      - LDAP
      - lync-compress
      - memcache
      - Modbus
      - MongoDB
      - MSMQ
      - MSN
      - MSRPC
      - NetFlow
      - NFS
      - NTP
      - OpenVPN
      - PCoIP
      - Perforce
      - POP3
      - RDP
      - Redis
      - RFB
      - RTCP
      - RTP
      - sFlow
      - SIP
      - SMPP
      - SMTP
      - SNMP
      - SSH
      - SSL
      - Syslog
      - TCP
      - telnet
      - UDP
      - WebSocket
    deprecated: true
    description: Use extrahop-activity-map-get instead. Get a link to a live activity map in Reveal(x).
    name: extrahop-get-activity-map
    outputs:
    - contextPath: ExtraHop.ActivityMap
      description: The link to a visual activity map in ExtraHop.
      type: string
  - arguments:
    - auto: PREDEFINED
      defaultValue: pcap
      description: The output format. A pcap file, A keylog.txt file that can be loaded in wireshark to decode ssl packets, or a zip file containing both a packets.pcap and keylog.txt.
      name: output
      predefined:
      - pcap
      - keylog_txt
      - zip
    - defaultValue: 10MB
      description: The maximum number of bytes to return.
      name: limit_bytes
    - defaultValue: 5m
      description: The maximum amount of time to run the packet search. The default unit is milliseconds, but other units can be specified with a unit suffix.
      name: limit_search_duration
    - defaultValue: -10m
      description: 'The beginning timestamp of the time range the search will include, expressed in milliseconds since the epoch. A negative value specifies that the search will begin with packets captured at a time in the past relative to the current time. For example, specify -10m to begin the search with packets captured 10 minutes before the time of the request. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. See https://docs.extrahop.com/current/rest-api-guide/#supported-time-units- for more details on supported time units and suffixes.'
      name: query_from
      required: true
    - description: 'The ending timestamp of the time range the search will include, expressed in milliseconds since the epoch. A 0 value specifies that the search will end with packets captured at the time of the search. A negative value specifies that the search will end with packets captured at a time in the past relative to the current time. For example, specify -5m to end the search with packets captured 5 minutes before the time of the request. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. See https://docs.extrahop.com/current/rest-api-guide/#supported-time-units- for more details on supported time units and suffixes.'
      name: query_until
    - description: The Berkeley Packet Filter (BPF) syntax for the packet search.
      name: bpf
    - description: Returns packets sent to or received by the specified IP address.
      name: ip1
    - description: Returns packets sent from or received on the specified port.
      name: port1
    - description: Returns packets sent to or received by the specified IP address.
      name: ip2
    - description: Returns packets sent from or received on the specified port.
      name: port2
    deprecated: true
    description: Use extrahop-packets-search instead. Search for specific packets in Reveal(x).
    name: extrahop-search-packets
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- ExtraHop_v2-Test
fromversion: 6.5.0