ExtraHop - Get Peers by Host

Given a host, the playbook will retrieve the peer network devices that communicated with that host in a given time range. In addition to a list of peers and protocols (sorted by bytes) the playbook returns a link to the ExtraHop Live Activity Map to visualize the peer relationships.

Pack

ExtraHop

Tasks

8

Inputs

• name — The name of the device. This searches for matches on all ExtraHop name fields (DHCP, DNS, NetBIOS, Cisco Discovery Protocol, etc).
• ip — The IP address of the device.
• mac — The MAC address of the device.
• from_time — The beginning timestamp of the time range the playbook will use to search, expressed in seconds since the epoch.
• until_time — The ending timestamp of the time range the playbook will use to search, expressed in seconds since the epoch.

Outputs

• ExtraHop.Device — Details on the host and any peer devices found.
• ExtraHop.ActivityMap — The link to a visual activity map in ExtraHop.

Commands used

• extrahop-activity-map-get
• extrahop-devices-search
• extrahop-peers-get