ExtraHop Reveal(x) collector
Overview
ExtraHop Reveal(x) provides complete east-west visibility, real-time threat detection inside the perimeter, and intelligent response at scale. Use this collector to send ExtraHop Reveal(x) logs to Devo.
Devo collector features
Feature | Details |
---|---|
Allow parallel downloading ( |
|
Running environments |
|
Populated Devo events |
|
Flattening preprocessing |
|
Data sources
Data source | Description | API endpoint | Collector service name | Devo table | Available from release |
---|---|---|---|---|---|
|
|
|
|
|
|
Detections |
|
|
|
|
|
For more information on how the events are parsed, visit our page.
Flattening preprocessing
Data source | Collector service | Optional | Flattening details |
---|---|---|---|
|
| yes | Not required |
|
| yes | Not required |
Minimum configuration required for basic pulling
Although this collector supports advanced configuration, the fields required to retrieve data with basic configuration are defined below.
This minimum configuration refers exclusively to those specific parameters of this integration. There are more required parameters related to the generic behavior of the collector. Check setting sections for details.
Setting | Details |
---|---|
| The hostname to ExtraHop Reveal(x) 360 API. (Ex : Base URL- |
| The ID for ExtraHop Reveal(x) 360 API. |
| The token endpoint for to get the access token. ( Ex:- |
| The secret to ExtraHop Reveal(x) 360 API |
See the Accepted authentication methods section to verify what settings are required based on the desired authentication method.
Accepted authentication methods
Authentication method | hostname | token_endpoint | client_id | secret |
---|---|---|---|---|
| REQUIRED | REQUIRED | REQUIRED | REQUIRED |
Run the collector
Once the data source is configured, you can either send us the required information if you want us to host and manage the collector for you (Cloud collector), or deploy and host the collector in your own machine using a Docker image (On-premise collector).
Collector services detail
This section is intended to explain how to proceed with specific actions for services.
Alerts
Collector operations
This section is intended to explain how to proceed with specific operations of this collector.
Change log
Release | Released on | Release type | Details | Recommendations |
---|---|---|---|---|
| Mar 21, 2024 | IMPROVEMENTS |
|
|
| Feb 20, 2024 | IMPROVEMENTS | Updated the DCSDK version to 1.11.0 |
|
| Feb 16, 2024 | FIRST RELEASE | Released the first version of the ExtraHop Revealx collector. |
|