ExtraHop

ExtraHop v2.1.0

Home FortiSOAR Connectors ExtraHop

2.1.0

ExtraHop v2.1.0

About the connector

ExtraHop Reveal(x) network detection and response automatically discovers and classifies every transaction, session, device, and asset in your enterprise. ExtraHop helps organizations understand and secure their environments by analyzing all network interactions in real-time and leveraging machine learning to identify threats, deliver critical applications, and secure investments in the hybrid cloud.

This document provides information about the ExtraHop Connector, which facilitates automated interactions, with an ExtraHop server using FortiSOAR™ playbooks. Add the ExtraHop Connector as a step in FortiSOAR™ playbooks and perform automated operations such as retrieving alerts from ExtraHop, querying log records in ExtraHop, updating watch lists in ExtraHop, etc.

Version information

Connector Version: 2.1.0

FortiSOAR™ Version Tested on: 7.4.2-3279

ExtraHop Version Tested on: 9.4.2.1625

Authored By: Fortinet

Contributor: Parag Khatavkar

Certified: Yes

Release Notes for version 2.1.0

Following enhancements have been made to the ExtraHop Connector in version 2.1.0:

Added a new action Search Detections

Installing the connector

Use the Content Hub to install the connector. For the detailed procedure to install a connector, click here.

You can also use the yum command as a root user to install the connector:

yum install cyops-connector-extrahop

Prerequisites to configuring the connector

You must have the URL of the ExtraHop server to which you will connect and perform automated operations, and the API key used to access the ExtraHop Reveal(x) APIs.
The FortiSOAR™ server should have outbound connectivity to port 443 on the ExtraHop server.

Minimum Permissions Required

Not applicable

Configuring the connector

For the procedure to configure a connector, click here

Configuration parameters

In FortiSOAR™, on the Connectors page, click the ExtraHop connector row (if you are in the Grid view on the Connectors page) and in the Configurations tab enter the required configuration details:

Parameter	Description
Server URL	Server URL of the ExtraHop Reveal(x) server to which you will connect and perform the automated operations.
API Key	API Key configured for your account for using the ExtraHop Reveal(x) APIs.
Verify SSL	Specifies whether the SSL certificate for the server is to be verified. By default, this option is set to `True`.

Actions supported by the connector

The following automated operations can be included in playbooks and you can also use the annotations to access operations:

Function	Description	Annotation and Category
Get Alerts	Retrieves all alerts from ExtraHop.	get_alerts Investigation
Get Alert Details	Retrieves details of a specific alert from ExtraHop based on the alert ID you have specified.	get_alert_details Investigation
Create Alert	Creates a new alert in ExtraHop based on the name, severity, author, and other input parameters you have specified.	create_alert Investigation
Update Alert	Updates an existing alert in ExtraHop based on the alert ID, name, severity, and other input parameters you have specified.	update_alert Investigation
Query Records	Queries log records in ExtraHop based on the time frame and other input parameters you have specified.	query_records Investigation
Search Devices	Retrieves all devices from ExtraHop that match the search criteria you have specified.	search_devices Investigation
Get Watchlist	Retrieves all devices that are on the watchlist from ExtraHop.	get_watchlist Investigation
Update Watchlist	Adds or removes devices from the watchlist in ExtraHop based on the IP addresses or device IDs you have specified.	update_watchlist Miscellaneous
Update Detection	Updates a detection in ExtraHop based on the detection ID, ticket ID, assignee, and other input parameters you have specified.	update_detection Miscellaneous
Get Peers Devices	Retrieves all peers for a device from ExtraHop based on the device ID or IP address and other input parameters you have specified.	get_peers_devices Investigation
Get Protocols	Retrieves all active network protocols for a device from ExtraHop based on the device ID or IP address and other input parameters you have specified.	get_protocols Investigation
Tag Devices	Adds or removes a tag from devices in ExtraHop based on the IP addresses or device IDs you have specified.	tag_devices Investigation
Create Tag	Creates a new tag in ExtraHop based on the tag name you have specified.	create_tag Investigation
Search Packet	Searches for packets by specifying parameters in a URL. Input parameters include the starting timestamp, file format, etc based on which packets are searched in ExtraHop. NOTE: On successful execution of this action, an attachment of the specified file format is created in FortiSOAR.	search_packet Investigation
Get Detections	Retrieves all detections from ExtraHop.	get_detections Investigation
Get Detection By ID	Retrieves a specific detection from ExtraHop based on the detection ID specified.	get_detection_by_id Investigation
Get Detection Formats	Retrieves all detection types from ExtraHop.	get_detection_format Investigation
Create New Detection Format	Creates a new detection format in ExtraHop based on the Type, Display Name, and other parameters specified.	create_new_detection_format Investigation
Delete Detection Format	Deletes a specific detection format from ExtraHop based on the detection ID specified.	delete_detection_format Investigation
Get Detection Hiding Rules	Retrieves all tuning rules from ExtraHop.	get_detection_rules_hiding Investigation
Update Detection Format	Updates a specific detection format in ExtraHop based on the detection format ID and other parameters specified.	update_detection_format Miscellaneous
Update Associated Ticket	Updates a ticket associated with detection in ExtraHop based on the ticket ID, assignee, status, and resolution specified.	update_associated_ticket Investigation
Search Detections	Retrieves detections that match the specified search criteria in ExtraHop.	search_detections Investigation

operation: Get Alerts

Input parameters

None.

Output

The output contains the following populated JSON schema:

[
    {
        "apply_all": "",
        "author": "",
        "categories": [],
        "cc": [],
        "description": "",
        "disabled": "",
        "field_name": "",
        "field_name2": "",
        "field_op": "",
        "id": "",
        "interval_length": "",
        "mod_time": "",
        "name": "",
        "notify_snmp": "",
        "object_type": "",
        "operand": "",
        "operator": "",
        "param": {},
        "param2": {},
        "protocols": [],
        "refire_interval": "",
        "severity": "",
        "stat_name": "",
        "type": "",
        "units": ""
    }
]

operation: Get Alert Details

Input parameters

Parameter	Description
Alert ID	Specify the unique identifier for the alert whose details you want to retrieve from ExtraHop.

Output

The output contains the following populated JSON schema:

{
    "apply_all": "",
    "author": "",
    "categories": [],
    "cc": [],
    "description": "",
    "disabled": "",
    "field_name": "",
    "field_name2": "",
    "field_op": "",
    "id": "",
    "interval_length": "",
    "mod_time": "",
    "name": "",
    "notify_snmp": "",
    "object_type": "",
    "operand": "",
    "operator": "",
    "param": {},
    "param2": {},
    "protocols": [],
    "refire_interval": "",
    "severity": "",
    "stat_name": "",
    "type": "",
    "units": ""
}

operation: Create Alert

Input parameters

Parameter	Description
Name	Specify the unique, friendly name for the alert that you want to create in ExtraHop.
Disabled	Select this checkbox to create the alert in the Disabled state in ExtraHop.
Severity	Select the severity level of the alert that you want to create in ExtraHop. This severity level gets displayed in the alert history, email notifications, and SNMP traps. You can choose from the following options: Emergency Alert Critical Error Warning Info Debug
Author	Specify the name of the user who created the alert that you want to add in ExtraHop.
Apply All	Select this checkbox to assign the created alert to all available data sources.
Notify SNMP	Select this checkbox to send an SNMP trap when this alert is generated.
Type	Select the type of alert you want to create in ExtraHop. You can choose from following options: Threshold: Specify values in the following fields: Statistic Name: Specify the name of the statistic that you want to assign to the alert you want to create in ExtraHop. Field OP: Select the type of comparison between the field_name and field_name2 fields when applying a ratio. You can choose between / or Null. Operator: Select the logical operator applied when comparing the value of the operand field to alert conditions. You can choose from the following options ==, >,<.>=,<=.< /li> Operand: Specify the value to compare against alert conditions. The compare method is specified by the value of the operator field. Field Name: Specify the name of the monitored metric. Param: Specify the first alert parameter, in the JSON format, which is either a key pattern or a data point. Field Name2: Specify the second monitored metric when applying a ratio. Param2: Specify the second alert parameter, in the JSON format, which is either a key pattern or a data point. Interval Length: Select the length of the alert interval. You can choose from options such as 30 seconds, 5 minutes, 30 minutes, etc. Units: Select the interval in which to evaluate the alert condition. You can choose from options such as None, Period, 1 minute, etc. Detection: Specify values in the following fields: Object Type: Select the type of object that requires to be monitored. You can choose between Application or Device. Categories: (Optional) Specify the list of one or more detection categories that you want to associate with the created alert. The alert will be generated only if the detection is identified in the specified categories. Protocols: (Optional) Specify the list of monitored protocols.
CC	Specify the list of email addresses that have not been included in an email group, and to which notifications of created alerts must be sent.
Description	(Optional) Specify the description for the alert that you want to create in ExtraHop.
Refire Interval	(Optional) Specify the time interval in which alert conditions are monitored.

