Extrahop
ExtraHop is a network detection and response platform that provides real-time visibility and analytics for enhanced security operations.
ExtraHop provides advanced network detection and response capabilities, enabling organizations to monitor and secure their network environments effectively. The ExtraHop connector for Swimlane Turbine allows users to automate the extraction of device lists, retrieval of alerts, and querying of records from ExtraHop, enhancing visibility and response times. By integrating ExtraHop with Swimlane Turbine, users can streamline their security operations, improve threat detection, and automate responses to network anomalies, all within a low-code environment.
Prerequisites
Before you can use the ExtraHop connector for Turbine, you'll need access to the ExtraHop API. This requires the following:
- an API key authentication using the following parameters:
- URL: The endpoint URL for accessing the ExtraHop API.
- API Key: A valid API key for authenticating requests to the ExtraHop platform.
Capabilities
This connector provides the following capabilities:
- Extract Device List
- Get Alerts
- Query Records
- Search for Device
Notes
Additional Documentation
Configurations
ExtraHop API Key Authentication
Authenticates using an ExtraHop API Key
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. IE https://seattle-eda/ | string | Required |
x-apikey | API key | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Extract Device List
Extract the list of devices discovered by the ExtraHop sensor or console.
Endpoint
- URL: /api/v1/devices
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.limit | number | Optional | Parameters for the Extract Device List action |
parameters.offset | number | Optional | Parameters for the Extract Device List action |
parameters.search_type | string | Optional | Parameters for the Extract Device List action |
Input Example
{"parameters":{"limit":10,"offset":0,"search_type":"any"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}
Get Alerts
Retrieve all alerts from ExtraHop for monitoring and analysis.
Endpoint
- URL: /api/v1/alerts
- Method: GET
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
apply_all | boolean | Output field: apply_all |
author | string | Output field: author |
categories | array | Output field: categories |
cc | array | Output field: cc |
cc.file_name | string | Name of the resource |
cc.file | string | Output field: cc.file |
description | string | Output field: description |
disabled | boolean | Output field: disabled |
field_name | string | Name of the resource |
field_name2 | string | Name of the resource |
field_op | string | Output field: field_op |
id | number | Unique identifier |
interval_length | number | Output field: interval_length |
mod_time | number | Time value |
name | string | Name of the resource |
notify_snmp | boolean | Output field: notify_snmp |
object_type | string | Type of the resource |
operand | string | Output field: operand |
operator | string | Output field: operator |
param | object | Output field: param |
param2 | object | Output field: param2 |
protocols | array | Output field: protocols |
refire_interval | number | Output field: refire_interval |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"apply_all":true,"author":"string","categories":["string"],"cc":[],"description":"string","disabled":true,"field_name":"string","field_name2":"string","field_op":"string","id":0,"interval_length":0,"mod_time":0,"name":"string","notify_snmp":true,"object_type":"string"}}
Query Records
Query records stored on an ExtraHop recordstore using the provided data body.
Endpoint
- URL: /api/v1/records/search
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
data_body | object | Required | Response data |
data_body.context_ttl | number | Optional | Response data |
data_body.from | string | Optional | Response data |
data_body.filter | object | Optional | Response data |
data_body.filter.field | string | Optional | Response data |
data_body.filter.operator | string | Optional | Response data |
data_body.filter.operand | object | Optional | Response data |
data_body.filter.operand.type | string | Optional | Response data |
data_body.filter.operand.value | string | Optional | Response data |
Input Example
{"data_body":{"context_ttl":10,"from":"-30m","filter":{"field":"ex.isSuspicious","operator":"=","operand":{"type":"boolean","value":"true"}}}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}
Search for Device
Search through all discovered devices on your ExtraHop sensor or console by specifying your criteria.
Endpoint
- URL: /api/v1/devices/search
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
data_body | object | Required | Response data |
data_body.filter | object | Optional | Response data |
data_body.filter.field | string | Optional | Response data |
data_body.filter.operand | string | Optional | Response data |
data_body.filter.operator | string | Optional | Response data |
Input Example
{"data_body":{"filter":{"field":"ipaddr","operand":"10.10.10.200","operator":"="}}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}
Response Headers
Header | Description | Example |
|---|---|---|
Content-Type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |