ExtraHop

Integration version: 4.0

Configure ExtraHop integration in Google Security Operations SOAR

For detailed instructions on how to configure an integration in Google Security Operations SOAR, see Configure integrations.

Integration parameters

Use the following parameters to configure the integration:

Parameter Display Name Type Default Value Is Mandatory Description
API Root String Yes API root of the ExtraHop instance.
Client ID String N/A Yes Client ID of the ExtraHop instance.
Client Secret Password N/A Yes Client Secret of the ExtraHop instance.
Verify SSL Checkbox Checked Yes If enabled, verify the SSL certificate for the connection to the ExtraHop server is valid.

Product Use Cases

Ingestion of alerts

Actions

Ping

Description

Test connectivity to ExtraHop with parameters provided at the integration configuration page in the Google Security Operations Marketplace tab.

Parameters

N/A

Action Results

Script Result
Script Result Name Value Options Example
is_succeed True/False is_succeed:False

Case Wall

Result type Value/Description Type
Output message*

The action should not fail nor stop a playbook execution:

if successful: "Successfully connected to the ExtraHop server with the provided connection parameters!"

The action should fail and stop a playbook execution:

If not successful: "Failed to connect to the ExtraHop server! Error is {0}".format(exception.stacktrace)

 General

Connectors

ExtraHop - Detections Connector

Description

Pull information about detections from ExtraHop.

Configure ExtraHop - Detections Connector in Google Security Operations SOAR

For detailed instructions on how to configure a connector in Google Security Operations SOAR, see Configuring the connector.

Connector parameters

Use the following parameters to configure the connector:

Parameter Display Name Type Default Value Is Mandatory Description
Product Field Name String Product Name Yes Enter the source field name in order to retrieve the Product Field name.
Event Field Name String type Yes Enter the source field name in order to retrieve the Event Field name.
Environment Field Name String "" No

Describes the name of the field where the environment name is stored.

If the environment field isn't found, the environment is the default environment.
Environment Regex Pattern String .* No

A regex pattern to run on the value found in the "Environment Field Name" field.

Default is .* to catch all and return the value unchanged.

Used to allow the user to manipulate the environment field via regex logic.

If the regex pattern is null or empty, or the environment value is null, the final environment result is the default environment.
Script Timeout (Seconds) Integer 180 Yes Timeout limit for the python process running the current script.
API Root String https://{instance}.api.cloud.extrahop.com Yes API root of the ExtraHop instance.
Client ID String N/A Yes Client ID of the ExtraHop instance.
Client Secret Password N/A Yes Client Secret of the ExtraHop instance.
Lowest Risk Score To Fetch Integer N/A No Lowest risk score that needs to be used to fetch detections. Maximum: 100. If nothing is provided, the connector will ingest detections with all risk scores.
Max Hours Backwards Integer 1 No Amount of hours from where to fetch detections.
Max Detections To Fetch Integer 100 No How many detections to process per one connector iteration. Default: 100.
Use whitelist as a blacklist Checkbox Unchecked Yes If enabled, whitelist will be used as a blacklist.
Verify SSL Checkbox Checked Yes If enabled, verify the SSL certificate for the connection to the ExtraHop server is valid.
Proxy Server Address String N/A No The address of the proxy server to use.
Proxy Username String N/A No The proxy username to authenticate with.
Proxy Password Password N/A No The proxy password to authenticate with.

Connector Rules

Proxy Support

The connector supports proxy.