ExtraHop Reveal(x) can improve regarding integration capabilities. For instance, the market is getting really flooded with Microsoft Sentinel, and I know there is an integration possible, but the tools on the market right now indicate that integration should not be a skill from an integrator point of view. It should be quite easy for customers to integrate that solution into SOCs, SIEMs, or any other integration with other tools. There are various integrations from which there's a manual on how to do it, but specifically, the Microsoft portfolio, particularly Sentinel, integration is not yet there. If you score them on a scale of one to ten, ExtraHop scores around a 7.5 to an 8 on an integration basis, but there's actually room for improvement on that side. In the older days, ExtraHop had a license model where you could do all you can eat, so if you had a sensor with 10 gig of capacity, you could use all the entire 10 gig of throughput. They changed that to an asset-based license model, and that's an absolute downside of the solution, where it is harder for smaller companies to acquire the solution itself. That has given us quite some problems in positioning the solution properly within the network, so the licensing model is an absolute downside where they need to improve.
Assistant VP, Idm Compliance at a financial services firm with 1,001-5,000 employees
Real User
Top 5
May 29, 2025
I would like to see improvements in areas where events are getting dropped; we're not able to view complete insights. For example, if I'm sending communication from one place to another while passing multiple security controls, it's not giving a complete flow easily. It shows one communication from the firewall, then one from the firewall to the proxy, and one from the proxy to the user endpoint as separate communications. There's no way to uniquely correlate that this is the same communication happening throughout that packet flow.
Network Consultant at a non-profit with 201-500 employees
Consultant
Top 10
Oct 31, 2024
We expect regular firmware patches for upgrades and maintenance. Currently, we have to check manually as we do not receive any notifications about new patches, maintenance, or firmware releases. It would be beneficial if they could send us notifications for new releases and maintenance trials.
Account Manager at a tech services company with 11-50 employees
Reseller
Oct 31, 2023
The solution's reporting part and GUI are areas with certain shortcomings where improvements are required. Response time is an area where the product's technical support team must make improvements. The product's price could be more flexible.
Information Security Assurance Engineer at School District of Lee County
Real User
Sep 7, 2022
There is a little training online, but it'd be cool if ExtraHop provided certifications. CrowdStrike does elective training that gives you a certification as a Falcon administrator. It'd be nice to see ExtraHop have something like that
Technical Account Manager at a security firm with 501-1,000 employees
Real User
Aug 2, 2022
I can't think of anything right now. They meet all of my customers' requirements. Additional integration partners would be beneficial. I would like to see more cloud capability.
Senior monitoring engineer at a financial services firm with 10,001+ employees
Real User
Jul 11, 2022
Agent management could certainly use some focus. It should also be a little bit easier to work with collections. We should be able to nest collections within collections. There should be better nesting. The beautiful thing about the company that runs ExtraHop is that when we go to them with feature requests or with things that we would like to see, they're really good at getting them added. The most recent one that we're looking for is being able to limit the packets that users can download. So, if you're an administrator, you should be able to download a full packet capture with the full packet, but if you're just an engineer or an application person just looking at your application header traffic, you don't need to see any payload data. We want to be able to limit that traffic. We want to limit who can see the payload, and we can do that. The vendor is putting that into the tool for us. It's going to be done before the end of the year.
Sales Engineer | Technical Sales | Pre-Sales at SUSE
Vendor
Aug 12, 2020
Netflow - Processing Netflow can be cumbersome as it requires triggers to truly gain value and insight. This in turn can add a bit of load to the hardware. The focus of ExtraHop Reveal (x) is live packet data. Triggers - While the triggers are great for specific use cases, it can add load to the hardware and requires some development skill, which can be costly. VoIP - While we can view SIP and RTP (quality, MOS, etc.) it is not the best solution for VoIP itself. There are better solutions for more detailed VoIP monitoring. It can solve some problems, but not all problems.
Technical Account Manager at a security firm with 501-1,000 employees
Real User
Jul 5, 2020
At this point, there aren't any features that are lacking, from our perspective. The solution is pretty complete. The solution is expensive and gets more expensive if a company needs to scale it.
