ExtraHop Reveal(x) 360 Reviews

I use ExtraHop Reveal(x) 360 as our cloud-native NDR platform, with primary use cases including monitoring real-time network traffic across the north-south environment. While we do not currently focus on east-west traffic, we have plans to enable that capability in our roadmap for upcoming quarters. Additionally, we address advanced threats such as lateral movement and insider threats. We also use the platform for visibility of all encrypted traffic deployed with endpoint agents, supporting incident response investigations integrated with our SIEM and cross-functional threat intelligence sources.

Our SOC team has highlighted several scenarios demonstrating how ExtraHop Reveal(x) 360 helps with incident response investigations. One major threat involved an open port that was not supposed to be part of our standards, which was detected and resolved.

ExtraHop Reveal(x) 360 offers AML-based behavioral detection, good integration with SIEM and SOAR platforms such as Splunk and QRadar, and contextual metadata for faster triage through alerting mechanisms. The platform provides agentless traffic analysis for packet-level visibility and features a cloud-native SaaS architecture that eliminates the need for heavy on-premises management, making these features stronger compared to competitors in the market.

The behavioral detection that our SIEM identified was enhanced by ExtraHop Reveal(x) 360, providing an in-depth summary of a specific host. The process was quicker than expected, consuming less than a day for complete approvals, isolation, and resolution.

One challenge with ExtraHop Reveal(x) 360 is its pricing, which tends to be comparatively high in the marketplace. Initial setup requires significant effort to get the platform tuned up to speed, which can be difficult. Additionally, the dashboards could benefit from enriched customizations, advanced features for learning, and detailed documentation to assist with complex integrations.

I have been using ExtraHop Reveal(x) 360 for close to three and a half years, deploying it in our cloud environments, specifically in Azure and AWS, while we maintain a different solution on-premises for our cloud detection and response needs.

ExtraHop Reveal(x) 360 performs stably under high traffic loads. While there is a cost associated with the load sent, the cloud-hosted analytics layer alleviates infrastructure-related performance bottlenecks, enhancing visibility into encrypted traffic and making the platform more suitable for hybrid and large enterprise networks such as ours.

The platform has proven to be stable and performs consistently even under high traffic loads. Quick auto-upgrade solutions for sensors prevent any major disruptions and mitigate infrastructure-related performance bottlenecks.

ExtraHop Reveal(x) 360's scalability is well-defined, facilitating ease of growth for enterprise environments. The cloud-native architecture manages large traffic volumes across distributed settings without significant performance degradation, allowing us to add more sensors as needed.

The support we receive from ExtraHop is very good, responsive, and knowledgeable.

ExtraHop support provides dedicated engineers who check in bi-weekly, demonstrating knowledge and responsiveness. They address technical gaps by consulting their internal engineering team to deliver solutions during onboarding and tuning.

We did not use any solution prior to ExtraHop Reveal(x) 360, but we evaluated a few options including Vectra AI. We recognized ExtraHop's stronger depth in packet-level visibility and encrypted traffic analysis as the key factors in our choice.

One challenge with ExtraHop Reveal(x) 360 is its pricing, which tends to be comparatively high in the marketplace. Initial setup requires significant effort to get the platform tuned up to speed, which can be difficult.

I evaluated Vectra AI and another solution, likely involving Cisco. However, ExtraHop's depth of packet-level visibility and encrypted traffic analysis made it the standout option.

We have covered most of the features over the past three years and look forward to discovering more as we work closely with the ExtraHop technical team, who are open to sharing what they have developed.

Pricing is on the higher side, typically based on load, volume of traffic, and deployment scale. The advanced detection capabilities provide significant value in reducing investigation time, making the licensing and pricing acceptable for larger organizations.

ExtraHop Reveal(x) 360 has undeniably improved our security posture, reduced manual investigation efforts, and facilitated fast threat detection mechanisms, which all help prevent costly potential breaches in enterprise environments.

ExtraHop Reveal(x) 360's SaaS environment is well-suited for cloud, on-premises, and hybrid environments, effectively addressing real-life scenarios involving east-west and north-south traffic. The platform is recommended for large organizations in need of comprehensive detection capabilities. I would rate this product overall as an 8 out of 10.

Public Cloud

Other

The main use case for me is to get network detection and response as we are migrating many network devices, so we get a very broad idea about all the information that we may miss normally from this product and get all the security alerts and incidents recorded and investigated through that and have a very clear picture of any issues that bother us during the migration.

In this project, while we connect the devices from the old system to the new system, it gives us a great view to understand the threats or risks that might be on the old devices and helps us to mitigate those alerts and to respond to those security threats and to improve on them. Plus, it gives us a clear picture of what work we will need to do during and after the migration.

