Admin UI Guide

If you want to connect to Atlas services through a proxy, configure the proxy settings in the ExtraHop Admin UI. If you do not have a proxy, you can skip this section.

1. In the Network Settings section, click Connectivity.
2. Click Enable ExtraHop Cloud Proxy. Click Change ExtraHop Cloud Proxy to modify an existing configuration.
3. Click Enable ExtraHop Cloud Proxy.
4. Type the hostname or IP address for your proxy server.
5. Type the port number for your proxy server, such as 8080.
6. (Optional): If required, type a username and password for your proxy server.
7. Click Save.

Some environments are configured so that encrypted traffic cannot leave the network without inspection by a third-party device. This device can act as an SSL/TLS endpoint, which decrypts and re-encrypts the traffic before sending the packets to the Atlas server. If your environment is not set up for inspection by third-party devices, you can skip this section.

1. Log into the Admin UI of the ExtraHop appliance you want to connect to Atlas services.
2. In the Appliance Settings section, click Running Config.
3. Click Edit config.
4. Add the entry to the Running Config file by completing the following steps:
   1. Add a comma after the second to last curly brace (}).
   2. Press ENTER to create a new line.
   3. Paste "ecm": { "atlas_verify_cert": false } on the new line before the final curly brace (}).
5. Click Update.
6. Click View and Save Changes.
7. Review the changes and click Save.
8. Click Done.

After you have configured any optional firewall or proxy settings, complete the following steps to establish a connection to the Atlas server.

1. Log into the Admin UI on the ExtraHop Discover, Explore, or Trace appliance.
2. In the Network Settings section, click Atlas Services.
3. If you have not already changed the default password for the setup and shell users, you will see a message prompting you to change the password. Change the default password and then proceed to the next step.
4. On the Connect to Atlas Services page, click Terms and Conditions to read about the service agreement.
   The Atlas subscription services agreement opens in the browser or downloads the file to your computer.
5. Return to the Connect to Atlas Services page and select the checkbox next to Terms and Conditions.
6. Click Test Connectivity to make sure the connection is successful. If you have problems connecting to the Atlas service, see the previous sections to determine if you must open access through a firewall or connecting through a proxy.
7. Click Connect.

1. In the Access Settings section, click Support Account.
2. Click Support Account.

   Note:

   On Command, Explore, and Trace appliances, this step is unnecessary.

3. Click Enable Support Account.
4. Copy the encrypted key from the text box and email the key to support@extrahop.com.
5. Click Done.

1. In the Access Settings section, click Support Account.
2. Click Support Account.

   Note:

   On Command, Explore, and Trace appliances, this step is unnecessary.

3. Click Regenerate Key.
4. Click Regenerate.
5. Copy the encrypted key from the text box and email the key to support@extrahop.com.
6. Click Done.

The Atlas Remote UI account enables the ExtraHop Support team to provide remote analysis reports through Atlas Services (Discover appliance only).

1. In the Access Settings section, click Support Account.
2. Click Atlas Remote UI Account.
3. Click Enable Atlas Remote UI Account.
4. Copy the encrypted key from the text box and email the key to support@extrahop.com.
5. Click Done.

By adding a local user account, you can provide users with direct access to your ExtraHop appliances and restrict their access as needed by their role in your organization.

1. Log into the Admin UI on the ExtraHop appliance.
2. In the Access Settings section, click Users.
3. Click Add User.
4. In the Personal Information section, type the following information:

   Login ID: The username that users will log into their ExtraHop appliances with, which cannot contain any spaces. For example, adalovelace.

   Full Name: A display name for the user, which can contain spaces. For example, Ada Lovelace.

   Password: The password for this account, which must be a minimum of 5 characters.

   Confirm Password: Re-type the password from the Password field.

5. In the Authentication Type section, select Local.
6. In the User Type section, select the type of privileges for the user.
   • Unlimited privileges enables full read and write access to the Web and Admin UIs.
   • Limited privileges enable you to select from a subset of privileges and options.

   Note:

   For more information, see the User privileges section.

7. Click Save.

Add a remote SAML user account when you want to provision the remote user before that user logs into the appliance. After the user is added, you can add them to local groups or share items directly with them before they log in through the SAML provider.

1. Log into the Admin UI on the Command or Discover appliance.
2. In the Access Settings section, click Users.
3. Click Add User.
4. In the Personal Information section, type the following information:

   Login ID: The email address that the user logs into their SAML SSO identity provider with.

   Full Name: The first and last name of the user.

5. In the Authentication Type section, select Remote.
6. Click Save.

The ExtraHop system supports the Lightweight Directory Access Protocol (LDAP) for authentication and authorization. Instead of storing user credentials locally, you can configure your ExtraHop appliance to authenticate users remotely with an existing LDAP server. Note that ExtraHop LDAP authentication only queries for user accounts; it does not query for any other entities that might be in the LDAP directory.

1. Log into the Admin UI on the ExtraHop appliance.
2. In the Access Settings section, click Remote Authentication.
3. From the Remote authentication method drop-down list, select LDAP and then click Continue.
4. On the LDAP Settings page, complete the following server information fields:
   1. In the Hostname field, type the hostname or IP address of the LDAP server. If you are configuring a hostname, make sure that the DNS entry of the ExtraHop appliance is properly configured.
   2. In the Port field, type the port number on which the LDAP server is listening.
   3. From the Server Type drop-down list, select Posix or Active Directory.
   4. (Optional): In the Bind DN field, type the bind DN. The bind DN is the user credentials that allow you to authenticate with the LDAP server to perform the user search. The bind DN must have list access to the base DN and any OU, groups, or user account required for LDAP authentication. If this value is not set, then an anonymous bind is performed. Note that anonymous binds are not enabled on all LDAP servers.
   5. (Optional): In the Bind Password field, type the bind password. The bind password is the password required when authenticating with the LDAP server as the bind DN specified above. If you are configuring an anonymous bind, leave this field blank. In some cases, an unauthenticated bind is possible, where you supply a Bind DN value but no bind password. Consult your LDAP administrator for the proper settings.
   6. From the Encryption drop-down list, select one of the following encryption options.

      None: This options specifies cleartext TCP sockets. All passwords are sent across the network in cleartext in this mode.

      LDAPS: This option specifies LDAP wrapped inside SSL.

      StartTLS: This option specifies TLS LDAP. (SSL is negotiated before any passwords are sent.)

   7. Select Validate SSL Certificates to enable certificate validation. If you select this option, the certificate on the remote endpoint is validated against the root certificates as specified by the trusted certificates manager. You must configure which certificates you want to trust on the Trusted Certificates page. For more information, see Add a trusted certificate to your ExtraHop appliance.
   8. Type a time value in the Refresh Interval field or leave the default setting of 1 hour. The refresh interval ensures that any changes made to user or group access on the LDAP server are updated on the ExtraHop appliance.
5. Configure the following user settings:
   1. Type the base DN in the Base DN field. The Base DN is the point from where a server will search for users. The base DN must contain all user accounts that will have access to the ExtraHop appliance. The users can be direct members of the base DN or nested within an OU within the base DN if the Whole Subtree option is selected for the Search Scope specified below.
   2. Type a search filter in the Search Filter field. Search filters enable you to define search criteria when searching the LDAP directory for user accounts.

      Important:

      The ExtraHop system automatically adds parentheses to wrap the filter and will not parse this parameter correctly if you add parentheses manually. Add your search filters in this step and in step 5b, similar to the following example: cn=atlas* |(cn=EH-*)(cn=IT-*) In addition, if your group names include the asterisk (*) character, the asterisk must be escaped as \2a. For example, if your group has a CN called test*group, type cn=test\2agroup in the Search Filter field.

   3. From the Search Scope drop-down list, select one of the following options. Search scope specifies the scope of the directory search when looking for user entities.

      Whole subtree: This option looks recursively under the group DN for matching users.

      Single level: This option looks for users that exist in the base DN only; not any subtrees.

