ExtraHop

https://docs.extrahop.com
Admin
ExtraHop is a network detection and response platform providing real-time network monitoring,...
Tokens:1,108,268
Snippets:14,346
Trust Score:10
Update:6 months ago
Show doc for...
Tokens:
Raw
### Example RPCAP Forwarder Installation

Source: https://docs.extrahop.com/26.1/rpcap

An example of the install script command with specific IP address and port.

```bash
sudo ./install.sh -k 10.10.115.215 2003
```

--------------------------------

### Define and Start VM

Source: https://docs.extrahop.com/26.1/deploy-exa-kvm

Commands to register the VM configuration and start the instance.

```bash
virsh define <EXA-5100v-<x>.xml>
```

```bash
virsh start <vm_name>
```

--------------------------------

### Install rpcapd using Windows Installation Wizard

Source: https://docs.extrahop.com/26.1/rpcap

Use this command to launch the rpcapd installation wizard on a Windows server. Ensure you replace '<version>' with the actual version number of the installer.

```bash
msiexec /i ExtraHopRemotePacketCapture–<version>.msi /lv ExtraHopRmotePacketCapture-install.log
```

--------------------------------

### HTTP GET Example

Source: https://docs.extrahop.com/26.1/extrahop-trigger-api

Example of issuing an HTTP GET request to a specified configuration and path, including query string variables.

```APIDOC
## HTTP GET Example

### Description
Issues an HTTP GET request to a named HTTP configuration and a specified path, which can include query string variables.

### Method
GET

### Endpoint
`Remote.HTTP("my_destination").get({ path: "/?example=example1&example2=my_data" })`

### Parameters
- **path** (String) - Required - The URI including query string variables.

### Request Example
```javascript
Remote.HTTP("my_destination").get( { path: "/?example=example1&example2=my_data" } );
```
```

--------------------------------

### Example VLAN Trunking Configuration

Source: https://docs.extrahop.com/26.1/deploy-eda-hyp

An example demonstrating how to set a VM network adapter to trunk mode, allowing VLANs 1 through 100 and setting VLAN 1 as the native VLAN.

```powershell
Set-VMNetworkAdapterVlan -VMName EDA1100v -Trunk -AllowedVlanIdList 1-100 -NativeVlanId 1

```

--------------------------------

### Identify Object ID from GET Response Body

Source: https://docs.extrahop.com/26.1/ids-rest-api

Example of a device object returned from a GET request, including the unique ID field.

```json
{
 "mod_time": 1448474346504,
 "node_id": null,
 "id": 10212,
 "extrahop_id": "test0001",
 "description": null,
 "user_mod_time": 1448474253809,
 "discover_time": 1448474250000,
 "vlanid": 0,
 "parent_id": 9352,
 "macaddr": "00:05:G3:FF:FC:28",
 "vendor": "Cisco",
 "is_l3": true,
 "ipaddr4": "10.10.10.5",
 "ipaddr6": null,
 "device_class": "node",
 "default_name": "Cisco5",
 "custom_name": null,
 "cdp_name": "",
 "dhcp_name": "",
 "netbios_name": "",
 "dns_name": "",
 "custom_type": "",
 "analysis_level": 1
},
```

--------------------------------

### Create Virtual Machine

Source: https://docs.extrahop.com/26.1/deploy-eca-azure

Provision the VM and attach the previously created managed disk.

```bash
az vm create --resource-group <resource group name> --public-ip-address "" --location <Azure region> 
--name <vm name> --os-type linux --attach-os-disk <disk name> --size <azure machine size>
```

```bash
az vm create --resource-group exampleRG --public-ip-address "" --location westus --name exampleVM --os-type linux 
```

--------------------------------

### HTTP GET Request Example

Source: https://docs.extrahop.com/26.1/extrahop-trigger-api

Issues an HTTP GET request to a specified configuration and path. Ensure the 'my_destination' HTTP ODS target is configured.

```javascript
Remote.HTTP("my_destination").get( { path: "/?example=example1&example2=my_data" } );
```

--------------------------------

### Default Configuration Example (RPM)

Source: https://docs.extrahop.com/26.1/eh-admin-ui-guide

An example of the default configuration file for the ExtraHop key forwarder, showing hostname, listener port, and syslog settings.

```properties
#EDA_HOSTED_PLATFORM=aws
EDA_HOSTNAME=sensor.example.com
LOCAL_LISTENER_PORT=598
SYSLOG=local3
ADDITIONAL_ARGS=''

```

--------------------------------

### GET /extrahop/firmware/previous

Source: https://docs.extrahop.com/26.1/ids-rest-api

Retrieves information about the previously installed firmware version.

```APIDOC
## GET /extrahop/firmware/previous

### Description
Retrieves information about the previously installed firmware version.

### Method
GET

### Endpoint
/extrahop/firmware/previous

### Parameters
There are no parameters for this operation.

### Response
#### Success Response (200)
- **backup_time** (Number) - The timestamp when the previous firmware was backed up.
- **version** (String) - The version string of the previous firmware.

### Response Example
```json
{
    "backup_time": 0,
    "version": "string"
}
```
```

--------------------------------

### Response Body for GET Request (Single Device)

Source: https://docs.extrahop.com/26.1/exa-rest-api-guide

The response body from a GET request for all devices includes an ID for each device. This example shows an entry for a single device.

```json
{
 "mod_time": 1448474346504,
 "node_id": null,
 "id": 10212,
 "extrahop_id": "test0001",
 "description": null,
 "user_mod_time": 1448474253809,
 "discover_time": 1448474250000,
 "vlanid": 0,
 "parent_id": 9352,
 "macaddr": "00:05:G3:FF:FC:28",
 "vendor": "Cisco",
 "is_l3": true,
 "ipaddr4": "10.10.10.5",
 "ipaddr6": null,
 "device_class": "node",
 "default_name": "Cisco5",
 "custom_name": null,
 "cdp_name": "",
 "dhcp_name": "",
 "netbios_name": "",
 "dns_name": "",
 "custom_type": "",
 "analysis_level": 1
}
```

--------------------------------

### Example Launch Configuration for Auto Scaling Groups

Source: https://docs.extrahop.com/26.1/integrate-eh-aws-cloud-formation

This example demonstrates the 'LaunchConfig' attribute for an Auto Scaling group, showing the 'UserData' section with placeholders for ExtraHop IP and Port.

```json
"LaunchConfig": {
"Type" : "AWS::AutoScaling::LaunchConfiguration",
"Metadata" : {
...
},
"Properties": {
... "UserData" : { "Fn::Base64" : { "Fn::Join" : ["", [
"#!/bin/bash -v\n",
"curl --connect-timeout 10 -k 'https://[ExtraHopIP]/tools/install-rpcapd.sh' > install-rpcapd.sh","\n",
"sh install-rpcapd.sh [ExtraHopIP] [Port]"
]]
}
}
}
}
```

--------------------------------

### Specify BPF Filter for rpcapd Installer

Source: https://docs.extrahop.com/26.1/rpcap

This example shows how to use the RPCAP_OPTSVCPARAMS option to specify a Berkeley Packet Filter (BPF) for rpcapd during installation. This filter captures packets to or from a specific IP address.

```bash
RPCAP_OPTSVCPARAMS="-F host 10.10.10.10"
```

--------------------------------

### Start and access VM console

Source: https://docs.extrahop.com/26.1/deploy-eda-kvm

Commands to initiate the VM and connect to its serial console.

```bash
virsh start <vm_name>
```

```bash
sudo virsh console <vm_name>
```

```bash
virsh console <vm_name>
```

--------------------------------

### Example: Two Interfaces by Interface Name

Source: https://docs.extrahop.com/26.1/deploy-eda-hyp

Configuration example specifying two interfaces using their interface names.

```ini
ActiveClient = 10.10.6.45, 2003, ifname=\Device\NPF_{2C2FC212-701D-42E6-9EAE-BEE969FEFB3F}
ActiveClient = 10.10.6.45, 2003, ifname=\Device\NPF_{3C2FC212-701D-42E6-9EAE-BEE969FEFB3F}
NullAuthPermit = YES
UserName = rpcapd
```

--------------------------------

### GET /alerts/{id}/stats Response Example

Source: https://docs.extrahop.com/26.1/rx360-rest-api

This JSON object represents the successful response format when retrieving statistics for a specific alert.

```json
{
    "alert_id": 0,
    "field_name": "string",
    "id": 0,
    "param": "string",
    "stat_name": "string"
}
```

--------------------------------

### Example configurations for multiple interfaces

Source: https://docs.extrahop.com/26.1/eh-admin-ui-guide

Examples of specifying multiple interfaces using names, IP addresses, or CIDR blocks.

```ini
ActiveClient = 10.10.6.45, 2003, ifname=eth0
ActiveClient = 10.10.6.45, 2003, ifname=eth1
NullAuthPermit = YES
UserName = rpcapd
```

```ini
ActiveClient = 10.10.6.45, 2003, ifaddr=10.10.1.100
ActiveClient = 10.10.6.45, 2003, ifaddr=10.10.2.100
NullAuthPermit = YES
UserName = rpcapd
```

```ini
ActiveClient = 10.10.6.45, 2003, ifaddr=10.10.1.0/24
ActiveClient = 10.10.6.45, 2003, ifaddr=10.10.2.0/24
NullAuthPermit = YES
UserName = rpcapd
```

--------------------------------

### Access HL7 Segment Field

Source: https://docs.extrahop.com/26.1/extrahop-trigger-api

Access a specific field within an HL7 segment. Remember that segment field indices start at 1, so subtract 1 to get the correct array index.

```javascript
HL7.segments[5].fields[15]
```

--------------------------------

### Example: Change Dashboard Owner with Python

Source: https://docs.extrahop.com/26.1/rest-change-dashboard-ownership

This Python script shows how to change a dashboard owner using the ExtraHop REST API. Ensure you have the 'requests' library installed and replace placeholders with your specific details.

```python
import requests

api_key = "<api_key>"
hostname = "<hostname>"
dashboard_id = "<dashboard_id>"
new_owner = "<new_owner_username>"

url = f"https://{hostname}/api/v1/dashboards/{dashboard_id}"
headers = {
    "Content-Type": "application/json"
}
data = {
    "owner": new_owner
}

response = requests.patch(url, headers=headers, data=json.dumps(data), auth=(api_key, ""))

if response.status_code == 204:
    print(f"Successfully changed owner of dashboard {dashboard_id} to {new_owner}")
else:
    print(f"Failed to change owner. Status code: {response.status_code}")
    print(response.text)
```

--------------------------------

### Kubernetes Integration Pod Status Example

Source: https://docs.extrahop.com/26.1/integrations-kubernetes

Example output showing the status of Kubernetes integration pods. The session-key-forwarder pod may not appear if it was excluded during configuration.

```bash
NAME                             READY      STATUS    RESTARTS   AGE
kubernetes-traffic-forwarder     1/1        Running   0          5m
kubernetes-metadata-forwarder    1/1        Running   0          5m
session-key-forwarder            1/1        Running   0          5m
```

--------------------------------

### Generate REST API Token with cURL

Source: https://docs.extrahop.com/current/rx360-rest-api

This example demonstrates how to generate a temporary API access token using cURL. Ensure you have cURL and jq installed. Replace placeholders with your actual HOST, ID, and SECRET.

```bash
curl -X POST \
  https://<revealx-360-hostname-or-ip-address>/oauth2/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -u "<ID>:<SECRET>" \
  -d "grant_type=client_credentials"
```