Output

The output contains the following populated JSON schema:

{
    "success": "",
    "result": ""
}

operation: Update Alert

Input parameters

Parameter	Description
Alert ID	Specify the unique identifier for the alert that you want to update in ExtraHop.
Name	Specify the unique, friendly name for the alert that you want to update in ExtraHop.
Severity	Select the severity level of the alert that you want to update in ExtraHop. This severity level is displayed in the alert history, email notifications, and SNMP traps. You can choose from the following options: Emergency Alert Critical Error Warning Info Debug
Author	Specify the name of the user who created the alert that you want to update in ExtraHop.
Apply All	Select this checkbox to assign the created alert to all available data sources.
Notify SNMP	Select this checkbox to send an SNMP trap when this alert is generated.
Type	Select the type of alert you want to update in ExtraHop. You can choose from following options: Threshold: Specify values in the following fields: Statistic Name: Specify the name of the statistic that you want to assign to the alert you want to update in ExtraHop. Field OP: Select the type of comparison between the field_name and field_name2 fields when applying a ratio. You can choose between / or Null. Operator: Select the logical operator applied when comparing the value of the operand field to alert conditions. You can choose from the following options ==, >,<.>=,<=.< /li> Operand: Specify the value to compare against alert conditions. The compare method is specified by the value of the operator field. Field Name: Specify the name of the monitored metric. Param: Specify the first alert parameter, in the JSON format, which is either a key pattern or a data point. Field Name2: Specify the second monitored metric when applying a ratio. Param2: Specify the second alert parameter, in the JSON format, which is either a key pattern or a data point. Interval Length: Select the length of the alert interval. You can choose from options such as 30 seconds, 5 minutes, 30 minutes, etc. Units: Select the interval in which to evaluate the alert condition. You can choose from options such as None, Period, 1 minute, etc. Detection: Specify values in the following fields: Object Type: Select the type of object that requires to be monitored. You can choose between Application or Device. Categories: (Optional) Specify the list of one or more detection categories that you want to associate with the created alert. The alert will be generated only if the detection is identified in the specified categories. Protocols: (Optional) Specify the list of monitored protocols.
CC	Specify the list of email addresses that have not been included in an email group, and to which notifications of updated alerts must be sent.
Description	Specify the description for the alert that you want to update in ExtraHop.
Refire Interval	Specify the time interval in which alert conditions are monitored.

Output

The output contains the following populated JSON schema:

{
    "success": "",
    "result": ""
}

operation: Query Records

Input parameters

Parameter	Description
From	Specify the starting timestamp of the time range expressed in milliseconds since the epoch, based on which the query will search log records in ExtraHop. A negative value specifies that the search will begin with records created at a time in the past relative to the current time. For example, specify -30m to begin the search with records created 30 minutes before the time of the request. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. For details on supported time units and suffixes, see https://docs.extrahop.com/current/rest-api-guide/#supported-time-units-.
Until	Specify the ending timestamp of the time range expressed in milliseconds since the epoch, based on which the query will search log records in ExtraHop. A negative value specifies that the search will begin with records created at a time in the past relative to the current time. For example, specify -30m to begin the search with records created 30 minutes before the time of the request. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. For details on supported time units and suffixes, see https://docs.extrahop.com/current/rest-api-guide/#supported-time-units-.
Type	Specify a CSV list of one or more record formats based on which you want to query for search log records in ExtraHop. The query returns only those records that match the specified formats. If no value is specified, then the query returns records of any type. Valid values for this field are displayed in the Record Type field on the Record Formats page. For example: "`cifs`"
Filter	Select the type of filter to be based on which the query will search log records in ExtraHop. You can choose between Filter or Conditional Filter. If you choose Filter, then you must specify the following parameters: Field: Specify the name of the field in the record based on which you want to filter the search log records in ExtraHop. The query compares the contents of the field parameter to the value of the operand parameter. Operator: Select the operation you want to use to combine the JSON fields that you will specify in the Operand field. You can choose from following options: `<` `>` `<=` `>=` `=` `!=` `startswith` `exists` Operand: Specify the conditions, in JSON format, based on which you want to search for log records in ExtraHop. You can specify multiple conditions and combine them using the selected operator. If you choose Conditional Filter, then you must specify the following parameters: Conditional Operator: Select the operation you want to use to combine the JSON fields that you will specify in the Condition field. You can choose between "and", "or", or "not" operators. Condition: Specify the conditions, in JSON format, based on which you want to search for log records in ExtraHop. You can specify multiple conditions and combine them using "and", "or", or "not" conditional operators.
Limit	(Optional) Specify the maximum number of results, per page, that this operation should return. By default, this is set to 100 and the maximum value that can be set is 10000.
Offset	(Optional) Specify the index of the first item to be returned by this operation. This parameter is useful if you want to get a subset of records, say incidents starting from the 10th log record. By default, this is set as 0.
Sort	Select this checkbox if you want to sort records retrieved from ExtraHop. By default, records are sorted in the descending order on the timestamp field. If you select this checkbox, then you must specify the following parameters: Field: Specify a CSV list of the fields based on which you want to sort records retrieved from ExtraHop. By default, this is set to 'timestamp'. Order: Direction based on which you want the operation to sort records retrieved from ExtraHop. You can choose between ASC or DESC. By default, this is set to 'descending'

Output

The output contains the following populated JSON schema:

{
    "apply_all": "",
    "author": "",
    "categories": [],
    "cc": [],
    "description": "",
    "disabled": "",
    "field_name": "",
    "field_name2": "",
    "field_op": "",
    "id": "",
    "interval_length": "",
    "mod_time": "",
    "name": "",
    "notify_snmp": "",
    "object_type": "",
    "operand": "",
    "operator": "",
    "param": {},
    "param2": {},
    "protocols": [],
    "refire_interval": "",
    "severity": "",
    "stat_name": "",
    "type": "",
    "units": ""
}

operation: Search Devices

Input parameters

Parameter	Description
Active From	Specify the starting timestamp of the time range expressed in milliseconds since the epoch, based on which active devices will be retrieved from ExtraHop. A negative value specifies that the search will begin with records created at a time in the past relative to the current time. For example, specify -30m to begin the search with records created 30 minutes before the time of the request. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. For details on supported time units and suffixes, see https://docs.extrahop.com/current/rest-api-guide/#supported-time-units-.
Active Until	Specify the ending timestamp of the time range expressed in milliseconds since the epoch, based on which active devices will be retrieved from ExtraHop. A negative value specifies that the search will begin with records created at a time in the past relative to the current time. For example, specify -30m to begin the search with records created 30 minutes before the time of the request. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. For details on supported time units and suffixes, see https://docs.extrahop.com/current/rest-api-guide/#supported-time-units-.
Filter	Select the type of filter to be based on which active devices will be retrieved from ExtraHop. You can choose between Filter or Conditional Filter. If you choose Filter, then you must specify the following parameters: Field: Select the name of the field based on which you want to filter results returned by this operation. The search compares the contents of the field parameter to the value of the operand parameter. Operator: Select the operation you want to use to combine the JSON fields that you will specify in the Operand field. You can choose from following options: `<` `>` `<=` `>=` `=` `!=` `startswith` `exists` Operand: Specify the conditions, in JSON format, based on which you want to search for log records in ExtraHop. You can specify multiple conditions and combine them using the selected operator. If you choose Conditional Filter, then you must specify the following parameters: Conditional Operator: Select the operation you want to use to combine the JSON fields that you will specify in the Condition field. You can choose between "and", "or", or "not" operators. Condition: Specify the conditions, in JSON format, based on which you want to search for log records in ExtraHop. You can specify multiple conditions and combine them using "and", "or", or "not" conditional operators.
Limit	(Optional) Specify the maximum number of results, per page, that this operation should return. By default, this is set to 100 and the maximum value that can be set is 10000.
Offset	(Optional) Specify the index of the first item to be returned by this operation. This parameter is useful if you want to get a subset of records, say incidents starting from the 10th log record. By default, this is set as 0.

Output

The output contains the following populated JSON schema:

{
    "activity": [],
    "analysis": "",
    "analysis_level": "",
    "auto_role": "",
    "cdp_name": "",
    "cloud_account": "",
    "cloud_instance_id": "",
    "cloud_instance_name": "",
    "cloud_instance_type": "",
    "critical": "",
    "custom_criticality": "",
    "custom_name": "",
    "custom_type": "",
    "default_name": "",
    "description": "",
    "device_class": "",
    "dhcp_name": "",
    "discover_time": "",
    "discovery_id": "",
    "display_name": "",
    "dns_name": "",
    "extrahop_id": "",
    "id": "",
    "ipaddr4": "",
    "ipaddr6": "",
    "is_l3": "",
    "last_seen_time": "",
    "macaddr": "",
    "mod_time": "",
    "model": "",
    "netbios_name": "",
    "node_id": "",
    "on_watchlist": "",
    "parent_id": "",
    "role": "",
    "subnet_id": "",
    "user_mod_time": "",
    "vendor": "",
    "vlanid": "",
    "vpc_id": ""
}

operation: Get Watchlist

Input parameters

None.

Output

The output contains the following populated JSON schema:

[
    {
        "activity": [],
        "analysis": "",
        "analysis_level": "",
        "auto_role": "",
        "cdp_name": "",
        "cloud_account": "",
        "cloud_instance_description": "",
        "cloud_instance_id": "",
        "cloud_instance_name": "",
        "cloud_instance_type": "",
        "critical": "",
        "custom_criticality": "",
        "custom_make": "",
        "custom_model": "",
        "custom_name": "",
        "custom_type": "",
        "default_name": "",
        "description": "",
        "device_class": "",
        "dhcp_name": "",
        "discover_time": "",
        "discovery_id": "",
        "display_name": "",
        "dns_name": "",
        "extrahop_id": "",
        "id": "",
        "ipaddr4": "",
        "ipaddr6": "",
        "is_l3": "",
        "last_seen_time": "",
        "macaddr": "",
        "mod_time": "",
        "model": "",
        "model_override": "",
        "netbios_name": "",
        "node_id": "",
        "on_watchlist": "",
        "parent_id": "",
        "role": "",
        "subnet_id": "",
        "user_mod_time": "",
        "vendor": "",
        "vlanid": "",
        "vpc_id": ""
    }
]

operation: Update Watchlist

Input parameters

Parameter	Description
Action	Select the action that you want to perform on the watchlist in ExtraHop. Choose 'Add' to add devices to the watchlist or choose 'Remove' to remove the devices from the watchlist.
Based On	Select the input based on which you want to add or remove devices from the watchlist. You can choose between IP addresses or Device IDs. If you choose 'IP Address', then in the IP Address field specify a CSV list of IP addresses that you want to add or remove from the watchlist. If you choose 'Device ID', then in the Device IDs field specify a CSV list of device IDs that you want to add or remove from the watchlist.

