ExtraHop v2

ExtraHop Reveal(x) for Cortex XSOAR is a network detection and response solution that provides complete visibility of network communications at enterprise scale, real-time threat detections backed by machine learning, and guided investigation workflows that simplify response.

Configure ExtraHop Reveal(x) in Cortex

1. Navigate to Settings > Integrations > Servers & Services.
2. Search for ExtraHop Reveal(x).
3. Click Add instance to create and configure a new integration instance.

1. Click Test to validate the URL, credentials, and connection.

Commands

You can run the following commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully run a command, a DBot message appears in the War Room with the command details.

• Get detections from ExtraHop Reveal(x): extrahop-detections-list
• Link an ExtraHop Reveal(x) detection to a Cortex XSOAR incident: extrahop-ticket-track
• Search for devices in ExtraHop Reveal(x): extrahop-devices-search
• Get all active network protocols for a device from ExtraHop Reveal(x): extrahop-protocols-get
• Get all peers for a device from ExtraHop Reveal(x): extrahop-peers-get
• Get a link to a live activity map in ExtraHop Reveal(x): extrahop-activity-map-get
• Get all devices on the Advanced Analysis watchlist in ExtraHop Reveal(x): extrahop-watchlist-get
• Add or remove devices from the Advanced Analysis watchlist in ExtraHop Reveal(x): extrahop-watchlist-edit
• Add or remove a tag from devices in ExtraHop Reveal(x): extrahop-devices-tag
• Get all alert rules from ExtraHop Reveal(x): extrahop-alert-rules-get
• Create a new alert rule in ExtraHop Reveal(x): extrahop-alert-rule-create
• Modify an alert rule in ExtraHop Reveal(x): extrahop-alert-rule-edit
• Get metrics for specified objects from ExtraHop Reveal(x): extrahop-metrics-list
• Search for specific packets in ExtraHop Reveal(x): extrahop-packets-search

extrahop-watchlist-get

Get all devices on the advanced analysis watchlist in ExtraHop Reveal(x).

Base Command

extrahop-watchlist-get

Input

There are no input arguments for this command.

