ExtraHop Reveal(x) Reviews

Being in a financial institution, we have certain regulations such as PCI DSS, so we want to ensure any connection from a non-PCA segment is not being connected to a core segment; vice versa connection should not happen. We have something called a server segment and a workstation segment, so apart from the whitelisted internet connection, no connection should be established from the server segment. These are the monitoring use cases we have implemented in ExtraHop Reveal(x) so far.

The best features of ExtraHop Reveal(x) for me are the depth it provides, especially the picturization where the connection is established; it's absolutely remarkable. If I want to know a specific IP and which server it has been connected to, it's easy to gather those kinds of trees from the NDR.

ExtraHop is very customizable, it's easy to access, and I can understand the flow where an IP address or email address has reached which level of security system; it's very easy to follow that flow.

We have IoT devices, network traffic, and all these traffic. ICT and non-ICT, all.

I am not sure about the specifics of how ExtraHop Reveal(x) has changed our approach. The cybersecurity team could elaborate more on this topic.

Initially, we deployed Reveal as a standalone solution for network detection and response. It provided us with data and analytics on server-to-server enterprise networking. We used it to gain visibility into the amount of traffic and where it's going. For example, it will say that 28 gigs of data went to Google and break that down based on all the sites that have been visited. 

It also tells you about the authentication data and helps you visualize how data moves across your network. Based on that, you can adjust the routing tables to make things work a little more evenly. It will also help you identify specific types of malware and how it moves across devices, what protocols and ports it uses, etc.

Unlike Crowdstrike, Reveal(x) doesn't require you to deploy sensors. CrowdStrike puts a sensor on the computer, so I know exactly how many devices are going through it. It's roughly 50,000. Those aren't people using it. Those are just devices that exist in the world. ExtraHop just looks at traffic, so each device connected to the network goes through it, and that's around 230,000 devices, and it's monitoring all the traffic to and from the internet.

We have a lot of other devices that do more analytics based on utilization instead of the actual configuration and management, but Reveal X gives us insight from a security standpoint into uptime, downtime, data aggregation, types of data, suspicious activity, etc.

It's used by application owners and network engineers for troubleshooting application performance issues or network performance issues.

It's a hybrid solution. We have on-prem sensors and trace appliances and a cloud control appliance.

It's a wire analytics tool. We use it for isolating and determining issues on our network or applications. It does a lot for crediting the network as opposed to discrediting the network. A lot of people come along and say that it's a network issue. It's always considered to be a network issue, but by using ExtraHop, we can quickly tell them that it's not a networking issue. It's something to do with your application or something at the other end. It could be a database issue. This tool gives us the ability to pinpoint with great accuracy the comings and goings on our network.

It's useful for different teams in our organization. The cybersecurity team uses it because it has got great analytics for anomaly detection, malware detection, and ransomware. It's used by the networking people because it's great to be able to get the three-way handshake between systems to see how your network is doing. 

The microservices for DNS use it because they like to be able to see how their DNS services are operating and how many DNS requests are being rejected, denied, or dropped. Application people love it because it fully decrypts their traffic. On the server side, they can see what's going on, how many methods are running, and which users are doing it. If there is a long-running process, what the SSL handshake looks like and how long does it take to figure out which cipher suite you're going to use and get it working.

I'm on the cybersecurity team. I do a lot of the blue threat-hunting and incident response. The things I deal with have nothing to do with network performance, but I handle the detections and things that ExtraHop Reveal(x) can pick up.

ExtraHop Reveal(x) is very easy to use and intuitive. ExtraHop Reveal(x) can pick up threats without any customization on the threat detection when none of my other tools can pick up. I've been told to make my other tools work how ExtraHop Reveal(x) works. I'm trying to get my SIEM to perform the way ExtraHop does out of the box.

For example, we're starting to ingest our DNS logs to be able to pick up on something that's called DNS tunneling. ExtraHop picks it up in the middle of it. My SIEM, however, didn't have the log. So, I have to work with the server team. It's been two-plus months trying to get those logs up and running, but I am still not there yet. The other tool I have didn't tell me for almost 24 hours.

ExtraHop was able to pick it up in the middle and detect there's DNS tunneling. ExtraHop Reveal(x) is one of the tools that works out of the box when it comes to threat hunting.

We are a healthcare organization with more than 80 facilities, but I'm the only one who uses ExtraHop. When there are performance issues with an HTTP app, ExtraHop enables us to identify the causes within a few minutes. We can see what transactions are being impacted by something that may be happening within the server environment.

We set up a number of traffic sources that are typically either ERSPANs or TAPs and place ExtraHop appliances at critical places within the network. That traffic is typically fed into a packet. We have four small devices designed to go into small data centers. We're continually rotating those around to different facilities to help identify issues. They have helped us to understand what's going on.

The ExtraHop appliance enables you to do what an expert using Wireshark can do. However, it's all in the firmware, so you can do real-time analysis without the need to boil terabytes worth of data to find out what's happening.

We've been able to leverage the information to show other vendors we use that there are issues with the SaaS solution they provide to our EMR physicians. At the top of every hour, they were doing a data recovery operation in the event of an outage of some sort. That was preventing our physicians from using the application. 

It only lasted about five minutes, but the physicians had to stop working. Of course, when they called the support desk and finally reached a support person, the vendor insisted it was our problem, not theirs. This data helped to prove it was their problem. They eventually brought in some other consultants from the hardware vendor and corrected the issue.

It can detect new attacks or expired certificates. It's especially effective in identifying Netria attacks or any other online threats that may occur.

With ExtraHop Reveal(x), it gives me more visibility into the packets. It doesn't provide the entire packet capture, but it offers more information on how connections are made at the network layer. This can be helpful for detecting network attacks. Additionally, I really like the customizable dashboards and reports. The incident dashboard and alerts provide a good summary initially, and diving deeper into them gives more detailed information. It's also great for analyzing specific attacks and victim logs. The feature that tracks the full attack chain makes it easier to monitor the progress of attacks. Plus, it's connected to the Netria.com app, which I find useful for certain tasks.           

We are using ExtraHop Reveal(x) for lateral movement and for behavioral analytics.

ExtraHop Reveal(x) has allowed us to triage the alerts as they're coming in. For example, as detections are noticed, being able to spot any issues within the application or failed access. 

We also use ExtraHop Reveal(x) for endpoint detection. The ability it has to mitigate risk from external IP addresses has been a lifesaver for us.