Parameter

Description

Action

Select the action that you want to perform on the watchlist in ExtraHop. Choose 'Add' to add devices to the watchlist or choose 'Remove' to remove the devices from the watchlist.

Based On

Select the input based on which you want to add or remove devices from the watchlist. You can choose between IP addresses or Device IDs.

If you choose 'IP Address', then in the IP Address field specify a CSV list of IP addresses that you want to add or remove from the watchlist.
If you choose 'Device ID', then in the Device IDs field specify a CSV list of device IDs that you want to add or remove from the watchlist.

Output

The output contains the following populated JSON schema:

{
    "status": "",
    "result": ""
}

operation: Update Detection

Input parameters

Parameter	Description
Detection ID	Specify the unique identifier for the detection that you want to update in ExtraHop.
Ticket ID	Specify the ID of the ticket that is associated with the detection, which you want to update in ExtraHop.
Assignee	Specify the assignee of the detection or the ticket that is associated with the detection, which you want to update in ExtraHop.
Status	Select the status of the detection or the ticket that is associated with the detection, which you want to update in ExtraHop. You can choose from the following options: New, In Progress, Acknowledged, or Closed.
Resolution	Select the resolution of the detection or the ticket that is associated with the detection, which you want to update in ExtraHop. You can choose between Action Taken or No Action Taken.

Output

The output contains the following populated JSON schema:

{
    "status": "",
    "result": ""
}

operation: Get Peers Devices

Input parameters

Parameter	Description
Based On	Select the input based on which you want to retrieve peers for the specified device from ExtraHop. You can choose between IP address or Device IDs If you choose 'IP Address', then in the IP Address field specify the IP address of the source device whose peer devices you want to retrieve from ExtraHop. If you choose 'Device ID', then in the Device IDs field specify the ID of the source device whose peer devices you want to retrieve from ExtraHop.
From	Specify the starting timestamp of the time range expressed in milliseconds since the epoch, based on which the query will search peer devices in ExtraHop. A negative value specifies that the search will begin with records created at a time in the past relative to the current time. For example, specify -30m to begin the search with records created 30 minutes before the time of the request. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. For details on supported time units and suffixes, see https://docs.extrahop.com/current/rest-api-guide/#supported-time-units-.
Until	(Optional) Specify the ending timestamp of the time range expressed in milliseconds since the epoch, based on which the query will search peer devices in ExtraHop. A negative value specifies that the search will begin with records created at a time in the past relative to the current time. For example, specify -30m to begin the search with records created 30 minutes before the time of the request. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. For details on supported time units and suffixes, see https://docs.extrahop.com/current/rest-api-guide/#supported-time-units-.
Role	(Optional) Select the role of the peer device in relation to the origin device. You can choose from the following options: Any, Client, or Server.
Protocol	(Optional) Specify the protocol over which the origin device is communicating, such as "HTTP". If no value is set, the object includes any protocol.

Output

The output contains the following populated JSON schema:

[
    {
        "analysis": "",
        "analysis_level": "",
        "auto_role": "",
        "client_protocols": [],
        "default_name": "",
        "device_class": "",
        "dhcp_name": "",
        "discover_time": "",
        "discovery_id": "",
        "display_name": "",
        "dns_name": "",
        "extrahop_id": "",
        "id": "",
        "ppaddr4": "",
        "is_l3": "",
        "macaddr": "",
        "mod_time": "",
        "on_watchlist": "",
        "parent_id": "",
        "role": "",
        "server_protocols": [],
        "url": "",
        "user_mod_time": "",
        "vendor": "",
        "vlanid": ""
    }
]

operation: Get Protocols

Input parameters

Parameter	Description
Based On	Select the input based on which you want to retrieve active network protocols for the specified device from ExtraHop. You can choose between IP address or Device IDs If you choose 'IP Address', then in the IP Address field specify the IP address of the source device whose active protocols you want to retrieve from ExtraHop. If you choose 'Device ID', then in the Device ID field specify the ID of the source device whose active protocols you want to retrieve from ExtraHop.
From	Specify the starting timestamp of the time range expressed in milliseconds since the epoch, based on which the query will search active protocols in ExtraHop. A negative value specifies that the search will begin with records created at a time in the past relative to the current time. For example, specify -30m to begin the search with records created 30 minutes before the time of the request. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. For details on supported time units and suffixes, see https://docs.extrahop.com/current/rest-api-guide/#supported-time-units-.
Until	(Optional) The ending timestamp of the time range expressed in milliseconds since the epoch, based on which the query will search active protocols in ExtraHop. A negative value specifies that the search will begin with records created at a time in the past relative to the current time. For example, specify -30m to begin the search with records created 30 minutes before the time of the request. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. For details on supported time units and suffixes, see https://docs.extrahop.com/current/rest-api-guide/#supported-time-units-.

Parameter

Description

Based On

Select the input based on which you want to retrieve active network protocols for the specified device from ExtraHop. You can choose between IP address or Device IDs

If you choose 'IP Address', then in the IP Address field specify the IP address of the source device whose active protocols you want to retrieve from ExtraHop.
If you choose 'Device ID', then in the Device ID field specify the ID of the source device whose active protocols you want to retrieve from ExtraHop.

From

Specify the starting timestamp of the time range expressed in milliseconds since the epoch, based on which the query will search active protocols in ExtraHop.
A negative value specifies that the search will begin with records created at a time in the past relative to the current time. For example, specify -30m to begin the search with records created 30 minutes before the time of the request. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. For details on supported time units and suffixes, see https://docs.extrahop.com/current/rest-api-guide/#supported-time-units-.

Until

(Optional) The ending timestamp of the time range expressed in milliseconds since the epoch, based on which the query will search active protocols in ExtraHop.
A negative value specifies that the search will begin with records created at a time in the past relative to the current time. For example, specify -30m to begin the search with records created 30 minutes before the time of the request. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. For details on supported time units and suffixes, see https://docs.extrahop.com/current/rest-api-guide/#supported-time-units-.

Output

The output contains the following populated JSON schema:

[
    {
        "analysis": "",
        "analysis_level": "",
        "auto_role": "",
        "client_protocols": [],
        "default_name": "",
        "device_class": "",
        "dhcp_name": "",
        "discover_time": "",
        "discovery_id": "",
        "display_name": "",
        "dns_name": "",
        "extrahop_id": "",
        "id": "",
        "ppaddr4": "",
        "is_l3": "",
        "macaddr": "",
        "mod_time": "",
        "on_watchlist": "",
        "parent_id": "",
        "role": "",
        "server_protocols": [],
        "url": "",
        "user_mod_time": "",
        "vendor": "",
        "vlanid": ""
    }
]

operation: Tag Devices

Input parameters

Parameter	Description
Tag Name	Specify the name of the tag that you want to add or remove from the specified device.
Action	Select the action that you want to perform on the tags in ExtraHop. Choose 'Add' to add tags to the device or choose 'Remove' to remove the tags from the device.
Based On	Select the input based on which you want to add or remove tags from the device. You can choose between IP address or Device IDs If you choose 'IP Address', then in the IP Address field specify a CSV list of device IP addresses to which you want to add or remove the specified tag. If you choose 'Device ID', then in the Device IDs field specify a CSV list of device IDs you want to which you want to add or remove the specified tag.

Parameter

Description

Tag Name

Specify the name of the tag that you want to add or remove from the specified device.

Action

Select the action that you want to perform on the tags in ExtraHop. Choose 'Add' to add tags to the device or choose 'Remove' to remove the tags from the device.

Based On

Select the input based on which you want to add or remove tags from the device. You can choose between IP address or Device IDs

If you choose 'IP Address', then in the IP Address field specify a CSV list of device IP addresses to which you want to add or remove the specified tag.
If you choose 'Device ID', then in the Device IDs field specify a CSV list of device IDs you want to which you want to add or remove the specified tag.

Output

The output contains the following populated JSON schema:

{
    "apply_all": "",
    "author": "",
    "categories": [],
    "cc": [],
    "description": "",
    "disabled": "",
    "field_name": "",
    "field_name2": "",
    "field_op": "",
    "id": "",
    "interval_length": "",
    "mod_time": "",
    "name": "",
    "notify_snmp": "",
    "object_type": "",
    "operand": "",
    "operator": "",
    "param": {},
    "param2": {},
    "protocols": [],
    "refire_interval": "",
    "severity": "",
    "stat_name": "",
    "type": "",
    "units": ""
}

operation: Create Tag

Input parameters

Parameter	Description
Tag Name	Specify the name of that tag that you want to create in ExtraHop.