Context Output

Command example

#### Context Example

```json
{
    "ExtraHop": {
        "Device": [
            {
                "analysis": "advanced",
                "analysis_level": 2,
                "auto_role": "other",
                "critical": false,
                "default_name": "VM9",
                "device_class": "node",
                "dhcp_name": "test",
                "discover_time": 1635499650000,
                "discovery_id": "0000000000000000",
                "display_name": "test",
                "extrahop_id": "0000000000000000",
                "id": 25769803982,
                "ipaddr4": "0.0.0.0",
                "is_l3": false,
                "macaddr": "00:00:00:00:00:00",
                "mod_time": 1676638611398,
                "model": "vmware_vm",
                "node_id": 6,
                "on_watchlist": true,
                "role": "other",
                "url": "https://dummy_url/extrahop/#/metrics/devices/overview/",
                "user_mod_time": 1676290306316,
                "vendor": "VMware",
                "vlanid": 0
            },
            {
                "analysis": "advanced",
                "analysis_level": 2,
                "auto_role": "other",
                "critical": false,
                "default_name": "VM8",
                "device_class": "node",
                "discover_time": 1675318050000,
                "discovery_id": "0000000000000000",
                "display_name": "VM8",
                "extrahop_id": "0000000000000000",
                "id": 25769808133,
                "ipaddr4": "0.0.0.0",
                "is_l3": false,
                "last_seen_time": 1675319010000,
                "macaddr": "00:00:00:00:00:00",
                "mod_time": 1675425919964,
                "model": "vmware_vm",
                "node_id": 6,
                "on_watchlist": true,
                "role": "other",
                "url": "https://dummy_url/extrahop/#/metrics/devices/00000000000000000000000000000000.0000000000000000/overview/",
                "user_mod_time": 0,
                "vendor": "VMware",
                "vlanid": 0
            }
        ]
    }
}

Human Readable Output

Device Details

Display Name	IP Address	MAC Address	Role	Vendor	URL
test	0.0.0.0	00:00:00:00:00:00	other	VMware	View Device in ExtraHop
VM 8	0.0.0.0	00:00:00:00:00:00	other	VMware	View Device in ExtraHop

extrahop-peers-get

Get all peers for a device from ExtraHop Reveal(x).

Base Command

extrahop-peers-get

Input

Context Output

Command example

!extrahop-peers-get ip_or_id=0.0.0.0 peer_role=server protocol=any query_from=-60m query_until=0

Context Example

{
    "ExtraHop": {
        "Device": {
            "analysis": "advanced",
            "analysis_level": 1,
            "auto_role": "gateway",
            "critical": true,
            "default_name": "Cisco Meraki 23D27A",
            "device_class": "gateway",
            "discover_time": 1655102100000,
            "discovery_id": "0000000000000000",
            "display_name": "Cisco Meraki 23D27A",
            "extrahop_id": "0000000000000000",
            "id": 25769805776,
            "ipaddr4": "0.0.0.0",
            "is_l3": false,
            "macaddr": "00:00:00:00:00:00",
            "mod_time": 1676638911830,
            "node_id": 6,
            "on_watchlist": false,
            "role": "gateway",
            "server_protocols": [
                "UDP:NTP"
            ],
            "url": "https://dummy_url/extrahop/#/metrics/devices/overview/",
            "user_mod_time": 0,
            "vendor": "Cisco Meraki",
            "vlanid": 0
        }
    }
}

Human Readable Output

Device Details

Display Name	IP Address	MAC Address	Role	Protocols	URL	Vendor
Cisco Meraki 23D27A	0.0.0.0	00:00:00:00:00:00	gateway	Server: UDP:NTP	View Device in ExtraHop	Cisco Meraki

extrahop-devices-search

Search for devices in ExtraHop Reveal(x).

Base Command

extrahop-devices-search

Input

Context Output

Command example

!extrahop-devices-search activity=aaa_client discover_time=-10m ip=0.0.0.0 l3_only=true limit=2 mac=00:00:00:00:00:00 match_type=or name=DNS operator=!= role=file_server software=linux tag=tag1 vendor=cisco

Context Example

{
    "ExtraHop": {
        "Device": [
            {
                "analysis": "advanced",
                "analysis_level": 1,
                "auto_role": "other",
                "critical": false,
                "default_name": "VMware 8",
                "device_class": "node",
                "discover_time": 1676633640000,
                "discovery_id": "0000000000000000",
                "display_name": "VMware 8",
                "extrahop_id": "0000000000000000",
                "id": 25769808421,
                "ipaddr4": "0.0.0.0",
                "is_l3": false,
                "last_seen_time": 1676634840000,
                "macaddr": "00:00:00:00:00:00",
                "mod_time": 1676634890174,
                "model": "vmware_vm",
                "node_id": 6,
                "on_watchlist": false,
                "role": "other",
                "url": "https://dummy_url/extrahop/#/metrics/devices/overview/",
                "user_mod_time": 0,
                "vendor": "VMware",
                "vlanid": 0
            },
            {
                "analysis": "advanced",
                "analysis_level": 1,
                "auto_role": "other",
                "critical": false,
                "default_name": "VMware 3",
                "device_class": "node",
                "discover_time": 1676614620000,
                "discovery_id": "0000000000000000",
                "display_name": "VMware 3",
                "extrahop_id": "0000000000000000",
                "id": 25769808417,
                "ipaddr4": "0.0.0.0",
                "is_l3": false,
                "last_seen_time": 1676616960000,
                "macaddr": "00:00:00:00:00:00",
                "mod_time": 1676616977189,
                "model": "vmware_vm",
                "node_id": 6,
                "on_watchlist": false,
                "role": "other",
                "url": "https://dummy_url/extrahop/#/metrics/devices/overview/",
                "user_mod_time": 0,
                "vendor": "VMware",
                "vlanid": 0
            }
        ]
    }
}

Human Readable Output

Device Details

Display Name	IP Address	MAC Address	Role	Vendor	URL
VMware 8	0.0.0.0	00:00:00:00:00:00	other	VMware	View Device in ExtraHop
VMware 3	0.0.0.0	00:00:00:00:00:00	other	VMware	View Device in ExtraHop

extrahop-protocols-get

Get all active network protocols for a device from ExtraHop Reveal(x).

Base Command

extrahop-protocols-get

Input

Context Output

Command example

!extrahop-protocols-get ip_or_id=0.0.0.0 query_from=-20m query_until=0

Context Example

{
    "ExtraHop": {
        "Device": {
            "analysis": "advanced",
            "analysis_level": 2,
            "auto_role": "other",
            "client_protocols": [
                "UDP:NTP"
            ],
            "critical": false,
            "default_name": "VMware 9",
            "device_class": "node",
            "dhcp_name": "test",
            "discover_time": 1635499650000,
            "discovery_id": "0000000000000000",
            "display_name": "test",
            "extrahop_id": "0000000000000000",
            "id": 10000000000,
            "ipaddr4": "0.0.0.0",
            "is_l3": false,
            "macaddr": "00:00:00:00:00:000",
            "mod_time": 1676638611398,
            "model": "vmware_vm",
            "node_id": 6,
            "on_watchlist": true,
            "role": "other",
            "url": "https://dummy_url/extrahop/#/metrics/devices/overview/",
            "user_mod_time": 1676290306316,
            "vendor": "VMware",
            "vlanid": 0
        }
    }
}

Human Readable Output

Device Activity Found

Display Name	IP Address	MAC Address	Protocols (Client)	Role	Vendor	URL
test	0.0.0.0	00:00:00:00:00:000	UDP:NTP	other	VMware	View Device in ExtraHop

extrahop-activity-map-get

Get a link to a live activity map in ExtraHop Reveal(x).

Base Command

extrahop-activity-map-get

Input

Context Output

Command example

!extrahop-activity-map-get ip_or_id=0.0.0.0 peer_role=server protocol=any time_interval="30 minutes"

Context Example

{
    "ExtraHop": {
        "ActivityMap": {
            "url": "https://dummy_url/extrahop/#/activitymaps?appliance_id=00000000000000000000000000000000&discovery_id=0000000000000000&from=30&interval_type=MIN&object_type=device&protocol=any&role=server&until=0"
        }
    }
}

Human Readable Output

View Live Activity Map in ExtraHop

extrahop-alert-rules-get

Get all alert rules from ExtraHop Reveal(x).

Base Command

extrahop-alert-rules-get

Input

There are no input arguments for this command.

Context Output

Command example

#### Context Example