6. To configure user group settings, select the Import user groups from LDAP server checkbox and configure the following settings:
   1. Type the base DN in the Base DN field. The Base DN is the point from where a server will search for user groups. The base DN must contain all user groups that will have access to the ExtraHop appliance. The user groups can be direct members of the base DN or nested within an OU within the base DN if the Whole Subtree option is selected for the Search Scope specified below.
   2. Type a search filter in the Search Filter field. Search filters enable you to define search criteria when searching the LDAP directory for user groups.

      Important:

      For group search filters, the ExtraHop system implicitly filters on the objectclass=group, and so objectclass=group should not be added to this filter.

   3. From the Search Scope drop-down list, select one of the following options. Search scope specifies the scope of the directory search when looking for user group entities.

      Whole subtree: This option looks recursively under the base DN for matching user groups.

      Single level: This option looks for user groups that exist in the base DN; not any subtrees.

7. Click Test Settings. If the test succeeds, a status message appears near the bottom of the page. If the test fails, click Show details to see a list of errors. You must resolve any errors before you continue.
8. Click Save and Continue.

You can configure your ExtraHop Command and Discover appliances to enable users to log into the appliance through the Google identity management service.

The ExtraHop appliance supports Remote Authentication Dial In User Service (RADIUS) for remote authentication and local authorization only. For remote authentication, the ExtraHop appliance supports unencrypted RADIUS and plaintext formats.

1. Log into the Admin UI on the ExtraHop appliance.
2. In the Access Settings section, click Remote Authentication.
3. From the Remote authentication method drop-down list, select RADIUS and then click Continue.
4. On the Add RADIUS Server page, type the following information:

   Host

   The hostname or IP address of the RADIUS server. Make sure that the DNS of the ExtraHop appliance is properly configured if you specify a hostname.

   Secret

   The shared secret between the ExtraHop appliance and the RADIUS server. Contact your RADIUS administrator to obtain the shared secret.

   Timeout

   The amount of time in seconds that the ExtraHop appliance waits for a response from the RADIUS server before attempting the connection again.

5. Click Add Server.
6. (Optional): Add additional servers as needed.
7. Click Save and Finish.
8. From the Permission assignment options drop-down list, choose one of the following options:
   • Remote users have full write access

     This option allows remote users to have full write access to the ExtraHop Web UI.

   • Remote users have full read-only access

     This option allows remote users to have read-only permissions to the ExtraHop Web UI.

     Note:

     You can add read-write permissions on a per-user basis later through the Users page in the Admin UI.

   • Remote users can view connected appliances

     This option, which only appears on the Command appliance, allows remote users to log into the Admin UI on the Command appliance and view any connected Discover, Explore, and Trace appliances.

9. Select one of the following options to allow remote users to download packet captures and SSL session keys.
   • No access
   • Packets only
   • Packets and session keys
10. Click Save and Finish.
11. Click Done.

The ExtraHop appliance supports Terminal Access Controller Access-Control System Plus (TACACS+) for remote authentication and authorization.

1. Log into the Admin UI on the ExtraHop appliance.
2. In the Access Settings section, click Remote Authentication.
3. From the Remote authentication method drop-down list, select TACACS+, and then click Continue.
4. On the Add TACACS+ Server page, type the following information:

   Host: The hostname or IP address of the TACACS+ server. Make sure that the DNS of the ExtraHop appliance is properly configured if you are entering a hostname.

   Secret: The shared secret between the ExtraHop appliance and the TACACS+ server. Contact your TACACS+ administrator to obtain the shared secret.

   Timeout: The amount of time in seconds that the ExtraHop appliance waits for a response from the TACACS+ server before attempting to connect again.

5. Click Add Server.
6. (Optional): Add additional servers as needed.
7. Click Save and Finish.
8. From the Permission assignment options drop-down list, choose one of the following options:
   • Obtain privileges level from remote server

     This option allows remote users to obtain privilege levels from the remote server. You must also configure permissions on the TACACS+ server.

   • Remote users have full write access

     This option allows remote users to have full write access to the ExtraHop Web UI.

   • Remote users have full read-only access

     This option allows remote users to have read-only permissions to the ExtraHop Web UI.

