Publisher: Splunk
Connector Version: 2.0.0
Product Vendor: ExtraHop Networks
Product Name: ExtraHop
Product Version Supported (regex): ".*"
Minimum Product Version: 5.3.0

This app integrates with the ExtraHop platform to perform investigative actions based on real-time network data

For ExtraHop installation and configuration instructions visit bundles.extrahop.com .

The Splunk SOAR integration for ExtraHop enables you to automate and orchestrate rapid security investigation, response, and remediation workflows. ExtraHop Reveal(x) provides a uniquely rich, real-time data source by turning unstructured packets into structured wire data and analyzing it in real-time. Based on this data, you can confidently configure Splunk SOAR to automate security workflows and investigations and orchestrate precise, rapid responses to security threats more effectively than ever before.

Extrahop and Splunk SOAR connect through simple, powerful REST APIs, making it easy to build and iterate new use cases to get the most value for the least effort, a vital capability for thinly stretched enterprise security teams.

The below configuration variables are required for this Connector to operate. These variables are specified when configuring a ExtraHop asset in SOAR.

test connectivity - Validate the asset configuration for connectivity using supplied configuration
get device info - Get device details from ExtraHop
get peers - Get a list of peers that a device communicated with within the last N minutes
get protocols - Get a list of protocols that a device communicated in the last N minutes
get devices - Get a list of newly discovered devices
create device - Create a new custom device on the ExtraHop
tag device - Tag an existing device on the ExtraHop

Validate the asset configuration for connectivity using supplied configuration

Type: test
Read only: True

No parameters are required for this action

No Output

Get device details from ExtraHop

Type: investigate
Read only: True

This action will get more details about a device given its IP address. Details include MAC address, dhcp name, first discovered time, device type, and more.

Get a list of peers that a device communicated with within the last N minutes

Type: investigate
Read only: True

This action retrieves a list of all of the peers that a device communicated with within the last N minutes, optionally filtered by role and/or protocol. Either 'ip' or 'eh_api_id' parameter is required. If both the parameters are provided, 'eh_api_id' will be considered.

Get a list of protocols that a device communicated in the last N minutes

Type: investigate
Read only: True

This action retrieves a list of all of the protocols that a device communicated over the last N minutes, optionally filtered by role. Either 'ip' or 'eh_api_id' parameter is required. If both the parameters are provided, 'eh_api_id' will be considered.

Get a list of newly discovered devices

Type: investigate
Read only: True

This action retrieves a list of newly discovered devices classified in a particular activity group that first communicated on your network in the last N minutes.

Create a new custom device on the ExtraHop

Type: generic
Read only: False

This action will create a new custom device on the ExtraHop appliance with a single IP address. This action is expected to be used with endpoints, which are not typically tracked individually with full analysis.

Tag an existing device on the ExtraHop

Type: generic
Read only: False

This action will tag a device on the ExtraHop appliance. Normally tags are used to control device membership in dynamic groups. Either 'ip' or 'eh_api_id' parameter is required. If both the parameters are provided, 'eh_api_id' will be considered.