It also helps us to control the lateral movements of the devices by securing them, and we also get the asset discovery and network visibility through that. Last but not least, it helps us to do threat hunting as well.

In my experience, the features that are available with ExtraHop Reveal(x) 360, one of the best features I have seen is their dashboard in the NDR, the way it shows you and how you can deeply dive into protocol level settings. Plus, it helps to do asset discovery and profiling. It also has good behavioral AI and ML related pattern recognition, and I have also seen it does a very good job in terms of advanced decryption, plus lateral movement detections and packet forensics. One other thing I have noticed it does is threat hunting and MITRE ATT&CK mapping.

In terms of the dashboard, the key features focused on the network security team are basically security overview, posture, the active detections, its risk levels, and severities it's showing, so during the migration, we can see the overall security posture of the devices and network and also understand the detection dashboard from the high critical or critical detections and suspicious behavior of the devices, any sort of credential attacks I have seen, or policy and security violations. Also, we can see the top communicating devices in it as well.

I think what we can add more is the application network performance area in that as well, so in terms of any issues with applications I have seen, we can mitigate that and we have seen we can pinpoint what can be the root cause during that application flow, specifically looking at the application response time, the network latency, errors, throughputs, and application dependencies in that.

In terms of workload and pinpointing issues, ExtraHop Reveal(x) 360 has helped us a lot and made our life as network Level 3 support easier. As most of the application-related issues were really hard to troubleshoot, we have now real-time visibility. We can do deep level, protocol level analysis from Layer 2 to Layer 7, and we can have automatic threat detection and we have investigation workflows. We can do integration from the new environments easily, and we can integrate it with our SIEM which is Splunk easily, plus we have operational collaboration. So it has made our life very easy.

In terms of improvement, I have found sometimes ExtraHop Reveal(x) 360 duplicates data a bit because it basically spans the data information from the sources within the network, so sometimes it's very hard to correlate data because it sometimes gets multiple feeds. I would to say that it needs to have some sort of internal check to validate data rather than duplicating from multiple sources so that we don't have to manually correct the source of truth.

Plus, I think I would like to see continued improvements in AI-assisted threat hunting and natural language queries so the analysts can move from high-level detection to the relevant user, device, application, and network evidence with fewer manual pivots. Making advanced features easier for less experienced analysts to use would help organizations to get more value from the platforms.

I would like to add one more thing: if we could have more customization of dashboards and role-based views, stronger out-of-the-box correlations with SIEM, EDR, and identity platforms, and maybe further automation of investigation response workflows, that will be great.

I have been using ExtraHop Reveal(x) 360 for around three years now, and I have worked on it in my previous company with Cleanaway Private Limited as well as I'm working on it now, and we are working on the NDR module to get network detection and response from it.

I have seen only once or twice that ExtraHop Reveal(x) 360 has gone offline. Other than that, it's pretty much stable as per my understanding.

In terms of scalability, I have seen that ExtraHop Reveal(x) 360 can be easily scaled up as it has a lot of potential.

Customer support for ExtraHop Reveal(x) 360 was fantastic. I have worked with multiple account managers as well, and they have all been great and no problems with them.

I did not use any solution previously. Before ExtraHop Reveal(x) 360, to be honest, I did not have a lot of options as not a lot of solutions were there in the market. I think only one of the solutions we were getting around was Cisco's ThousandEyes. But the main reason for preferring ExtraHop was it was more suitable for our needs as we were mostly buying smaller companies, and we needed to get a lot of quick analysis done all the time through their quick network connectivity. The ThousandEyes solution was not easy to implement all the time on a quick basis, and plus, its features were mostly restricted to the application-based issues and application latencies, but whereas in ExtraHop Reveal(x) 360, we had a lot more analysis and understanding of more issues. That's why we opted for ExtraHop.

In terms of our environment, we deployed ExtraHop Reveal(x) 360 as on-premise completely, as we were trying to basically merge and join multiple networks into our network in the data center. We deployed two big boxes of their devices to span all the data onto it to get all the feeds and data analyzed on that, so this was done on-premises.

My advice to other users who want to use ExtraHop Reveal(x) 360 is to go and procure it with confidence if you know what purpose you are trying to achieve from it. It's definitely a product to go through, and you won't be disappointed.

Regarding governance and security, I would say that though I'm not using the AI part a lot, it does help in the context of the AI. It has two useful angles: AI security and AI governance, which I have seen. It shows that it has controls in AI governance, such as approved AI tools, models, data classification, and access control. So if employees are using an external Gen AI service, we will need to get control over them, but with ExtraHop Reveal(x) 360, it comes with the AI security and AI governance as per my understanding.