--------------------------------

### Example: Monitor Two Interfaces by IP Address

Source: https://docs.extrahop.com/26.1/deploy-eda-hyp

This configuration example shows how to monitor two network interfaces using their specific IP addresses.

```ini
ActiveClient = 10.10.6.45, 2003, ifaddr=10.10.1.100
ActiveClient = 10.10.6.45, 2003, ifaddr=10.10.2.100
NullAuthPermit = YES
UserName = rpcapd
```

--------------------------------

### Display Configuration

Source: https://docs.extrahop.com/26.1/dep-brocade-aws

Show the complete configuration after making changes.

```bash
show configuration
```

--------------------------------

### Install RPCAP on Other Linux Systems

Source: https://docs.extrahop.com/26.1/eh-admin-ui-guide

Commands for extracting and installing the packet forwarder using the provided installation script.

```bash
tar xf rpcapd-<extrahop_firmware_version>.tar.gz
```

```bash
cd rpcapd
```

```bash
sudo ./install.sh <extrahop_ip> 2003
```

```bash
sudo /etc/init.d/rpcapd status
```

--------------------------------

### Install RPCAP on RPM-based Linux

Source: https://docs.extrahop.com/26.1/deploy-eda-hyp

Use this command to install the RPCAP software on RPM-based Linux systems. Ensure you have the correct installer file name.

```bash
sudo rpm -i rpcapd-<extrahop_firmware_version>.x86_64.rpm
```

--------------------------------

### Install Session Key Forwarder via Command Line

Source: https://docs.extrahop.com/26.1/pfs-install

Use these commands to install the forwarder on a Windows server. The -q flag enables non-interactive mode, and multiple sensors can be specified as a comma-separated list.

```bash
ExtraHopSessionKeyForwarderSetup.exe -q EDA_HOSTNAME="<hostname or IP address of sensor>"
```

```bash
ExtraHopSessionKeyForwarderSetup.exe EDA_HOSTNAME="packet-sensor.example.com,ids-sensor.example.com"
```

--------------------------------

### Example Exporter Description

Source: https://docs.extrahop.com/26.1/configure-netflow

An example of providing a description for a NetFlow exporter.

```bash
description Production-Netflow-Exporter
```

--------------------------------

### Multi-interface configuration examples

Source: https://docs.extrahop.com/26.1/eh-admin-ui-guide

Examples of configuring multiple interfaces using IP addresses, CIDR blocks, or device names.

```ini
ActiveClient = 10.10.6.45, 2003, ifaddr=10.10.1.100
ActiveClient = 10.10.6.45, 2003, ifaddr=10.10.2.100
NullAuthPermit = YES
UserName = rpcapd
```

```ini
ActiveClient = 10.10.6.45, 2003, ifaddr=10.10.1.0/24
ActiveClient = 10.10.6.45, 2003, ifaddr=10.10.2.0/24
NullAuthPermit = YES
UserName = rpcapd
```

```ini
ActiveClient = 10.10.6.45, 2003, ifname=\Device\NPF_{2C2FC212-701D-42E6-9EAE-BEE969FEFB3F}
ActiveClient = 10.10.6.45, 2003, ifname=\Device\NPF_{3C2FC212-701D-42E6-9EAE-BEE969FEFB3F}
NullAuthPermit = YES
UserName = rpcapd
```

--------------------------------

### Device Filtering Examples

Source: https://docs.extrahop.com/26.1/rest-api-guide

Examples of how to filter devices based on different criteria.

```APIDOC
## Filter Devices by Tag

### Description
To select devices by tag, specify the field value as tag and the operand value as the tag name or as a regex string.

### Request Body Example
```json
{
  "filter": {
    "field": "tag",
    "operand": "Custom Tag",
    "operator": "="
  }
}
```

### Related Operation
Programmatically retrieve a list of all device tags through the GET /devices/{id}/tags operation. In the following example response, the name value for the tag is Custom Tag.