Output

The output contains the following populated JSON schema:

{
    "status": "",
    "result": ""
}

operation: Search Packet

Input parameters

Parameter	Description
From	Specify the starting timestamp of the time range expressed in milliseconds since the epoch, based on which the packets are searched in ExtraHop. A negative value specifies that the search will begin with records created at a time in the past relative to the current time. For example, specify -30m to begin the search with records created 30 minutes before the time of the request. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. For details on supported time units and suffixes, see https://docs.extrahop.com/current/rest-api-guide/#supported-time-units-.
Until	(Optional) The ending timestamp of the time range expressed in milliseconds since the epoch, based on which the packets are searched in ExtraHop. A negative value specifies that the search will begin with records created at a time in the past relative to the current time. For example, specify -30m to begin the search with records created 30 minutes before the time of the request. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. For details on supported time units and suffixes, see https://docs.extrahop.com/current/rest-api-guide/#supported-time-units-.
File Format	(Optional) Select the file format for the searched packet, which can be downloaded into the FortiSOAR 'Attachment' module. You can choose between pcap, pcapng, keylog_txt, or zip.
Limit Bytes	(Optional) Specify the maximum number of bytes to return.
Search Duration	(Optional) Specify the maximum amount of time to run the packet search. The default unit is milliseconds, but other units can be specified with a unit suffix.
BPF	(Optional) Specify the Berkeley Packet Filter (BPF) syntax for packet search.
IP1	(Optional) Specify the IP address whose sent or received packets will be returned by this operation.
Port1	(Optional) Specify the Port whose sent or received packets will be returned by this operation.
IP2	(Optional) Specify the IP address whose sent or received packets will be returned by this operation.
Port2	(Optional) Specify the Port whose sent or received packets will be returned by this operation.

Output

The output contains a non-dictionary value.

operation: Get Detections

Input parameters

None.

Output

The output contains the following populated JSON schema:

{
    "appliance_id": "",
    "assignee": "",
    "categories": [
        ""
    ],
    "description": "",
    "end_time": "",
    "id": "",
    "is_user_created": "",
    "mitre_tactics": [],
    "mitre_techniques": [],
    "mod_time": "",
    "participants": [],
    "properties": "",
    "resolution": "",
    "risk_score": "",
    "start_time": "",
    "status": "",
    "ticket_id": "",
    "ticket_url": "",
    "title": "",
    "type": "",
    "update_time": ""
}

operation: Get Detection By ID

Input parameters

Parameter	Description
Detection ID	Specify the unique identifier for the detection you want to retrieve from ExtraHop.

Output

The output contains the following populated JSON schema:

{
    "appliance_id": "",
    "assignee": "",
    "categories": [],
    "description": "",
    "end_time": "",
    "id": "",
    "is_user_created": "",
    "mitre_tactics": [],
    "mitre_techniques": [],
    "mod_time": "",
    "participants": [],
    "properties": "",
    "resolution": "",
    "risk_score": "",
    "start_time": "",
    "status": "",
    "ticket_id": "",
    "ticket_url": "",
    "title": "",
    "type": "",
    "update_time": ""
}

operation: Get Detection Formats

Input parameters

None.

Output

The output contains the following populated JSON schema:

{
    "author": "",
    "categories": [],
    "display_name": "",
    "is_user_created": "",
    "mitre_categories": [],
    "properties": "",
    "type": ""
}

operation: Create New Detection Format

Input parameters

Parameter	Description
Type	Specify the string identifier for the detection type you want to create in ExtraHop. The string can only contain letters, numbers, and underscores. Although detection types are unique across built-in formats, and detection types are unique across custom formats; a built-in and custom format can share the same detection type.
Display Name	Specify the display name of the detection type that appears on the 'Detections' page in the ExtraHop system.
Author	(Optional) Specify the author of the detection format you want to create in ExtraHop.
Categories	(Optional) Specify the list of categories to which the detection you want to create in ExtraHop belongs. Keep the following in mind: For POST and PATCH operations a list with a single string must be specified More than one category for custom detection formats cannot be specified. The 'perf' or 'sec' category is automatically added to all detection formats.
Mitre Categories	(Optional) Specify the IDs of the MITRE techniques associated with the detection you want to create in ExtraHop.

Output

The output contains the following populated JSON schema:

{
    "author": "",
    "categories": [],
    "display_name": "",
    "is_user_created": "",
    "mitre_categories": [],
    "properties": "",
    "type": ""
}

operation: Delete Detection Format

Input parameters

Parameter	Description
Detection ID	Specify the unique string identifier for the detection you want to delete from ExtraHop.

Output

The output contains the following populated JSON schema:

{
    "status": "",
    "result": ""
}

operation: Get Detection Hiding Rules

Input parameters

None.

Output

The output contains the following populated JSON schema:

{
    "author": "",
    "create_time": "",
    "description": "",
    "detection_type": "",
    "detections_hidden": "",
    "enabled": "",
    "expiration": "",
    "hide_past_detections": "",
    "id": "",
    "offender": "",
    "participants_hidden": "",
    "properties": [],
    "victim": ""
}

operation: Update Detection Format

Input parameters

Parameter	Description
Detection ID	Specify the unique string identifier for the detection format you want to update in ExtraHop
Display Name	Specify the display name of the detection type that appears on the 'Detections' page in the ExtraHop system.
Author	(Optional) Specify the author of the detection format you want to update in ExtraHop.
Categories	(Optional) Specify the list of categories to which the detection you want to update in ExtraHop belongs. Keep the following in mind: For POST and PATCH operations a list with a single string must be specified More than one category for custom detection formats cannot be specified. The 'perf' or 'sec' category is automatically added to all detection formats.
Mitre Categories	(Optional) Specify the IDs of the MITRE techniques associated with the detection you want to update in ExtraHop.
Type	(Optional) Specify the string identifier for the detection type you want to update in ExtraHop. The string can only contain letters, numbers, and underscores. Although detection types are unique across built-in formats, and detection types are unique across custom formats; a built-in and custom format can share the same detection type.

Output

The output contains the following populated JSON schema:

{
    "status": "",
    "result": ""
}

operation: Update Associated Ticket

Input parameters

Parameter	Description
Ticket ID	Specify the ID of the ticket associated with the detection you want to update in ExtraHop.
Assignee	Specify the assignee of the ticket associated with the detection you want to update in ExtraHop.
Status	Select the status of the ticket associated with the detection you want to update in ExtraHop. You can choose from the following options: New, In Progress, Acknowledged, or Closed.
Resolution	Select the resolution of the ticket associated with the detection you want to update in ExtraHop. You can choose between Action Taken or No Action Taken.

Output

The output contains the following populated JSON schema:

{
    "author": "",
    "categories": [],
    "display_name": "",
    "is_user_created": "",
    "mitre_categories": [],
    "properties": "",
    "type": ""
}

operation: Search Detections

Input parameters

Parameter	Description
Categories	Specify a list of one or more detection categories that you want to retrieve from ExtraHop.
Assignee	Specify a list of one or more assignee of the detection to retrieve from ExtraHop. Specify `.none` to search for unassigned detections or specify `.me` to search for detections assigned to the authenticated user.
Ticket ID	Specify a list of one or more ID of the ticket that is associated with the detection to retrieve from ExtraHop.
Status	Select one or more detection status to retrieve from ExtraHop. You can select from the following options: New In Progress Acknowledged Closed
Resolution	Select one or more detection resolution to retrieve from ExtraHop. You can select from the following options: Action Taken No Action Taken
Types	Specify the list of one or more type of the detection to retrieve from ExtraHop.
Min Risk Score	Specify the risk score of detection to retrieve detections with risk scores greater than or equal to the specified value.
From	Specify the starting timestamp of the time range expressed in milliseconds since the epoch, based on which the query will search detections in ExtraHop. Detections that started before the specified date are returned if the detection was ongoing at that time.
Limit	Specify the maximum number of results, per page, that this operation should return.
Offset	Specify the index of the first item to be returned by this operation. This parameter is useful if you want to get a subset of records, say incidents starting from the 10th log record. By default, this is set as 0.
Sort	Select this checkbox if you want to sort records retrieved from ExtraHop. By default, records are sorted in the descending order on the timestamp field. If you select this checkbox, then you must specify the following parameters: Field: Specify a field based on which you want to sort records retrieved from ExtraHop. By default, this is set to 'timestamp'. Direction: Direction based on which you want the operation to sort records retrieved from ExtraHop. You can choose between ASC or DESC. By default, this is set to 'descending'
Until	Specify the ending timestamp of the time range expressed in milliseconds since the epoch, based on which the query will search detections in ExtraHop.
Update Time	Returns detections related to events that occurred after the specified date, expressed in milliseconds since the epoch. Note that ExtraHop Machine Learning Services analyze historical data to generate detections, and so there is a time delay between when the events that cause those detections occur and when the detections are generated. If you search for detections in the same update_time window multiple times, the later search might return detections that were not returned by the earlier search.
Mod Time	Returns detections that were updated after the specified date, expressed in milliseconds since the epoch.
ID Only	(Optional) Select this checkbox if you want to retrieve only the IDs of the detections. By default, It is set to false

Output

The output contains the following populated JSON schema:

{
    "appliance_id": "",
    "assignee": "",
    "categories": [],
    "description": "",
    "id": "",
    "is_user_created": "",
    "mitre_tactics": [],
    "mitre_techniques": [],
    "mod_time": "",
    "participants": [],
    "properties": "",
    "resolution": "",
    "risk_score": "",
    "start_time": "",
    "status": "",
    "ticket_id": "",
    "title": "",
    "type": "",
    "update_time": ""
}

Included playbooks

The Sample - ExtraHop - 2.1.0 playbook collection comes bundled with the ExtraHop connector. These playbooks contain steps using which you can perform all supported actions. You can see bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the ExtraHop connector.

Create Alert
Create New Detection Format
Create Tag
Delete Detection Format
Get Alert Details
Get Alerts
Get Detection By ID
Get Detection Formats
Get Detection Hiding Rules
Get Detections
Get Peers Devices
Get Protocols
Get Watchlist
Query Records
Search Detections
Search Devices
Search Packet
Tag Devices
Update Alert
Update Associated Ticket
Update Detection
Update Detection Format
Update Watchlist

Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets overwritten during the connector upgrade and gets deleted during connector uninstall.