In terms of the accuracy and reliability of the AI's capabilities, I would distinguish between generative and AI threat detection and such assistants. In terms of the behavioral machine language, it's very strong for identifying deviations from established network behavior and detecting anomalous activities. If you talk about threat detection, it combines the machine language and behavioral detections with signature detection, giving it coverage for both known and behavioral threats. In terms of accuracy, I would not claim that ExtraHop Reveal(x) 360's AI is 100% accurate or quote a generic accuracy percentage; cybersecurity AI's quality depends heavily on network visibility. ExtraHop itself uses a review process for detection types, evaluating them for efficiency and accuracy before progressively making them available. Where I think AI is particularly strong is in network behavioral analysis.

I would rate this review a 9 out of 10.

My main use case for ExtraHop Reveal(x) 360 is primarily to detect devices and any abnormal activity on our network and on our client network.

A specific example of how I use ExtraHop Reveal(x) 360 to detect abnormal activity is when users attempt to upload documents outside of the network. We detect that activity from ExtraHop.

ExtraHop Reveal(x) 360 has been providing extensive networking details that give us insight into our network traffic. Even though we have XDR and SIEM tools, the NDR platform provides more visibility, especially since we have core switches, routers, and firewalls.

The best features ExtraHop Reveal(x) 360 offers include device detection. In large environments, we do not detect all devices, and when we implement this solution, we can see what devices are present in our environment, including users bringing devices from outside their home and plugging them into our network. This is a valuable feature.

The device detection feature works easily for me. Sometimes users are unaware of bringing their own devices from home, and we need to detect those. We miss some devices when we do not install our other security tools. In this scenario, this feature is quite helpful for us.

It is helpful to understand the MITRE framework with ExtraHop Reveal(x) 360. It shows if there is malicious activity or abnormal activity, and we can analyze through MITRE and those frameworks, which is quite helpful for understanding and investigating the network.

ExtraHop Reveal(x) 360 has positively impacted my organization by helping us detect abnormal activity on our network that we could not detect through our SIEM or XDR platform. This improves our security posture within our network.

The specific outcomes I noticed with ExtraHop Reveal(x) 360 include detecting abnormal traffic movement and lateral movement occurring on the network. A SIEM tool might take time to detect these, but ExtraHop performs well in this scenario.

I would like to see ExtraHop Reveal(x) 360 improved by integrating XDR features with NDR. Having one platform for both would make it a great product for the organization and for the market as well.

I have been using ExtraHop Reveal(x) 360 for around one year now.

In my experience, ExtraHop Reveal(x) 360 is stable, and I have not experienced any downtime.

ExtraHop Reveal(x) 360's scalability is very good, and I have not experienced any issues as my organization grows.

The customer support for ExtraHop Reveal(x) 360 has been good for me. Currently, I have not had any issues to reach out to your team, so I cannot comment further.

I have seen a return on investment with ExtraHop Reveal(x) 360. From a time-saving point of view, it is a very good tool, and we can save on human intervention, meaning less manual intervention is needed.

I would advise others looking into using ExtraHop Reveal(x) 360 that if you have a major environment where you cannot identify or control your devices, especially within your network, it is better to use ExtraHop features to improve your security posture. I would rate this product a 9 out of 10.

Public Cloud

Google

We were seeking a solution that can effectively identify security incidents within our networks, providing a level of visibility that surpasses what other products with agents currently offer. Additionally, we have a critical need for robust asset management capabilities. Traditional agent-based products fall short in comparison to what we can automatically glean from our network. Our third priority lies in network hardening. We aim to rapidly identify vulnerabilities and weaknesses, a task that has historically been time-consuming or, in some cases, nearly impossible. The ability to receive comprehensive information within a mere three minutes is crucial for enhancing our network security posture.

We only used it on PoV. But we have already easily identified the places that need attention. So we can say that the product starts bringing valuable data to the company from the very first minutes of use.

Additionally, I would like to mention the option to purchase an additional NPM licence which enables the statistics and network metrics module for NOC. For example, this solution will help in troubleshooting network and AD.

It stands out for its intuitive and efficient user interface, robust detection capabilities with minimal false positives, and the ability to handle encrypted traffic, making it a valuable asset for network security and management. Its strengths lie in its outstanding user interface, streamlined implementation, and efficient ongoing support. With a commendably low false positive rate, it minimizes operational efforts, allowing for quick comprehension and configuration. A notable advantage is its licensing based on MAC addresses, providing a more accurate representation of real devices and potential cost savings.

The NDR feature analyzes network traffic, creating records with connection details. While these records offer insights, there's a limitation in investigating payloads directly. ExtraHop provides an option for an additional server to save payloads, but its temporary storage has constraints. Unlike some competitors, it lacks an automatic payload-saving feature for each detection, presenting an improvement opportunity. Suggested enhancement involves the main sensor prompting payload storage for specific detections, streamlining the investigation process, and contributing to a more efficient workflow. A drawback includes packet storage limitations for payload data, necessitating timely extraction for thorough investigations.

I have been working with it for several weeks.

Occasionally, when I click on a link, I receive a page error, and after a few refreshes, it starts working again. I'm unsure whether the issue lies on my side or theirs, and we need to identify the cause. It's worth noting that this happens infrequently, and the rest of the system operates smoothly without any errors.

The solution scales well, supports network traffic analysis in the cloud. Of course, it is limited due to the limitations of the cloud itself. The servers are very powerful. For example, a 1U server can handle 25 Gbps of traffic. When there are solutions that require 2 2U servers for such performance.

We used LogRhythm NetMon, but it had reached its life cycle and had basic functionality.

The initial setup was straightforward.

The implementation process was swift, taking only an hour. After receiving sign-up emails, I completed a questionnaire, discussed the architecture, and a dedicated environment with the correct naming was promptly set up. Upon receiving an invitation, I set a password, and enabled Multi-Factor Authentication, gaining full access to the client environment. A server arrived via post, and following documentation instructions, I installed it in our data center, handling all cabling. During a call with a technical engineer, we configured the server together, initiating data transmission to the cloud environment. In the cloud, I easily customized settings and added users and the essential setup was complete.

The pricing is dependent on the network size, typically falling into the six-digit range. When compared to other solutions, it aligns with the market average, indicating a competitive pricing level.

Yes. LogRhythm NDR and DarkTrace.

I recommend prioritizing demos over POCs when engaging with vendors. Organizing POCs involves significant time and resource investments for both parties. Instead, invest time in multiple demo sessions, exploring the product in various scenarios and comparing capabilities against a predefined list of success criteria. Create a detailed success criteria list initially. Identify a top vendor based on these criteria, saving time and resources. Overall, I would rate it nine out of ten.

Private Cloud

The solution is primarily used for network detection and response. We collect network traffic with it.

We can use the solution for detection, which is quite helpful. We can see if some port is connected that shouldn't be. There's machine learning that helps with detection. 

The initial setup is very easy.

It is scalable.

The solution is very stable. 

There needs to be more support.

We'd like to see more protocols. There are some basic protocols, however, there needs to be more. 

I've used the solution for one and a half years. 

It's very stable. There are no bugs or glitches. It doesn't crash or freeze. You don't need to upgrade in order to get better performance. 

The solution is scalable. It's easy to expand the storage of the cloud as needed. Of course, it will cost extra if you expand.

We have 200 to 300 people using the solution. 

I haven't directly dealt with technical support. We just use the solution to detect and respond and reach out to the client if we see anything. The solution does seem to need more support in general. 

The solution is straightforward to implement. It's on the cloud, which makes it simple. We just send the traffic to the cloud.

It took about two to three days to have everything implemented. 

Before deployment, we just customized some desktops to provide more security. 

The licensing is paid annually. 

If a company wants to build a security operations center, this solution may help. 

I'd rate the solution eight out of ten. 

Public Cloud

It is very easy to collect and handle data in ExtraHop Reveal(X) Cloud. Integration with Big Data is also easy. Many of our customers integrate it with Big Data platforms like Splunk or Elastic.

It is also easy to handle and easy to understand.

They can include integration with SAP. Currently, no vendor provides network performance monitoring in the SAP market. It is a very big market. We have around 400 customers for SAP in Korea. In the USA, there are more than 10,000 customers. 

I am a distributor. One of our customers started to use ExtraHop Reveal(X) Cloud three years ago. They are very satisfied with this product. They bought another one this year.

We have one more customer who bought this solution five years ago. They already have a very good impression of this solution. 

It is scalable. It is five times more scalable than other competitors like Riverbed. 

Their technical support is more effective and of better quality than other competitors. They have more people for service and distribution. 

Their professional service can be improved. Service is essential for customers.

It is easy to install and implement.

In Korea, game companies, telecom companies, and retail companies usually use cloud deployment. The finance and manufacturing companies use on-premises deployment.

Korean customers have a nice impression of this product. ExtraHop is a leading vendor in Korea. It may be number one in the Network Purpose Monitoring (NPM) market in Korea. They, however, are not a large cloud company. They don't have enterprise customers. They also don't have a large customer base in the cloud environment in countries like the USA. 

I would recommend this solution. ExtraHop is a technical company. ExtraHop CEO, CMO, and CTO are technical people. They are oriented towards technology and are developing their product features for customers. They have very good skills in providing product functionality to customers.

I would rate ExtraHop Reveal(X) Cloud an eight out of ten.

On-premises