ExtraHop Reveal(x) offers advanced network visibility and threat detection through seamless integration with CrowdStrike. It enhances security with machine learning-driven behavioral analysis and customizable dashboards.ExtraHop Reveal(x) excels in network detection and response by decrypting SSL traffic and providing real-time packet inspection. Users benefit from its dynamic triggers and historical data tracing. The platform is valued for its depth of information, powerful analytics, and...
ExtraHop Reveal(x) can improve regarding integration capabilities. For instance, the market is getting really flooded with Microsoft Sentinel, and I know there is an integration possible, but the tools on the market right now indicate that integration should not be a skill from an integrator point of view. It should be quite easy for customers to integrate that solution into SOCs, SIEMs, or any other integration with other tools. There are various integrations from which there's a manual on how to do it, but specifically, the Microsoft portfolio, particularly Sentinel, integration is not yet there. If you score them on a scale of one to ten, ExtraHop scores around a 7.5 to an 8 on an integration basis, but there's actually room for improvement on that side. In the older days, ExtraHop had a license model where you could do all you can eat, so if you had a sensor with 10 gig of capacity, you could use all the entire 10 gig of throughput. They changed that to an asset-based license model, and that's an absolute downside of the solution, where it is harder for smaller companies to acquire the solution itself. That has given us quite some problems in positioning the solution properly within the network, so the licensing model is an absolute downside where they need to improve.
I would like to see improvements in areas where events are getting dropped; we're not able to view complete insights. For example, if I'm sending communication from one place to another while passing multiple security controls, it's not giving a complete flow easily. It shows one communication from the firewall, then one from the firewall to the proxy, and one from the proxy to the user endpoint as separate communications. There's no way to uniquely correlate that this is the same communication happening throughout that packet flow.
We expect regular firmware patches for upgrades and maintenance. Currently, we have to check manually as we do not receive any notifications about new patches, maintenance, or firmware releases. It would be beneficial if they could send us notifications for new releases and maintenance trials.
I think the tuning capabilities could be improved. We're working on minimizing false positives. Apart from that, everything seems fine to me.
The solution's reporting part and GUI are areas with certain shortcomings where improvements are required. Response time is an area where the product's technical support team must make improvements. The product's price could be more flexible.
The solution’s pricing could be improved.
They should integrate the solution with more security vendors.
The solution should include more support protocols. The solution should be less expensive.
There is a little training online, but it'd be cool if ExtraHop provided certifications. CrowdStrike does elective training that gives you a certification as a Falcon administrator. It'd be nice to see ExtraHop have something like that
I can't think of anything right now. They meet all of my customers' requirements. Additional integration partners would be beneficial. I would like to see more cloud capability.
Agent management could certainly use some focus. It should also be a little bit easier to work with collections. We should be able to nest collections within collections. There should be better nesting. The beautiful thing about the company that runs ExtraHop is that when we go to them with feature requests or with things that we would like to see, they're really good at getting them added. The most recent one that we're looking for is being able to limit the packets that users can download. So, if you're an administrator, you should be able to download a full packet capture with the full packet, but if you're just an engineer or an application person just looking at your application header traffic, you don't need to see any payload data. We want to be able to limit that traffic. We want to limit who can see the payload, and we can do that. The vendor is putting that into the tool for us. It's going to be done before the end of the year.
Netflow - Processing Netflow can be cumbersome as it requires triggers to truly gain value and insight. This in turn can add a bit of load to the hardware. The focus of ExtraHop Reveal (x) is live packet data. Triggers - While the triggers are great for specific use cases, it can add load to the hardware and requires some development skill, which can be costly. VoIP - While we can view SIP and RTP (quality, MOS, etc.) it is not the best solution for VoIP itself. There are better solutions for more detailed VoIP monitoring. It can solve some problems, but not all problems.
At this point, there aren't any features that are lacking, from our perspective. The solution is pretty complete. The solution is expensive and gets more expensive if a company needs to scale it.