soar
ExtraHop
Splunk SOAR Cloud
Overview
This app integrates with your ExtraHop system to gain insight into devices, traffic, and detections in your environment
Supported Actions Version 3.1.1
- test connectivity: Initiate a connection to the ExtraHop system to validate the asset configuration
- get device info: Retrieve details and properties for a device
- get peers: Retrieve a list of peers that communicated with a device
- get protocols: Retrieve a list of protocols observed on a device
- get devices: Retrieve a list of devices based on specified search criteria
- create device: Create a custom device (Reveal(x) Enterprise only)
- tag device: Tag an existing device
- get metrics: Retrieve the metrics data
- get packets: Retrieve the packets data
- on poll: Retrieve and ingest of data from the ExtraHop system
Supported Actions Version 3.1.0
- test connectivity: Initiate a connection to the ExtraHop system to validate the asset configuration
- get device info: Retrieve details and properties for a device
- get peers: Retrieve a list of peers that communicated with a device
- get protocols: Retrieve a list of protocols observed on a device
- get devices: Retrieve a list of devices based on specified search criteria
- create device: Create a custom device (Reveal(x) Enterprise only)
- tag device: Tag an existing device
- get metrics: Retrieve the metrics data
- get packets: Retrieve the packets data
- on poll: Retrieve and ingest of data from the ExtraHop system
Supported Actions Version 3.0.0
- test connectivity: Initiate a connection to the ExtraHop system to validate the asset configuration
- get device info: Retrieve details and properties for a device
- get peers: Retrieve a list of peers that communicated with a device
- get protocols: Retrieve a list of protocols observed on a device
- get devices: Retrieve a list of devices based on specified search criteria
- create device: Create a custom device (Reveal(x) Enterprise only)
- tag device: Tag an existing device
- get metrics: Retrieve the metrics data
- get packets: Retrieve the packets data
- on poll: Retrieve and ingest of data from the ExtraHop system
Supported Actions Version 2.1.0
- test connectivity: Initiate a connection to the ExtraHop system to validate the asset configuration
- get device info: Retrieve details and properties for a device
- get peers: Retrieve a list of peers that communicated with a device
- get protocols: Retrieve a list of protocols observed on a device
- get devices: Retrieve a list of devices based on specified search criteria
- create device: Create a custom device (Reveal(x) Enterprise only)
- tag device: Tag an existing device
- get metrics: Retrieve the metrics data
- get packets: Retrieve the packets data
- on poll: Retrieve and ingest of data from the ExtraHop system
Supported Actions Version 2.0.0
- test connectivity: Validate the asset configuration for connectivity using supplied configuration
- get device info: Get device details from ExtraHop
- get peers: Get a list of peers that a device communicated with within the last N minutes
- get protocols: Get a list of protocols that a device communicated in the last N minutes
- get devices: Get a list of newly discovered devices
- create device: Create a new custom device on the ExtraHop
- tag device: Tag an existing device on the ExtraHop
Supported Actions Version 1.0.4
- test connectivity: Validate the asset configuration for connectivity using supplied configuration
- get device info: Get device details from ExtraHop
- get peers: Get a list of peers that a device communicated with in the last N minutes
- get protocols: Get a list of protocols that a device communicated in the last N minutes
- get devices: Get a list of newly discovered devices
- create device: Create a new custom device on the ExtraHop
- tag device: Tag an existing device on the ExtraHop
Release Notes
Version 3.1.1
April 11, 2025
- Update Python dependencies for vulnerabilities, package updates, and platform built-in removals
- Update Python dependencies for Python 3.13 support
- Update NOTICE file with updated dependencies
- Apply pre-commit fixes
Version 3.1.0
June 12, 2023
- Added support for multiple values for detection category including a default value "sec.attack"
Version 3.0.0
March 22, 2023
- Updated artifact ingestion logic for 'Detections'
- Added new approach of configuring severity of container and artifacts based on the 'risk_score' field of detections
- Added a new field 'extrahop_link' in detections artifact
- Added a new asset configuration parameter 'Extrahop platform URL'
- Added container note of the description field while ingesting the detections
- Added support of missing 'object_value' property in the participants array of detections
- Added support of '.none' to 'detection status' configuration parameter
- Updated polling functionality for detections using 'mod_time' field
Version 2.1.0
Nov. 14, 2022
- Added Test Connectivity for Extrahop Reveal(x) 360
- Updated endpoint for device related actions
- Added 'filter'and 'json_object' parameter in the 'get devices' action
- Added 'json_object' parameter in the 'create device' action
- Added on-poll functionality for the following:
- Detections
- Metrics
- Packets
- Added two new actions
- Get metrics
- Get packets
Version 2.0.0
Sept. 1, 2022
- Compatibility changes for Python 3 support [PAPP-26198]
Version 1.0.4
Sept. 21, 2021
ExtraHop Release Notes - Published by Phantom May 11, 2018
Version 1.0.4 - Released May 11, 2018
- Initial Release