```json
{
    "ExtraHop": {
        "Alert": [
            {
                "apply_all": false,
                "author": "ExtraHop",
                "description": "Alert triggered when ratio of DB errors is greater than 1%.",
                "disabled": false,
                "field_name": "rsp_error",
                "field_name2": "rsp",
                "field_op": "/",
                "id": 15,
                "interval_length": 30,
                "mod_time": 1617887147538,
                "name": "DB Error Ratio - Orange",
                "notify_snmp": false,
                "operand": "0.01",
                "operator": ">",
                "refire_interval": 300,
                "severity": 3,
                "stat_name": "extrahop.application.db",
                "type": "threshold",
                "units": "none"
            },
            {
                "apply_all": false,
                "author": "ExtraHop",
                "description": "Alert triggered when ratio of DB errors is greater than 5%.",
                "disabled": false,
                "field_name": "rsp_error",
                "field_name2": "rsp",
                "field_op": "/",
                "id": 14,
                "interval_length": 30,
                "mod_time": 1617887147615,
                "name": "DB Error Ratio - Red",
                "notify_snmp": false,
                "operand": "0.05",
                "operator": ">",
                "refire_interval": 300,
                "severity": 1,
                "stat_name": "extrahop.application.db",
                "type": "threshold",
                "units": "none"
            },
            {
                "apply_all": false,
                "author": "ExtraHop",
                "description": "Alert triggered when ratio of DNS errors is greater than 0.1%.",
                "disabled": false,
                "field_name": "rsp_error",
                "field_name2": "rsp",
                "field_op": "/",
                "id": 19,
                "interval_length": 30,
                "mod_time": 1617887147785,
                "name": "DNS Error Ratio - Yellow",
                "notify_snmp": false,
                "operand": "0.001",
                "operator": ">",
                "refire_interval": 300,
                "severity": 5,
                "stat_name": "extrahop.application.dns",
                "type": "threshold",
                "units": "none"
            }
        ]
    }
}

Human Readable Output

Found 3 Alert(s)

Apply All	Author	Description	Disabled	Field Name	Field Name2	Field Op	Id	Interval Length	Mod Time	Name	Notify Snmp	Operand	Operator	Refire Interval	Severity	Stat Name	Type	Units
false	ExtraHop	Alert triggered when ratio of DB errors is greater than 1%.	false	rsp_error	rsp	/	15	30	1617887147538	DB Error Ratio - Orange	false	0.01	>	300	3	extrahop.application.db	threshold	none
false	ExtraHop	Alert triggered when ratio of DB errors is greater than 5%.	false	rsp_error	rsp	/	14	30	1617887147615	DB Error Ratio - Red	false	0.05	>	300	1	extrahop.application.db	threshold	none
false	ExtraHop	Alert triggered when ratio of DNS errors is greater than 0.1%.	false	rsp_error	rsp	/	19	30	1617887147785	DNS Error Ratio - Yellow	false	0.001	>	300	5	extrahop.application.dns	threshold	none

extrahop-packets-search

Search for specific packets in ExtraHop Reveal(x).