About the connector

Version information

Connector Version: 2.1.0

FortiSOAR™ Version Tested on: 7.4.2-3279

ExtraHop Version Tested on: 9.4.2.1625

Authored By: Fortinet

Contributor: Parag Khatavkar

Certified: Yes

Release Notes for version 2.1.0

Following enhancements have been made to the ExtraHop Connector in version 2.1.0:

Added a new action Search Detections

Installing the connector

Use the Content Hub to install the connector. For the detailed procedure to install a connector, click here.

You can also use the yum command as a root user to install the connector:

yum install cyops-connector-extrahop

Prerequisites to configuring the connector

You must have the URL of the ExtraHop server to which you will connect and perform automated operations, and the API key used to access the ExtraHop Reveal(x) APIs.
The FortiSOAR™ server should have outbound connectivity to port 443 on the ExtraHop server.

Minimum Permissions Required

Not applicable

Configuring the connector

For the procedure to configure a connector, click here

Configuration parameters

Parameter	Description
Server URL	Server URL of the ExtraHop Reveal(x) server to which you will connect and perform the automated operations.
API Key	API Key configured for your account for using the ExtraHop Reveal(x) APIs.
Verify SSL	Specifies whether the SSL certificate for the server is to be verified. By default, this option is set to `True`.

Actions supported by the connector

The following automated operations can be included in playbooks and you can also use the annotations to access operations:

Function	Description	Annotation and Category
Get Alerts	Retrieves all alerts from ExtraHop.	get_alerts Investigation
Get Alert Details	Retrieves details of a specific alert from ExtraHop based on the alert ID you have specified.	get_alert_details Investigation
Create Alert	Creates a new alert in ExtraHop based on the name, severity, author, and other input parameters you have specified.	create_alert Investigation
Update Alert	Updates an existing alert in ExtraHop based on the alert ID, name, severity, and other input parameters you have specified.	update_alert Investigation
Query Records	Queries log records in ExtraHop based on the time frame and other input parameters you have specified.	query_records Investigation
Search Devices	Retrieves all devices from ExtraHop that match the search criteria you have specified.	search_devices Investigation
Get Watchlist	Retrieves all devices that are on the watchlist from ExtraHop.	get_watchlist Investigation
Update Watchlist	Adds or removes devices from the watchlist in ExtraHop based on the IP addresses or device IDs you have specified.	update_watchlist Miscellaneous
Update Detection	Updates a detection in ExtraHop based on the detection ID, ticket ID, assignee, and other input parameters you have specified.	update_detection Miscellaneous
Get Peers Devices	Retrieves all peers for a device from ExtraHop based on the device ID or IP address and other input parameters you have specified.	get_peers_devices Investigation
Get Protocols	Retrieves all active network protocols for a device from ExtraHop based on the device ID or IP address and other input parameters you have specified.	get_protocols Investigation
Tag Devices	Adds or removes a tag from devices in ExtraHop based on the IP addresses or device IDs you have specified.	tag_devices Investigation
Create Tag	Creates a new tag in ExtraHop based on the tag name you have specified.	create_tag Investigation
Search Packet	Searches for packets by specifying parameters in a URL. Input parameters include the starting timestamp, file format, etc based on which packets are searched in ExtraHop. NOTE: On successful execution of this action, an attachment of the specified file format is created in FortiSOAR.	search_packet Investigation
Get Detections	Retrieves all detections from ExtraHop.	get_detections Investigation
Get Detection By ID	Retrieves a specific detection from ExtraHop based on the detection ID specified.	get_detection_by_id Investigation
Get Detection Formats	Retrieves all detection types from ExtraHop.	get_detection_format Investigation
Create New Detection Format	Creates a new detection format in ExtraHop based on the Type, Display Name, and other parameters specified.	create_new_detection_format Investigation
Delete Detection Format	Deletes a specific detection format from ExtraHop based on the detection ID specified.	delete_detection_format Investigation
Get Detection Hiding Rules	Retrieves all tuning rules from ExtraHop.	get_detection_rules_hiding Investigation
Update Detection Format	Updates a specific detection format in ExtraHop based on the detection format ID and other parameters specified.	update_detection_format Miscellaneous
Update Associated Ticket	Updates a ticket associated with detection in ExtraHop based on the ticket ID, assignee, status, and resolution specified.	update_associated_ticket Investigation
Search Detections	Retrieves detections that match the specified search criteria in ExtraHop.	search_detections Investigation

operation: Get Alerts

Input parameters

None.

Output

The output contains the following populated JSON schema:

[
    {
        "apply_all": "",
        "author": "",
        "categories": [],
        "cc": [],
        "description": "",
        "disabled": "",
        "field_name": "",
        "field_name2": "",
        "field_op": "",
        "id": "",
        "interval_length": "",
        "mod_time": "",
        "name": "",
        "notify_snmp": "",
        "object_type": "",
        "operand": "",
        "operator": "",
        "param": {},
        "param2": {},
        "protocols": [],
        "refire_interval": "",
        "severity": "",
        "stat_name": "",
        "type": "",
        "units": ""
    }
]

operation: Get Alert Details

Input parameters

Parameter	Description
Alert ID	Specify the unique identifier for the alert whose details you want to retrieve from ExtraHop.

Output

The output contains the following populated JSON schema:

{
    "apply_all": "",
    "author": "",
    "categories": [],
    "cc": [],
    "description": "",
    "disabled": "",
    "field_name": "",
    "field_name2": "",
    "field_op": "",
    "id": "",
    "interval_length": "",
    "mod_time": "",
    "name": "",
    "notify_snmp": "",
    "object_type": "",
    "operand": "",
    "operator": "",
    "param": {},
    "param2": {},
    "protocols": [],
    "refire_interval": "",
    "severity": "",
    "stat_name": "",
    "type": "",
    "units": ""
}

operation: Create Alert

Input parameters

Parameter	Description
Name	Specify the unique, friendly name for the alert that you want to create in ExtraHop.
Disabled	Select this checkbox to create the alert in the Disabled state in ExtraHop.
Severity	Select the severity level of the alert that you want to create in ExtraHop. This severity level gets displayed in the alert history, email notifications, and SNMP traps. You can choose from the following options: Emergency Alert Critical Error Warning Info Debug
Author	Specify the name of the user who created the alert that you want to add in ExtraHop.
Apply All	Select this checkbox to assign the created alert to all available data sources.
Notify SNMP	Select this checkbox to send an SNMP trap when this alert is generated.
Type	Select the type of alert you want to create in ExtraHop. You can choose from following options: Threshold: Specify values in the following fields: Statistic Name: Specify the name of the statistic that you want to assign to the alert you want to create in ExtraHop. Field OP: Select the type of comparison between the field_name and field_name2 fields when applying a ratio. You can choose between / or Null. Operator: Select the logical operator applied when comparing the value of the operand field to alert conditions. You can choose from the following options ==, >,<.>=,<=.< /li> Operand: Specify the value to compare against alert conditions. The compare method is specified by the value of the operator field. Field Name: Specify the name of the monitored metric. Param: Specify the first alert parameter, in the JSON format, which is either a key pattern or a data point. Field Name2: Specify the second monitored metric when applying a ratio. Param2: Specify the second alert parameter, in the JSON format, which is either a key pattern or a data point. Interval Length: Select the length of the alert interval. You can choose from options such as 30 seconds, 5 minutes, 30 minutes, etc. Units: Select the interval in which to evaluate the alert condition. You can choose from options such as None, Period, 1 minute, etc. Detection: Specify values in the following fields: Object Type: Select the type of object that requires to be monitored. You can choose between Application or Device. Categories: (Optional) Specify the list of one or more detection categories that you want to associate with the created alert. The alert will be generated only if the detection is identified in the specified categories. Protocols: (Optional) Specify the list of monitored protocols.
CC	Specify the list of email addresses that have not been included in an email group, and to which notifications of created alerts must be sent.
Description	(Optional) Specify the description for the alert that you want to create in ExtraHop.
Refire Interval	(Optional) Specify the time interval in which alert conditions are monitored.

Output

The output contains the following populated JSON schema:

{
    "success": "",
    "result": ""
}

operation: Update Alert

Input parameters

Parameter	Description
Alert ID	Specify the unique identifier for the alert that you want to update in ExtraHop.
Name	Specify the unique, friendly name for the alert that you want to update in ExtraHop.
Severity	Select the severity level of the alert that you want to update in ExtraHop. This severity level is displayed in the alert history, email notifications, and SNMP traps. You can choose from the following options: Emergency Alert Critical Error Warning Info Debug
Author	Specify the name of the user who created the alert that you want to update in ExtraHop.
Apply All	Select this checkbox to assign the created alert to all available data sources.
Notify SNMP	Select this checkbox to send an SNMP trap when this alert is generated.
Type	Select the type of alert you want to update in ExtraHop. You can choose from following options: Threshold: Specify values in the following fields: Statistic Name: Specify the name of the statistic that you want to assign to the alert you want to update in ExtraHop. Field OP: Select the type of comparison between the field_name and field_name2 fields when applying a ratio. You can choose between / or Null. Operator: Select the logical operator applied when comparing the value of the operand field to alert conditions. You can choose from the following options ==, >,<.>=,<=.< /li> Operand: Specify the value to compare against alert conditions. The compare method is specified by the value of the operator field. Field Name: Specify the name of the monitored metric. Param: Specify the first alert parameter, in the JSON format, which is either a key pattern or a data point. Field Name2: Specify the second monitored metric when applying a ratio. Param2: Specify the second alert parameter, in the JSON format, which is either a key pattern or a data point. Interval Length: Select the length of the alert interval. You can choose from options such as 30 seconds, 5 minutes, 30 minutes, etc. Units: Select the interval in which to evaluate the alert condition. You can choose from options such as None, Period, 1 minute, etc. Detection: Specify values in the following fields: Object Type: Select the type of object that requires to be monitored. You can choose between Application or Device. Categories: (Optional) Specify the list of one or more detection categories that you want to associate with the created alert. The alert will be generated only if the detection is identified in the specified categories. Protocols: (Optional) Specify the list of monitored protocols.
CC	Specify the list of email addresses that have not been included in an email group, and to which notifications of updated alerts must be sent.
Description	Specify the description for the alert that you want to update in ExtraHop.
Refire Interval	Specify the time interval in which alert conditions are monitored.