     Note:

     You can add read-write privileges on a per-user basis later through the Users page in the Admin UI.

   • Remote users can view connected appliances

     This option, which only appears on the Command appliance, allows remote users to log into the Admin UI on the Command appliance and view any connected Discover, Explore, and Trace appliances.

9. Select one of the following options to allow remote users to download packet captures and SSL session keys.
   • No access
   • Packets only
   • Packets and session keys
10. Click Save and Finish.
11. Click Done.

Users with unlimited privileges can configure whether users can generate API keys for the ExtraHop system. You can allow only local users to generate keys, or you can also disable API key generation entirely.

1. Log into the ExtraHop Admin UI through the following URL:

   https://<hostname-or-IP-of-your-ExtraHop-appliance>/admin

2. In the Access Settings section, click API Access.
3. In the Manage API Access section, select one of the following options:
   • Allow all users to generate an API key: Local and remote users can generate API keys.
   • Only local users can generate an API key: Remote users cannot generate API keys.
   • No users can generate an API key: No API keys can be generated by any user.
4. Click Save Settings.

Cross-origin resource sharing (CORS) allows you to access the ExtraHop REST API across domain-boundaries and from specified web pages without requiring the request to travel through a proxy server.

1. In the Access Settings section, click API Access.
2. In the CORS Settings section, specify one of the following access configurations.
   • To add a specific URL, type an origin URL in the text box, and then click the plus (+) icon or press ENTER.

     The URL must include a scheme, such as HTTP or HTTPS, and the exact domain name. You cannot append a path; however, you can provide a port number.

   • To allow access from any URL, select the Allow API requests from any Origin checkbox.

     Note:

     Allowing REST API access from any origin is less secure than providing a list of explicit origins.

3. Click Save Settings and then click Done.

You must generate an API key before you can perform operations through the ExtraHop REST API. Keys can be viewed only by the user who generated the key or by system administrators with unlimited privileges. After you generate an API key, add the key to your request headers or the ExtraHop REST API Explorer.

1. In the Access Settings section, click API Access.
2. In the Generate an API Key section, type a description for the new key, and then click Generate.
3. Scroll down to the API Keys section, and copy the API key that matches your description.

By uploading threat intelligence information in the form of the Structured Threat Information eXpression (STIX) file format to your Discover and Command appliances, you can find suspicious hosts, IP addresses, and URIs in the ExtraHop Web UI.

1. Log into the Admin UI on your Discover or Command appliance.
   Threat intelligence files are applied only to the local appliance and are not synced between appliances. If you manage your Reveal(x) system through a Command appliance, upload the threat collection to the Command appliance and to each connected Discover appliance.
2. In the System Configuration section, click Threat Intelligence.
3. Click Upload New Collection.
4. Type a unique collection ID in the Collection ID field. The ID can only contain alphanumeric characters. Spaces are not allowed.
5. Type a display name in the Display Name field.
6. Click Choose file and select a .tar or .tgz file that contains a STIX file.
7. Click Upload.

By default, all supported modules on the ExtraHop appliance are included in the capture unless you manually exclude them.

1. Click System Configuration > Capture.
2. Click Excluded Protocol Modules.
3. Add Module to Exclude.
4. On the Select Protocol Module to Exclude page, from the Module Name dropdown, select the module that you want to exclude from the capture.
5. Click Add.
6. On the Excluded Protocol Modules page, click Restart Capture.
7. After the capture restarts, click OK.

Add filters to exclude specific MAC addresses or vendor device traffic from the network capture

1. In the System Configuration section, click Capture.
2. Click MAC Address Filters.
3. Click Add Filter.
4. In the MAC Address field, type the MAC address to exclude.
5. In the Mask field, type the mask to indicate how many bits, from left to right, the filter checks against the MAC address.
6. Click Add.
   In the following example, the full MAC address is excluded from the capture:

   MAC Address: 60:98:2D:B1:EC:42

   Mask: FF:FF:FF:FF:FF:FF

   In this example, only the first 24 bits are evaluated for exclusion:

   MAC Address: 60:98:2D:B1:EC:42

   Mask: FF:FF:FF:00:00:00

Add filters to exclude specific IP addresses and IP ranges from the network capture on the Discover appliance.

1. Click System Configuration > Capture.
2. Click IP Address Filters.
3. Click Add Filter.
4. On the IP Address Filters page, enter either a single IP address you want to exclude, or an IP address mask in CIDR format for a range of IP addresses you want to exclude.
5. Click Add.

Add filters to exclude traffic from specific ports from the network capture on the Discover appliance.

1. Go to the Configuration section and click Capture.
2. On the Capture Configuration page, click Port Filters.
3. Click Add Filter.
4. On the Port Address Filters page, enter the port you want to include.
   • To specify a source port you want to exclude, enter the port in the Source Port field.
   • To specify a destination port you want to exclude, enter the port in the Destination Port field.
5. From the IP Protcol drop-down list, select the protocol you want to exclude on the indicated port.
6. Click Add.

This procedure shows you how to enable the storage of SSL session keys on connected Trace appliances. Keys are stored for all sessions that the Discover appliance can decrypt. These keys include SSL session keys derived from SSL decryption keys you upload on the SSL Decryption Keys page, and keys received from PFS session key forwarders.

1. Log into the Admin UI on the Discover appliance.
2. In the System Configuration section, click Capture.
3. Click SSL Session Key Storage.
4. Select Enable SSL Session Key Storage.
5. Click Save.

You can view recently connected session key forwarders after you install the session key forwarder on your server and enable the SSL session key receiver service on the Discover appliance. Note that this page only displays session key forwarders that have connected over the last few minutes, not all session key forwarders that are currently connected.

1. Log into the Admin UI on the Discover appliance.
2. In the System Configuration section, click Capture.
3. Click SSL Shared Secrets.

You must install the software tap on each server to be monitored in order to forward packets to the ExtraHop system.

1. Go to https://<extrahop_ip_address>/admin/capture/rpcapd/windows/ to download the RPCAP Service for Windows installer file.
2. When the file is finished downloading, double-click the file to start the installer.
3. In the wizard, select the components to install.
   
4. Complete the ExtraHop IP and ExtraHop Port fields and click Next. The default port is 2003.
   
5. (Optional): Enter additional arguments in the text box and click Next.
   
6. Browse to and select the destination folder to install RPCAP Service.
   
7. If RPCAP Service was previously installed, click Yes to delete the previous service.
   
8. When the installation is complete, click Close.

For servers with multiple interfaces, you can configure the software tap to forward packets from a particular interface or from multiple interfaces by editing its configuration file on the server.

1. After installing the software tap, open the configuration file, /opt/extrahop/etc/rpcapd.ini.
   The configuration file contains this text or similar:

   ActiveClient = 10.0.0.100,2003
   NullAuthPermit = YES

2. Modify the existing ActiveClient line and create an ActiveClient line for each additional interface to be monitored. Specify each interface by its interface name or IP address.

   ActiveClient = <extrahop_ip>, <extrahop_port>, ifname=<interface_name>

   or

   ActiveClient = <extrahop_ip>, <extrahop_port>, ifaddr=<interface_address>

   Where <interface_name> is the name of the interface from which you want to forward packets, and <interface_address> is the IP address of the interface from which the packets are forwarded. The <interface_address> variable can be either the IP address itself, such as 10.10.1.100, or a CIDR specification (network IP address/subnet prefix length) that contains the IP address, such as 10.10.1.0/24.

   For every ActiveClient line, the software tap independently forwards packets from the interface specified in the line.

   The following is an example of the configuration file specifying two interfaces by the interface name:

   ActiveClient = 10.10.6.45, 2003, ifname=eth0
   ActiveClient = 10.10.6.45, 2003, ifname=eth1
   NullAuthPermit = YES

   The following is an example of the configuration file specifying two interfaces by the interface IP address:

   ActiveClient = 10.10.6.45, 2003, ifaddr=10.10.1.100
   ActiveClient = 10.10.6.45, 2003, ifaddr=10.10.2.100
   NullAuthPermit = YES

   The following is an example of the configuration file specifying two interfaces using CIDR specifications that contain the interface IP address:

   ActiveClient = 10.10.6.45, 2003, ifaddr=10.10.1.0/24
   ActiveClient = 10.10.6.45, 2003, ifaddr=10.10.2.0/24
   NullAuthPermit = YES

3. Save the configuration file. Make sure to save the file in ASCII format to prevent errors.
4. Restart the software tap by running the command:

   sudo /etc/init.d/rpcapd restart

   Note:

   To reinstall the software tap after changing the configuration file, run the installation command and replace <extrahop_ip> and <extrahop_port> with the –k flag in order to preserve the modified configuration file. For example: sudo sh ./install-rpcapd.sh –k

For servers with multiple interfaces, you can configure the software tap to forward packets from a particular interface or from multiple interfaces by editing its configuration file on the server.

1. After installing the software tap, on the server, open the configuration file: C:\Program Files\rpcapd\rpcapd.ini
   The configuration file contains this text or similar:

   ActiveClient = 10.0.0.100,2003
   NullAuthPermit = YES

2. Modify the existing ActiveClient line and create an ActiveClient line for each additional interface to be monitored. Specify each interface by its interface name or IP address.

   ActiveClient = <extrahop_ip>, <extrahop_port>, ifname=<interface_address>

   Where <interface_address> is the IP address of the interface from which the packets are forwarded and <interface_address> can be either the IP address itself, such as 10.10.1.100, or a CIDR specification (network IP address/subnet prefix length) that contains the IP address, such as 10.10.1.0/24.

   or

   ActiveClient = <extrahop_ip>, <extrahop_port>, ifaddr=<interface_name>

   Where <interface_name> is the name of the interface from which the packets are forwarded. The name is formatted as \Device\NPF_{<GUID>}, where <GUID> is the globally unique identifier (GUID) of the interface. For example, if the interface GUID is 2C2FC212-701D-42E6-9EAE-BEE969FEFB3F, the interface name is \Device\NPF_{2C2FC212-701D-42E6-9EAE-BEE969FEFB3F}.

   The following is an example of the configuration file specifying two interfaces with the interface IP address:

   ActiveClient = 10.10.6.45, 2003, ifaddr=10.10.1.100
   ActiveClient = 10.10.6.45, 2003, ifaddr=10.10.2.100
   NullAuthPermit = YES

   The following is an example of the configuration file specifying two interfaces with CIDR specifications that contain the interface IP address:

   ActiveClient = 10.10.6.45, 2003, ifaddr=10.10.1.0/24
   ActiveClient = 10.10.6.45, 2003, ifaddr=10.10.2.0/24
   NullAuthPermit = YES

   The following is an example of the configuration file specifying two interfaces with the interface name:

   ActiveClient = 10.10.6.45, 2003, ifname=\Device\NPF_{2C2FC212-701D-42E6-9EAE-BEE969FEFB3F}
   ActiveClient = 10.10.6.45, 2003, ifname=\Device\NPF_{3C2FC212-701D-42E6-9EAE-BEE969FEFB3F}
   NullAuthPermit = YES

3. Save the configuration (.ini) file. Make sure to save the file in ASCII format to prevent errors.
4. Restart the software tap by running the command:

   restart-service rpcapd

   Note:

   To reinstall the software tap after changing the configuration file, run the installation command and replace -RpcapIp and -RpcapPort with the -KeepConfig flag to preserve the modified configuration file. For example: .\install-rpcapd.ps1 -MgmtIp <extrahop_ip> -KeepConfig or .\install-rpcapd.ps1 –InputDir . -KeepConfig

Network overlay encapsulation wraps standard network packets in outer protocol headers to perform specialized functions, such as smart routing and virtual machine networking management. Network overlay decapsulation enables the ExtraHop appliance to remove these outer encapsulating headers and then process the inner packets.

The offline capture mode in the Discover appliance enables an ExtraHop administrator to upload a capture file recorded by packet analyzer software, such as Wireshark or tcpdump, to the ExtraHop datastore for analysis.