```json
[
  {
    "mod_time": 1521577040934,
    "id": 19,
    "name": "Custom Tag"
  }
]
```
```

```APIDOC
## Filter Devices by User

### Description
To select devices by user, specify the field value as user and the operand value as the username or as a regex string.

### Request Body Example
```json
{
  "filter": {
    "field": "user",
    "operand": "user@example.extrahop.com",
    "operator": "="
  }
}
```
```

```APIDOC
## Filter Devices by VLAN

### Description
To select devices by the ID of a VLAN, specify the field value as vlan and the operand value as the ID of the VLAN.

### Request Body Example
```json
{
  "filter": {
    "field": "vlan",
    "operand": "0",
    "operator": "="
  }
}
```
```

```APIDOC
## Search with Regular Expressions (Regex)

### Description
For certain field values, the string can be in regex syntax. Specify the operand value as an object that has a value parameter with the regex syntax you want to match and an is_regex parameter that is set to true. The following example selects devices with DNS names that end with com.

### Request Body Example
```json
{
    "filter":  {
        "field": "dns_name",
        "operand": {
            "value": ".*?com",
            "is_regex": true
        },
        "operator": "="
    }
}
```

### Supported Fields for Regex
An operand field with regex syntax is valid for the following field values:
  * cdp_name
  * custom_name
  * dns_name
  * dhcp_name
  * model
  * name
  * netbios_name
  * software
  * tag
  * vendor
```

```APIDOC
## Specify Multiple Criteria

### Description
You can specify multiple criteria with the rules field. The following example returns results for devices with an IP address of 192.168.12.0 or 192.168.12.1.

### Request Body Example
```json
{
  "filter": {
    "operator": "or",
    "rules": [
      {
        "field": "ipaddr",
        "operand": "192.168.12.0",
        "operator": "="
      },
      {
        "field": "ipaddr",
        "operand": "192.168.12.1",
        "operator": "="
      }
    ]
  }
}
```

### Note
You cannot specify more than 1000 rules for a device group.
```

--------------------------------

### Enter configuration mode

Source: https://docs.extrahop.com/26.1/configure-erspan-nexus-1000-v

Access the configuration terminal to begin setting up the monitor session.

```bash
Switch# config terminal
```

--------------------------------

### Enter Configuration Mode

Source: https://docs.extrahop.com/26.1/eh-cli-ref

Initiates Configuration mode on the ExtraHop system. This is the first step before executing configuration sub-commands.

```bash
extrahop#configure
```

--------------------------------

### Verify Packet Forwarder Installation

Source: https://docs.extrahop.com/26.1/deploy-eda-hyp

These commands verify that the rpcapd service is installed and running on a Debian-based system. The first command checks if the package is selected for installation, and the second checks the service status.

```bash
sudo dpkg --get-selections | grep rpcapd

```

```bash
sudo service rpcapd status

```

--------------------------------

### Example: Monitor Two Interfaces by Name

Source: https://docs.extrahop.com/26.1/deploy-eda-hyp

This configuration example shows how to monitor two network interfaces, eth0 and eth1, by their names.

```ini
ActiveClient = 10.10.6.45, 2003, ifname=eth0
ActiveClient = 10.10.6.45, 2003, ifname=eth1
NullAuthPermit = YES
UserName = rpcapd
```

--------------------------------

### install

Source: https://docs.extrahop.com/26.1/eh-cli-ref

Retrieves and uploads a firmware update from ExtraHop.

```APIDOC
## install

### Description
Retrieves and uploads a firmware update from ExtraHop.

### Parameters
#### Path Parameters
- **uri** (string) - Required - Specifies the URI of a firmware update from ExtraHop Support that is uploaded to the ExtraHop system.
```
Tokens:
Raw