--- title: Extrahop slug: connectors/extrahop docTags: createdAt: 2026-06-09T16:29:42.998Z --- ExtraHop is a network detection and response platform that provides real-time visibility and analytics for enhanced security operations. ExtraHop provides advanced network detection and response capabilities, enabling organizations to monitor and secure their network environments effectively. The ExtraHop connector for Swimlane Turbine allows users to automate the extraction of device lists, retrieval of alerts, and querying of records from ExtraHop, enhancing visibility and response times. By integrating ExtraHop with Swimlane Turbine, users can streamline their security operations, improve threat detection, and automate responses to network anomalies, all within a low-code environment. ## Prerequisites Before you can use the ExtraHop connector for Turbine, you'll need access to the ExtraHop API. This requires the following: - an API key authentication using the following parameters: - URL: The endpoint URL for accessing the ExtraHop API. - API Key: A valid API key for authenticating requests to the ExtraHop platform. ## Capabilities This connector provides the following capabilities: - Extract Device List - Get Alerts - Query Records - Search for Device ## Notes - [ExtrHop Documentation](https://docs.extrahop.com/current/rest-api-guide/) ## Additional Documentation - [Extrahop Connector Documentation](https://docs.swimlane.com/connectors/extrahop) - [Extrahop API Documentation](https://docs.extrahop.com/current/rest-api-guide/) # Configurations ## ExtraHop API Key Authentication Authenticates using an ExtraHop API Key ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ------------------------------------------------------------------------- | -------- | ------------ | | url | A URL to the target host. IE [https://seattle-eda/](https://seattle-eda/) | string | Required | | x-apikey | API key | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Extract Device List Extract the list of devices discovered by the ExtraHop sensor or console. ### Endpoint - **URL:** `/api/v1/devices` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------ | -------- | ------------ | --------------------------------------------- | | `parameters.limit` | number | Optional | Parameters for the Extract Device List action | | `parameters.offset` | number | Optional | Parameters for the Extract Device List action | | `parameters.search_type` | string | Optional | Parameters for the Extract Device List action | ### Input Example `{"parameters":{"limit":10,"offset":0,"search_type":"any"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}` ## Get Alerts Retrieve all alerts from ExtraHop for monitoring and analysis. ### Endpoint - **URL:** `/api/v1/alerts` - **Method:** `GET` ### Output | **Parameter** | **Type** | **Description** | | ----------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `apply_all` | boolean | Output field: apply\_all | | `author` | string | Output field: author | | `categories` | array | Output field: categories | | `cc` | array | Output field: cc | | `cc.file_name` | string | Name of the resource | | `cc.file` | string | Output field: cc.file | | `description` | string | Output field: description | | `disabled` | boolean | Output field: disabled | | `field_name` | string | Name of the resource | | `field_name2` | string | Name of the resource | | `field_op` | string | Output field: field\_op | | `id` | number | Unique identifier | | `interval_length` | number | Output field: interval\_length | | `mod_time` | number | Time value | | `name` | string | Name of the resource | | `notify_snmp` | boolean | Output field: notify\_snmp | | `object_type` | string | Type of the resource | | `operand` | string | Output field: operand | | `operator` | string | Output field: operator | | `param` | object | Output field: param | | `param2` | object | Output field: param2 | | `protocols` | array | Output field: protocols | | `refire_interval` | number | Output field: refire\_interval | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"apply_all":true,"author":"string","categories":["string"],"cc":[],"description":"string","disabled":true,"field_name":"string","field_name2":"string","field_op":"string","id":0,"interval_length":0,"mod_time":0,"name":"string","notify_snmp":true,"object_type":"string"}}` ## Query Records Query records stored on an ExtraHop recordstore using the provided data body. ### Endpoint - **URL:** `/api/v1/records/search` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------- | -------- | ------------ | --------------- | | `data_body` | object | Required | Response data | | `data_body.context_ttl` | number | Optional | Response data | | `data_body.from` | string | Optional | Response data | | `data_body.filter` | object | Optional | Response data | | `data_body.filter.field` | string | Optional | Response data | | `data_body.filter.operator` | string | Optional | Response data | | `data_body.filter.operand` | object | Optional | Response data | | `data_body.filter.operand.type` | string | Optional | Response data | | `data_body.filter.operand.value` | string | Optional | Response data | ### Input Example `{"data_body":{"context_ttl":10,"from":"-30m","filter":{"field":"ex.isSuspicious","operator":"=","operand":{"type":"boolean","value":"true"}}}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}` ## Search for Device Search through all discovered devices on your ExtraHop sensor or console by specifying your criteria. ### Endpoint - **URL:** `/api/v1/devices/search` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------- | -------- | ------------ | --------------- | | `data_body` | object | Required | Response data | | `data_body.filter` | object | Optional | Response data | | `data_body.filter.field` | string | Optional | Response data | | `data_body.filter.operand` | string | Optional | Response data | | `data_body.filter.operator` | string | Optional | Response data | ### Input Example `{"data_body":{"filter":{"field":"ipaddr","operand":"10.10.10.200","operator":"="}}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{}}` # Response Headers | **Header** | **Description** | **Example** | | ------------ | ----------------------------------------------------- | ----------------------------- | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |