ExtraHop - Get Peers by Host

Given a host, the playbook will retrieve the peer network devices that communicated with that host in a given time range. In addition to a list of peers and protocols (sorted by bytes) the playbook returns a link to the ExtraHop Live Activity Map to visualize the peer relationships.

ExtraHop Reveal(x) · 8 tasks · 5 inputs · 2 outputs

Inputs

  • name — The name of the device. This searches for matches on all ExtraHop name fields (DHCP, DNS, NetBIOS, Cisco Discovery Protocol, etc).
  • ip — The IP address of the device.
  • mac — The MAC address of the device.
  • from_time — The beginning timestamp of the time range the playbook will use to search, expressed in seconds since the epoch.
  • until_time — The ending timestamp of the time range the playbook will use to search, expressed in seconds since the epoch.

Outputs

  • ExtraHop.Device — Details on the host and any peer devices found.
  • ExtraHop.ActivityMap — The link to a visual activity map in ExtraHop.

Commands used

extrahop-activity-map-get extrahop-devices-search extrahop-peers-get

Flowchart

yes yes yes yes Start Start Done Done Search for peer devices in ExtraHop Reveal(x) - extrahop-peers-get Search for peer devices i... extrahop-peers-get Search for device in ExtraHop Reveal(x) - extrahop-devices-search Search for device in Extr... extrahop-devices-search Is there a host? Is there a host? Was a device found? Was a device found? Is ExtraHop Reveal(x) enabled? - Exists Is ExtraHop Reveal(x) ena... Exists Get a link to a live activity map in ExtraHop Reveal(x) - extrahop-activity-map-get Get a link to a live acti... extrahop-activity-map-get