Output

The output contains the following populated JSON schema:

{
    "success": "",
    "result": ""
}

operation: Query Records

Input parameters

Parameter	Description
From	Specify the starting timestamp of the time range expressed in milliseconds since the epoch, based on which the query will search log records in ExtraHop. A negative value specifies that the search will begin with records created at a time in the past relative to the current time. For example, specify -30m to begin the search with records created 30 minutes before the time of the request. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. For details on supported time units and suffixes, see https://docs.extrahop.com/current/rest-api-guide/#supported-time-units-.
Until	Specify the ending timestamp of the time range expressed in milliseconds since the epoch, based on which the query will search log records in ExtraHop. A negative value specifies that the search will begin with records created at a time in the past relative to the current time. For example, specify -30m to begin the search with records created 30 minutes before the time of the request. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. For details on supported time units and suffixes, see https://docs.extrahop.com/current/rest-api-guide/#supported-time-units-.
Type	Specify a CSV list of one or more record formats based on which you want to query for search log records in ExtraHop. The query returns only those records that match the specified formats. If no value is specified, then the query returns records of any type. Valid values for this field are displayed in the Record Type field on the Record Formats page. For example: "`cifs`"
Filter	Select the type of filter to be based on which the query will search log records in ExtraHop. You can choose between Filter or Conditional Filter. If you choose Filter, then you must specify the following parameters: Field: Specify the name of the field in the record based on which you want to filter the search log records in ExtraHop. The query compares the contents of the field parameter to the value of the operand parameter. Operator: Select the operation you want to use to combine the JSON fields that you will specify in the Operand field. You can choose from following options: `<` `>` `<=` `>=` `=` `!=` `startswith` `exists` Operand: Specify the conditions, in JSON format, based on which you want to search for log records in ExtraHop. You can specify multiple conditions and combine them using the selected operator. If you choose Conditional Filter, then you must specify the following parameters: Conditional Operator: Select the operation you want to use to combine the JSON fields that you will specify in the Condition field. You can choose between "and", "or", or "not" operators. Condition: Specify the conditions, in JSON format, based on which you want to search for log records in ExtraHop. You can specify multiple conditions and combine them using "and", "or", or "not" conditional operators.
Limit	(Optional) Specify the maximum number of results, per page, that this operation should return. By default, this is set to 100 and the maximum value that can be set is 10000.
Offset	(Optional) Specify the index of the first item to be returned by this operation. This parameter is useful if you want to get a subset of records, say incidents starting from the 10th log record. By default, this is set as 0.
Sort	Select this checkbox if you want to sort records retrieved from ExtraHop. By default, records are sorted in the descending order on the timestamp field. If you select this checkbox, then you must specify the following parameters: Field: Specify a CSV list of the fields based on which you want to sort records retrieved from ExtraHop. By default, this is set to 'timestamp'. Order: Direction based on which you want the operation to sort records retrieved from ExtraHop. You can choose between ASC or DESC. By default, this is set to 'descending'

Output

The output contains the following populated JSON schema:

{
    "apply_all": "",
    "author": "",
    "categories": [],
    "cc": [],
    "description": "",
    "disabled": "",
    "field_name": "",
    "field_name2": "",
    "field_op": "",
    "id": "",
    "interval_length": "",
    "mod_time": "",
    "name": "",
    "notify_snmp": "",
    "object_type": "",
    "operand": "",
    "operator": "",
    "param": {},
    "param2": {},
    "protocols": [],
    "refire_interval": "",
    "severity": "",
    "stat_name": "",
    "type": "",
    "units": ""
}

operation: Search Devices

Input parameters

Parameter	Description
Active From	Specify the starting timestamp of the time range expressed in milliseconds since the epoch, based on which active devices will be retrieved from ExtraHop. A negative value specifies that the search will begin with records created at a time in the past relative to the current time. For example, specify -30m to begin the search with records created 30 minutes before the time of the request. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. For details on supported time units and suffixes, see https://docs.extrahop.com/current/rest-api-guide/#supported-time-units-.
Active Until	Specify the ending timestamp of the time range expressed in milliseconds since the epoch, based on which active devices will be retrieved from ExtraHop. A negative value specifies that the search will begin with records created at a time in the past relative to the current time. For example, specify -30m to begin the search with records created 30 minutes before the time of the request. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. For details on supported time units and suffixes, see https://docs.extrahop.com/current/rest-api-guide/#supported-time-units-.
Filter	Select the type of filter to be based on which active devices will be retrieved from ExtraHop. You can choose between Filter or Conditional Filter. If you choose Filter, then you must specify the following parameters: Field: Select the name of the field based on which you want to filter results returned by this operation. The search compares the contents of the field parameter to the value of the operand parameter. Operator: Select the operation you want to use to combine the JSON fields that you will specify in the Operand field. You can choose from following options: `<` `>` `<=` `>=` `=` `!=` `startswith` `exists` Operand: Specify the conditions, in JSON format, based on which you want to search for log records in ExtraHop. You can specify multiple conditions and combine them using the selected operator. If you choose Conditional Filter, then you must specify the following parameters: Conditional Operator: Select the operation you want to use to combine the JSON fields that you will specify in the Condition field. You can choose between "and", "or", or "not" operators. Condition: Specify the conditions, in JSON format, based on which you want to search for log records in ExtraHop. You can specify multiple conditions and combine them using "and", "or", or "not" conditional operators.
Limit	(Optional) Specify the maximum number of results, per page, that this operation should return. By default, this is set to 100 and the maximum value that can be set is 10000.
Offset	(Optional) Specify the index of the first item to be returned by this operation. This parameter is useful if you want to get a subset of records, say incidents starting from the 10th log record. By default, this is set as 0.

Output

The output contains the following populated JSON schema:

{
    "activity": [],
    "analysis": "",
    "analysis_level": "",
    "auto_role": "",
    "cdp_name": "",
    "cloud_account": "",
    "cloud_instance_id": "",
    "cloud_instance_name": "",
    "cloud_instance_type": "",
    "critical": "",
    "custom_criticality": "",
    "custom_name": "",
    "custom_type": "",
    "default_name": "",
    "description": "",
    "device_class": "",
    "dhcp_name": "",
    "discover_time": "",
    "discovery_id": "",
    "display_name": "",
    "dns_name": "",
    "extrahop_id": "",
    "id": "",
    "ipaddr4": "",
    "ipaddr6": "",
    "is_l3": "",
    "last_seen_time": "",
    "macaddr": "",
    "mod_time": "",
    "model": "",
    "netbios_name": "",
    "node_id": "",
    "on_watchlist": "",
    "parent_id": "",
    "role": "",
    "subnet_id": "",
    "user_mod_time": "",
    "vendor": "",
    "vlanid": "",
    "vpc_id": ""
}

operation: Get Watchlist

Input parameters

None.

Output

The output contains the following populated JSON schema:

[
    {
        "activity": [],
        "analysis": "",
        "analysis_level": "",
        "auto_role": "",
        "cdp_name": "",
        "cloud_account": "",
        "cloud_instance_description": "",
        "cloud_instance_id": "",
        "cloud_instance_name": "",
        "cloud_instance_type": "",
        "critical": "",
        "custom_criticality": "",
        "custom_make": "",
        "custom_model": "",
        "custom_name": "",
        "custom_type": "",
        "default_name": "",
        "description": "",
        "device_class": "",
        "dhcp_name": "",
        "discover_time": "",
        "discovery_id": "",
        "display_name": "",
        "dns_name": "",
        "extrahop_id": "",
        "id": "",
        "ipaddr4": "",
        "ipaddr6": "",
        "is_l3": "",
        "last_seen_time": "",
        "macaddr": "",
        "mod_time": "",
        "model": "",
        "model_override": "",
        "netbios_name": "",
        "node_id": "",
        "on_watchlist": "",
        "parent_id": "",
        "role": "",
        "subnet_id": "",
        "user_mod_time": "",
        "vendor": "",
        "vlanid": "",
        "vpc_id": ""
    }
]

operation: Update Watchlist

Input parameters

Parameter	Description
Action	Select the action that you want to perform on the watchlist in ExtraHop. Choose 'Add' to add devices to the watchlist or choose 'Remove' to remove the devices from the watchlist.
Based On	Select the input based on which you want to add or remove devices from the watchlist. You can choose between IP addresses or Device IDs. If you choose 'IP Address', then in the IP Address field specify a CSV list of IP addresses that you want to add or remove from the watchlist. If you choose 'Device ID', then in the Device IDs field specify a CSV list of device IDs that you want to add or remove from the watchlist.

Parameter

Description

Action

Select the action that you want to perform on the watchlist in ExtraHop. Choose 'Add' to add devices to the watchlist or choose 'Remove' to remove the devices from the watchlist.