Base Command

extrahop-packets-search

Input

Context Output

Command example

!extrahop-packets-search ip1=0.0.0.0 ip2=0.0.0.0 limit_bytes=10MB limit_search_duration=10m output=pcap port1=8000 port2=8000 query_from=-15m query_until=0

Human Readable Output

Uploaded file: extrahop 2022-12-15 21.12.29 to 21.27.29 IST.pcapDownload.

Property	Value
Type	pcap
Size	1,122,020 bytes
Info	data
MD5	710737f2d9874690f130da14da38e7cb
SHA1	a89d4696c11ee0a8890d8f4effba8fad891cf05d
SHA256	433f238d350d8eb19979f0f513974d97b9e9f3445f99deb75c0a1f46e54de111
SHA512	fbb914a425d324e4d50bdcf15fc31499720e48d9242005c796d91c345dcb44e1f2fb1435d6bf44c89e0f8256dbae43638f5d8175872bcd29e5bf4fbcba4124cb
SSDeep	12288:WzC9IOFcF8jgBXx00uMOsOFtKu1R4mF48f6G2GeXCuX:Wgo8cNx3QsODKugmnfjcPX

extrahop-devices-tag

Add or remove a tag from devices in ExtraHop Reveal(x).

Base Command

extrahop-devices-tag

Input

Context Output

There is no context output for this command.

Command example

!extrahop-devices-tag tag=MyTag add=0.0.0.0 remove=0.0.0.0

Human Readable Output

Successfully tagged untagged the device/s.

extrahop-alert-rule-create

Create a new alert rule in ExtraHop Reveal(x).

Base Command

extrahop-alert-rule-create

Input

Context Output

There is no context output for this command.

Command example

!extrahop-alert-rule-create apply_all=true interval_length=30 disabled=false name="test10" notify_snmp=false refire_interval=300 severity=4 type=detection object_type=device protocols="udp"

Human Readable Output

Successfully created alert rule.

extrahop-ticket-track

Link an ExtraHop Reveal(x) detection to a Cortex XSOAR incident.

Base Command

extrahop-ticket-track

Input

Context Output

Command example

!extrahop-ticket-track detection_id=1234 incident_id=1 incident_owner=John incident_status=1

Context Example

{
    "ExtraHop": {
        "ExtraHop": {
            "TicketId": "1"
        }
    }
}

Human Readable Output

Successfully linked detection(1234) with incident(1)

extrahop-alert-rule-edit

Modify an alert rule in ExtraHop Reveal(x).

Base Command

extrahop-alert-rule-edit

Input

Context Output

There is no context output for this command.

Command example

!extrahop-alert-rule-edit interval_length=30 alert_id=36 apply_all=true disabled=false name="t127" notify_snmp=false refire_interval=300 severity=4 type=detection protocols="udp" object_type=device

Human Readable Output

Successfully updated alert rule.

extrahop-watchlist-edit

Add or remove devices from the advanced analysis watchlist in ExtraHop Reveal(x).

Base Command

extrahop-watchlist-edit

Input

Context Output

There is no context output for this command.

Command example

!extrahop-watchlist-edit add=0.0.0.0 remove=0.0.0.0

Human Readable Output

Successfully added new devices(0.0.0.0) in the watchlist
Successfully removed devices(0.0.0.0) from the watchlist

extrahop-metrics-list

Get metrics for specified objects from ExtraHop Reveal(x).

Base Command

extrahop-metrics-list

Input

Context Output

Command example

!extrahop-metrics-list cycle=auto from_time=0 metric_category=http object_ids=0 object_type=application until_time=0 metric_specs="[{\"name\": \"req\", \"key\": \"/GET/\"}]"

Context Example

{
    "ExtraHop": {
        "Metrics": {
            "clock": 1676883600000,
            "cycle": "1hr",
            "from": 0,
            "node_id": 0,
            "stats": [
                {
                    "duration": 3600000,
                    "oid": 0,
                    "time": 1637740800000,
                    "values": [
                        345
                    ]
                },
                {
                    "duration": 3600000,
                    "oid": 0,
                    "time": 1637744400000,
                    "values": [
                        178
                    ]
                },
                {
                    "duration": 3600000,
                    "oid": 0,
                    "time": 1637751600000,
                    "values": [
                        744
                    ]
                }
            ],
            "until": 1676883600000
        }
    }
}

Human Readable Output

Metrics Found:

extrahop-detections-list

Get detections from ExtraHop Reveal(x).

