ExtraHop RevealX Threat Detection and Response

The typical use case for ExtraHop Reveal(x)  that we use is from a security perspective, specifically Network Detect and Response. The ExtraHop solution has both the network analytics and the security side of it, and a typical use case is the security side of the entire solution.

We position it in a network to do security-based analytics, detections, and threat and anomaly detection. That's what we position it for and use it for.

The best features of ExtraHop Reveal(x)  include the cloud-based Reveal(x) 360, which is an absolute plus. You've got one point of administration where you can attach multiple vendors or solutions or sensors, and that's good.

The plus is the capacity of the different sensors that the ExtraHop solution has; it's quite big compared to the price it costs, and the detailed dashboarding is a big plus to get proper insights on both traffic and asset visibility within the network.

The machine learning-driven behavioral analysis feature is quite useful. I do quite a lot of POVs with customers for a period of four weeks, and I always tell them that in the first week, week and a half, the machine needs to learn the network. Customers appreciate it, so that's good.

On the other side, it gives you clear insights into what the normal baseline would be and what the actual deviation is after machine learning has understood how the network functions. It's very useful.

ExtraHop Reveal(x) can improve regarding integration capabilities. For instance, the market is getting really flooded with Microsoft Sentinel , and I know there is an integration possible, but the tools on the market right now indicate that integration should not be a skill from an integrator point of view. It should be quite easy for customers to integrate that solution into SOCs, SIEMs, or any other integration with other tools.

There are various integrations from which there's a manual on how to do it, but specifically, the Microsoft portfolio, particularly Sentinel , integration is not yet there. If you score them on a scale of one to ten, ExtraHop scores around a 7.5 to an 8 on an integration basis, but there's actually room for improvement on that side.

In the older days, ExtraHop had a license model where you could do all you can eat, so if you had a sensor with 10 gig of capacity, you could use all the entire 10 gig of throughput. They changed that to an asset-based license model, and that's an absolute downside of the solution, where it is harder for smaller companies to acquire the solution itself.

That has given us quite some problems in positioning the solution properly within the network, so the licensing model is an absolute downside where they need to improve.

I would rate the technical support from ExtraHop a solid eight. It's not exceptional, but it's definitely not bad. There are a lot more worse examples in the market, so it's good and we are happy.

My clients do see an ROI from ExtraHop Reveal(x); they see the value of the solution within the network, and it gives them solid confidence that they actually do see everything that's going across it.

Looking at the Dutch market, where I am based, and looking at the positioning and the customer base, for instance, educational customers with 20,000 clients find the price has a high impact on positioning it properly within educational environments.

In contrast, if you look at healthcare, where there are quite a lot of devices in the network or people that come and go, the amount of devices can become quite high, impacting the licensing model of ExtraHop and therefore the cost. The cost and return on investment are relative; if you have an enterprise customer with a static environment, it's quite easy to accept the cost and therefore see the return on investment. However, with other verticals, it's a lot harder to position the solution successfully.

We manage the setup cost ourselves, so I am quite happy with that. I also had engagement with professional services from ExtraHop, and it wasn't bad, but I was not impressed; it's not academic work. Pricing-wise, they are not cheap, but they also offer quite a lot of features. Pricing is subjective to different customers.

My advice to others considering ExtraHop Reveal(x) is don't doubt, just get it and make sure you have the money because the return on investment will prove itself, and you only need to have one problem for the solution to prove its value. On a scale of one to ten, I rate ExtraHop Reveal(x) an eight.

Being in a financial institution, we have certain regulations such as PCI DSS, so we want to ensure any connection from a non-PCA segment is not being connected to a core segment; vice versa connection should not happen. We have something called a server segment and a workstation segment, so apart from the whitelisted internet connection, no connection should be established from the server segment. These are the monitoring use cases we have implemented in ExtraHop Reveal(x)  so far.

The best features of ExtraHop Reveal(x)  for me are the depth it provides, especially the picturization where the connection is established; it's absolutely remarkable. If I want to know a specific IP and which server it has been connected to, it's easy to gather those kinds of trees from the NDR.

ExtraHop is very customizable, it's easy to access, and I can understand the flow where an IP address or email address has reached which level of security system; it's very easy to follow that flow.

I would like to see improvements in areas where events are getting dropped; we're not able to view complete insights. For example, if I'm sending communication from one place to another while passing multiple security controls, it's not giving a complete flow easily. It shows one communication from the firewall, then one from the firewall to the proxy, and one from the proxy to the user endpoint as separate communications. There's no way to uniquely correlate that this is the same communication happening throughout that packet flow.

I have been working with ExtraHop Reveal(x) for two to four months. It is a new product.

The integration with other security and IT operation tools has been implemented through an agent on the network level, and we are not facing any issues while deploying the agents. We've done integration only with the SIM solutions, specifically QRadar, and we don't find any issues there. The only consideration is that its rules are very noisy, and we need to fine-tune extensively; custom fine-tuning is completely required when bringing NDR into the picture.

At the moment, we are using different endpoint solutions, including EDR, and we have extra NDR solutions.

XDR  is from Microsoft, and MDR is not from Microsoft; it's ExtraHop.

ExtraHop Reveal(x) is a new solution for me, from an NDR SIM perspective, that's a monitoring solution we have just implemented. We are not sure how efficient an NDR is to detect network-level threats; it needs to be explored.

At the moment, we don't use the machine learning driven behavioral analysis feature; we're not sure where the data will be hosted and where it will be sent, so we don't want to do any kind of AI-based and machine learning-based decision making.

We don't want to decrypt any of the information; it's supposed to be captured based on the network flow of the packets without opening or reading them, considering the sensitive information stored under the packets.

I have not put any statistics or metrics to evaluate the effectiveness of ExtraHop Reveal(x) at the moment; it's still on the roadmap. This is an experience from SIM, and many stakeholders also need to be given feedback on the effectiveness, especially to validate with the business if it's blocking any genuine operations which cause an impact or not.

So far, I am using only EDR, the Microsoft EDR, for containment and related activities; there is no automation at the NDR level at the moment, but it is in the roadmap for future use.

If you have proper network segmentation, then I would recommend going for this kind of NDR monitoring with ExtraHop Reveal(x) as it provides more insights about what is happening in the networks. If you don't have network segmentation and only small subnets of IPs, I suggest not to go for NDR solutions because they won't add any value, even if you have many solutions on your network.

I would rate ExtraHop Reveal(x) eight to nine out of ten.

We have IoT devices, network traffic, and all these traffic. ICT and non-ICT, all.

I am not sure about the specifics of how ExtraHop Reveal(x)  has changed our approach. The cybersecurity team could elaborate more on this topic.

The solution offers a friendly GUI for security features.

We expect regular firmware patches for upgrades and maintenance. Currently, we have to check manually as we do not receive any notifications about new patches, maintenance, or firmware releases. It would be beneficial if they could send us notifications for new releases and maintenance trials.

I have been working with Reveal(x)  for two years.

The technical support is good, very good. I would rate their technical support nine out of ten.

We used NETSCOUT previously.

The initial setup was straightforward. We had 20 credit hours and completed it on time within ten days.

The implementation was done with the help of a reseller. We requested two individuals for implementation.

I do not know the prices and therefore cannot provide any comments on pricing or setup costs.

We used NETSCOUT before using ExtraHop Reveal(x).

ExtraHop Reveal(x) is highly recommended and very good. It is operationally easy to use.

I'd rate the solution nine out of ten.