Based On

Select the input based on which you want to add or remove devices from the watchlist. You can choose between IP addresses or Device IDs.

If you choose 'IP Address', then in the IP Address field specify a CSV list of IP addresses that you want to add or remove from the watchlist.
If you choose 'Device ID', then in the Device IDs field specify a CSV list of device IDs that you want to add or remove from the watchlist.

Output

The output contains the following populated JSON schema:

{
    "status": "",
    "result": ""
}

operation: Update Detection

Input parameters

Parameter	Description
Detection ID	Specify the unique identifier for the detection that you want to update in ExtraHop.
Ticket ID	Specify the ID of the ticket that is associated with the detection, which you want to update in ExtraHop.
Assignee	Specify the assignee of the detection or the ticket that is associated with the detection, which you want to update in ExtraHop.
Status	Select the status of the detection or the ticket that is associated with the detection, which you want to update in ExtraHop. You can choose from the following options: New, In Progress, Acknowledged, or Closed.
Resolution	Select the resolution of the detection or the ticket that is associated with the detection, which you want to update in ExtraHop. You can choose between Action Taken or No Action Taken.

Output

The output contains the following populated JSON schema:

{
    "status": "",
    "result": ""
}

operation: Get Peers Devices

Input parameters

Parameter	Description
Based On	Select the input based on which you want to retrieve peers for the specified device from ExtraHop. You can choose between IP address or Device IDs If you choose 'IP Address', then in the IP Address field specify the IP address of the source device whose peer devices you want to retrieve from ExtraHop. If you choose 'Device ID', then in the Device IDs field specify the ID of the source device whose peer devices you want to retrieve from ExtraHop.
From	Specify the starting timestamp of the time range expressed in milliseconds since the epoch, based on which the query will search peer devices in ExtraHop. A negative value specifies that the search will begin with records created at a time in the past relative to the current time. For example, specify -30m to begin the search with records created 30 minutes before the time of the request. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. For details on supported time units and suffixes, see https://docs.extrahop.com/current/rest-api-guide/#supported-time-units-.
Until	(Optional) Specify the ending timestamp of the time range expressed in milliseconds since the epoch, based on which the query will search peer devices in ExtraHop. A negative value specifies that the search will begin with records created at a time in the past relative to the current time. For example, specify -30m to begin the search with records created 30 minutes before the time of the request. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. For details on supported time units and suffixes, see https://docs.extrahop.com/current/rest-api-guide/#supported-time-units-.
Role	(Optional) Select the role of the peer device in relation to the origin device. You can choose from the following options: Any, Client, or Server.
Protocol	(Optional) Specify the protocol over which the origin device is communicating, such as "HTTP". If no value is set, the object includes any protocol.

Output

The output contains the following populated JSON schema:

[
    {
        "analysis": "",
        "analysis_level": "",
        "auto_role": "",
        "client_protocols": [],
        "default_name": "",
        "device_class": "",
        "dhcp_name": "",
        "discover_time": "",
        "discovery_id": "",
        "display_name": "",
        "dns_name": "",
        "extrahop_id": "",
        "id": "",
        "ppaddr4": "",
        "is_l3": "",
        "macaddr": "",
        "mod_time": "",
        "on_watchlist": "",
        "parent_id": "",
        "role": "",
        "server_protocols": [],
        "url": "",
        "user_mod_time": "",
        "vendor": "",
        "vlanid": ""
    }
]

operation: Get Protocols

Input parameters

Parameter	Description
Based On	Select the input based on which you want to retrieve active network protocols for the specified device from ExtraHop. You can choose between IP address or Device IDs If you choose 'IP Address', then in the IP Address field specify the IP address of the source device whose active protocols you want to retrieve from ExtraHop. If you choose 'Device ID', then in the Device ID field specify the ID of the source device whose active protocols you want to retrieve from ExtraHop.
From	Specify the starting timestamp of the time range expressed in milliseconds since the epoch, based on which the query will search active protocols in ExtraHop. A negative value specifies that the search will begin with records created at a time in the past relative to the current time. For example, specify -30m to begin the search with records created 30 minutes before the time of the request. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. For details on supported time units and suffixes, see https://docs.extrahop.com/current/rest-api-guide/#supported-time-units-.
Until	(Optional) The ending timestamp of the time range expressed in milliseconds since the epoch, based on which the query will search active protocols in ExtraHop. A negative value specifies that the search will begin with records created at a time in the past relative to the current time. For example, specify -30m to begin the search with records created 30 minutes before the time of the request. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. For details on supported time units and suffixes, see https://docs.extrahop.com/current/rest-api-guide/#supported-time-units-.

Parameter

Description

Based On

Select the input based on which you want to retrieve active network protocols for the specified device from ExtraHop. You can choose between IP address or Device IDs

If you choose 'IP Address', then in the IP Address field specify the IP address of the source device whose active protocols you want to retrieve from ExtraHop.
If you choose 'Device ID', then in the Device ID field specify the ID of the source device whose active protocols you want to retrieve from ExtraHop.

From

Until

Output

The output contains the following populated JSON schema:

[
    {
        "analysis": "",
        "analysis_level": "",
        "auto_role": "",
        "client_protocols": [],
        "default_name": "",
        "device_class": "",
        "dhcp_name": "",
        "discover_time": "",
        "discovery_id": "",
        "display_name": "",
        "dns_name": "",
        "extrahop_id": "",
        "id": "",
        "ppaddr4": "",
        "is_l3": "",
        "macaddr": "",
        "mod_time": "",
        "on_watchlist": "",
        "parent_id": "",
        "role": "",
        "server_protocols": [],
        "url": "",
        "user_mod_time": "",
        "vendor": "",
        "vlanid": ""
    }
]

operation: Tag Devices

Input parameters

Parameter	Description
Tag Name	Specify the name of the tag that you want to add or remove from the specified device.
Action	Select the action that you want to perform on the tags in ExtraHop. Choose 'Add' to add tags to the device or choose 'Remove' to remove the tags from the device.
Based On	Select the input based on which you want to add or remove tags from the device. You can choose between IP address or Device IDs If you choose 'IP Address', then in the IP Address field specify a CSV list of device IP addresses to which you want to add or remove the specified tag. If you choose 'Device ID', then in the Device IDs field specify a CSV list of device IDs you want to which you want to add or remove the specified tag.

Parameter

Description

Tag Name

Specify the name of the tag that you want to add or remove from the specified device.

Action

Select the action that you want to perform on the tags in ExtraHop. Choose 'Add' to add tags to the device or choose 'Remove' to remove the tags from the device.

Based On

Select the input based on which you want to add or remove tags from the device. You can choose between IP address or Device IDs

If you choose 'IP Address', then in the IP Address field specify a CSV list of device IP addresses to which you want to add or remove the specified tag.
If you choose 'Device ID', then in the Device IDs field specify a CSV list of device IDs you want to which you want to add or remove the specified tag.

Output

The output contains the following populated JSON schema:

{
    "apply_all": "",
    "author": "",
    "categories": [],
    "cc": [],
    "description": "",
    "disabled": "",
    "field_name": "",
    "field_name2": "",
    "field_op": "",
    "id": "",
    "interval_length": "",
    "mod_time": "",
    "name": "",
    "notify_snmp": "",
    "object_type": "",
    "operand": "",
    "operator": "",
    "param": {},
    "param2": {},
    "protocols": [],
    "refire_interval": "",
    "severity": "",
    "stat_name": "",
    "type": "",
    "units": ""
}

operation: Create Tag

Input parameters

Parameter	Description
Tag Name	Specify the name of that tag that you want to create in ExtraHop.

Output

The output contains the following populated JSON schema:

{
    "status": "",
    "result": ""
}

operation: Search Packet

Input parameters

Parameter	Description
From	Specify the starting timestamp of the time range expressed in milliseconds since the epoch, based on which the packets are searched in ExtraHop. A negative value specifies that the search will begin with records created at a time in the past relative to the current time. For example, specify -30m to begin the search with records created 30 minutes before the time of the request. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. For details on supported time units and suffixes, see https://docs.extrahop.com/current/rest-api-guide/#supported-time-units-.
Until	(Optional) The ending timestamp of the time range expressed in milliseconds since the epoch, based on which the packets are searched in ExtraHop. A negative value specifies that the search will begin with records created at a time in the past relative to the current time. For example, specify -30m to begin the search with records created 30 minutes before the time of the request. The default unit for a negative value is milliseconds, but other units can be specified with one of the following unit suffixes: ms, s, m, h, d, w, M, y. For details on supported time units and suffixes, see https://docs.extrahop.com/current/rest-api-guide/#supported-time-units-.
File Format	(Optional) Select the file format for the searched packet, which can be downloaded into the FortiSOAR 'Attachment' module. You can choose between pcap, pcapng, keylog_txt, or zip.
Limit Bytes	(Optional) Specify the maximum number of bytes to return.
Search Duration	(Optional) Specify the maximum amount of time to run the packet search. The default unit is milliseconds, but other units can be specified with a unit suffix.
BPF	(Optional) Specify the Berkeley Packet Filter (BPF) syntax for packet search.
IP1	(Optional) Specify the IP address whose sent or received packets will be returned by this operation.
Port1	(Optional) Specify the Port whose sent or received packets will be returned by this operation.
IP2	(Optional) Specify the IP address whose sent or received packets will be returned by this operation.
Port2	(Optional) Specify the Port whose sent or received packets will be returned by this operation.

Output

The output contains a non-dictionary value.

operation: Get Detections

Input parameters

None.