Base Command

extrahop-detections-list

Input

Context Output

Command example

!extrahop-detections-list limit=3

Context Example

{
    "ExtraHop": {
        "Detections": [
            {
                "appliance_id": 0,
                "categories": [
                    "sec",
                    "sec.exploit"
                ],
                "description": "The offender was recently observed carrying out a TCP SYN Scan and has now made a successful TCP 3-way handshake to the victim device. Investigate to determine if this is the result of the SYN Scan.",
                "end_time": 1676895361452,
                "id": 1110161,
                "is_user_created": true,
                "participants": [
                    {
                        "external": false,
                        "id": 2187135,
                        "object_type": "ipaddr",
                        "object_value": "0.0.0.0",
                        "role": "offender"
                    },
                    {
                        "external": true,
                        "id": 2187136,
                        "object_type": "ipaddr",
                        "object_value": "0.0.0.2",
                        "role": "victim"
                    }
                ],
                "risk_score": 50,
                "start_time": 1676895361452,
                "title": "Test_Detection_1_1676895361452",
                "type": "Test_Detection_1_1676895361452",
                "mod_time": 1676895361452
            },
            {
                "appliance_id": 0,
                "categories": [
                    "sec",
                    "sec.exploit"
                ],
                "description": "The offender was recently observed carrying out a TCP SYN Scan and has now made a successful TCP 3-way handshake to the victim device. Investigate to determine if this is the result of the SYN Scan.",
                "end_time": 1676895331451,
                "id": 1110160,
                "is_user_created": true,
                "participants": [
                    {
                        "external": false,
                        "id": 2187133,
                        "object_type": "ipaddr",
                        "object_value": "0.0.0.0",
                        "role": "offender"
                    },
                    {
                        "external": true,
                        "id": 2187134,
                        "object_type": "ipaddr",
                        "object_value": "0.0.0.2",
                        "role": "victim"
                    }
                ],
                "risk_score": 50,
                "start_time": 1676895331451,
                "title": "Test_Detection_1_1676895331451",
                "type": "Test_Detection_1_1676895331451",
                "mod_time": 1676895331451
            },
            {
                "appliance_id": 0,
                "categories": [
                    "sec",
                    "sec.exploit"
                ],
                "description": "The offender was recently observed carrying out a TCP SYN Scan and has now made a successful TCP 3-way handshake to the victim device. Investigate to determine if this is the result of the SYN Scan.",
                "end_time": 1676895301451,
                "id": 1110159,
                "is_user_created": true,
                "participants": [
                    {
                        "external": false,
                        "id": 2187131,
                        "object_type": "ipaddr",
                        "object_value": "0.0.0.0",
                        "role": "offender"
                    },
                    {
                        "external": true,
                        "id": 2187132,
                        "object_type": "ipaddr",
                        "object_value": "0.0.0.2",
                        "role": "victim"
                    }
                ],
                "risk_score": 50,
                "start_time": 1676895301451,
                "title": "Test_Detection_1_1676895301451",
                "type": "Test_Detection_1_1676895301451",
                "mod_time": 1676895301451
            }
        ]
    }
}

Human Readable Output

Found 3 Detection(s)

Detection ID	Risk Score	Description	Categories	Start Time
1110161	50	The offender was recently observed carrying out a TCP SYN Scan and has now made a successful TCP 3-way handshake to the victim device. Investigate to determine if this is the result of the SYN Scan.	sec, sec.exploit	1676895361452
1110160	50	The offender was recently observed carrying out a TCP SYN Scan and has now made a successful TCP 3-way handshake to the victim device. Investigate to determine if this is the result of the SYN Scan.	sec, sec.exploit	1676895331451
1110159	50	The offender was recently observed carrying out a TCP SYN Scan and has now made a successful TCP 3-way handshake to the victim device. Investigate to determine if this is the result of the SYN Scan.	sec, sec.exploit	1676895301451

Additional Information

ExtraHop Reveal(x) Playbooks

• ExtraHop - Default
• ExtraHop - CVE-2019-0708 (BlueKeep)
• ExtraHop - Ticket Tracking
• ExtraHop - Get Peers by Host

Use Cases

• Create incidents for every detection that ExtraHop Reveal(x) surfaces in real-time.
• Enable guided investigation and response through playbooks and automation scripts.
• Query the ExtraHop Reveal(x) REST API using the simple and powerful Cortex XSOAR CLI.