Output

The output contains the following populated JSON schema:

{
    "appliance_id": "",
    "assignee": "",
    "categories": [
        ""
    ],
    "description": "",
    "end_time": "",
    "id": "",
    "is_user_created": "",
    "mitre_tactics": [],
    "mitre_techniques": [],
    "mod_time": "",
    "participants": [],
    "properties": "",
    "resolution": "",
    "risk_score": "",
    "start_time": "",
    "status": "",
    "ticket_id": "",
    "ticket_url": "",
    "title": "",
    "type": "",
    "update_time": ""
}

operation: Get Detection By ID

Input parameters

Parameter	Description
Detection ID	Specify the unique identifier for the detection you want to retrieve from ExtraHop.

Output

The output contains the following populated JSON schema:

{
    "appliance_id": "",
    "assignee": "",
    "categories": [],
    "description": "",
    "end_time": "",
    "id": "",
    "is_user_created": "",
    "mitre_tactics": [],
    "mitre_techniques": [],
    "mod_time": "",
    "participants": [],
    "properties": "",
    "resolution": "",
    "risk_score": "",
    "start_time": "",
    "status": "",
    "ticket_id": "",
    "ticket_url": "",
    "title": "",
    "type": "",
    "update_time": ""
}

operation: Get Detection Formats

Input parameters

None.

Output

The output contains the following populated JSON schema:

{
    "author": "",
    "categories": [],
    "display_name": "",
    "is_user_created": "",
    "mitre_categories": [],
    "properties": "",
    "type": ""
}

operation: Create New Detection Format

Input parameters

Parameter	Description
Type	Specify the string identifier for the detection type you want to create in ExtraHop. The string can only contain letters, numbers, and underscores. Although detection types are unique across built-in formats, and detection types are unique across custom formats; a built-in and custom format can share the same detection type.
Display Name	Specify the display name of the detection type that appears on the 'Detections' page in the ExtraHop system.
Author	(Optional) Specify the author of the detection format you want to create in ExtraHop.
Categories	(Optional) Specify the list of categories to which the detection you want to create in ExtraHop belongs. Keep the following in mind: For POST and PATCH operations a list with a single string must be specified More than one category for custom detection formats cannot be specified. The 'perf' or 'sec' category is automatically added to all detection formats.
Mitre Categories	(Optional) Specify the IDs of the MITRE techniques associated with the detection you want to create in ExtraHop.

Output

The output contains the following populated JSON schema:

{
    "author": "",
    "categories": [],
    "display_name": "",
    "is_user_created": "",
    "mitre_categories": [],
    "properties": "",
    "type": ""
}

operation: Delete Detection Format

Input parameters

Parameter	Description
Detection ID	Specify the unique string identifier for the detection you want to delete from ExtraHop.

Output

The output contains the following populated JSON schema:

{
    "status": "",
    "result": ""
}

operation: Get Detection Hiding Rules

Input parameters

None.

Output

The output contains the following populated JSON schema:

{
    "author": "",
    "create_time": "",
    "description": "",
    "detection_type": "",
    "detections_hidden": "",
    "enabled": "",
    "expiration": "",
    "hide_past_detections": "",
    "id": "",
    "offender": "",
    "participants_hidden": "",
    "properties": [],
    "victim": ""
}

operation: Update Detection Format

Input parameters

Parameter	Description
Detection ID	Specify the unique string identifier for the detection format you want to update in ExtraHop
Display Name	Specify the display name of the detection type that appears on the 'Detections' page in the ExtraHop system.
Author	(Optional) Specify the author of the detection format you want to update in ExtraHop.
Categories	(Optional) Specify the list of categories to which the detection you want to update in ExtraHop belongs. Keep the following in mind: For POST and PATCH operations a list with a single string must be specified More than one category for custom detection formats cannot be specified. The 'perf' or 'sec' category is automatically added to all detection formats.
Mitre Categories	(Optional) Specify the IDs of the MITRE techniques associated with the detection you want to update in ExtraHop.
Type	(Optional) Specify the string identifier for the detection type you want to update in ExtraHop. The string can only contain letters, numbers, and underscores. Although detection types are unique across built-in formats, and detection types are unique across custom formats; a built-in and custom format can share the same detection type.

Output

The output contains the following populated JSON schema:

{
    "status": "",
    "result": ""
}

operation: Update Associated Ticket

Input parameters

Parameter	Description
Ticket ID	Specify the ID of the ticket associated with the detection you want to update in ExtraHop.
Assignee	Specify the assignee of the ticket associated with the detection you want to update in ExtraHop.
Status	Select the status of the ticket associated with the detection you want to update in ExtraHop. You can choose from the following options: New, In Progress, Acknowledged, or Closed.
Resolution	Select the resolution of the ticket associated with the detection you want to update in ExtraHop. You can choose between Action Taken or No Action Taken.

Output

The output contains the following populated JSON schema:

{
    "author": "",
    "categories": [],
    "display_name": "",
    "is_user_created": "",
    "mitre_categories": [],
    "properties": "",
    "type": ""
}

operation: Search Detections

Input parameters

Parameter	Description
Categories	Specify a list of one or more detection categories that you want to retrieve from ExtraHop.
Assignee	Specify a list of one or more assignee of the detection to retrieve from ExtraHop. Specify `.none` to search for unassigned detections or specify `.me` to search for detections assigned to the authenticated user.
Ticket ID	Specify a list of one or more ID of the ticket that is associated with the detection to retrieve from ExtraHop.
Status	Select one or more detection status to retrieve from ExtraHop. You can select from the following options: New In Progress Acknowledged Closed
Resolution	Select one or more detection resolution to retrieve from ExtraHop. You can select from the following options: Action Taken No Action Taken
Types	Specify the list of one or more type of the detection to retrieve from ExtraHop.
Min Risk Score	Specify the risk score of detection to retrieve detections with risk scores greater than or equal to the specified value.
From	Specify the starting timestamp of the time range expressed in milliseconds since the epoch, based on which the query will search detections in ExtraHop. Detections that started before the specified date are returned if the detection was ongoing at that time.
Limit	Specify the maximum number of results, per page, that this operation should return.
Offset	Specify the index of the first item to be returned by this operation. This parameter is useful if you want to get a subset of records, say incidents starting from the 10th log record. By default, this is set as 0.
Sort	Select this checkbox if you want to sort records retrieved from ExtraHop. By default, records are sorted in the descending order on the timestamp field. If you select this checkbox, then you must specify the following parameters: Field: Specify a field based on which you want to sort records retrieved from ExtraHop. By default, this is set to 'timestamp'. Direction: Direction based on which you want the operation to sort records retrieved from ExtraHop. You can choose between ASC or DESC. By default, this is set to 'descending'
Until	Specify the ending timestamp of the time range expressed in milliseconds since the epoch, based on which the query will search detections in ExtraHop.
Update Time	Returns detections related to events that occurred after the specified date, expressed in milliseconds since the epoch. Note that ExtraHop Machine Learning Services analyze historical data to generate detections, and so there is a time delay between when the events that cause those detections occur and when the detections are generated. If you search for detections in the same update_time window multiple times, the later search might return detections that were not returned by the earlier search.
Mod Time	Returns detections that were updated after the specified date, expressed in milliseconds since the epoch.
ID Only	(Optional) Select this checkbox if you want to retrieve only the IDs of the detections. By default, It is set to false

Output

The output contains the following populated JSON schema:

{
    "appliance_id": "",
    "assignee": "",
    "categories": [],
    "description": "",
    "id": "",
    "is_user_created": "",
    "mitre_tactics": [],
    "mitre_techniques": [],
    "mod_time": "",
    "participants": [],
    "properties": "",
    "resolution": "",
    "risk_score": "",
    "start_time": "",
    "status": "",
    "ticket_id": "",
    "title": "",
    "type": "",
    "update_time": ""
}

Included playbooks

Create Alert
Create New Detection Format
Create Tag
Delete Detection Format
Get Alert Details
Get Alerts
Get Detection By ID
Get Detection Formats
Get Detection Hiding Rules
Get Detections
Get Peers Devices
Get Protocols
Get Watchlist
Query Records
Search Detections
Search Devices
Search Packet
Tag Devices
Update Alert
Update Associated Ticket
Update Detection
Update Detection Format
Update Watchlist

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Unified SASE

Single Vendor SASE

Cloud Network Security

Secure Endpoint Connectivity

Web Application / API Protection

Security Operations

Security Operations Automation

Identity

Early Detection & Prevention

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Communication & Surveillance

Unified SASE

Single Vendor SASE

Secure Endpoint Connectivity

Cloud Network Security

Cloud-Native Security

Web Application / API Protection

Security Operations

Security Operations Automation

Endpoint

Data Protection

Identity

Email

Early Detection & Prevention

Expert Services

Edge Firewall

Orchestration & management

SD Branch

Application Delivery

Single Vendor SASE

Secure Endpoint Connectivity

Secure Private Access

Thin Edge

Identity

Application Gateway

Enterprise Asset Management

Endpoint Agent

Agentless Security Posture

Identity

Wireless

Switching

Identity

Privilege Acccess Management

Next Generation Firewall

Orchestration & management

Expert Services

All

All

Account Management

SAAS Management

SAAS Application Security

Managed Services

Platform as a service (PAAS)

Other SAAS Services

4D Pillars

Cloud

Popular Solutions

ExtraHop

ExtraHop v2.1.0

About the connector

Version information

Release Notes for version 2.1.0

Installing the connector

Prerequisites to configuring the connector

Minimum Permissions Required

Configuring the connector

Configuration parameters

Actions supported by the connector

operation: Get Alerts

Input parameters

Output