Change a device role

The ExtraHop system automatically discovers and classifies devices on your network. Based on the type of traffic and protocol activity associated with a device, the ExtraHop system can automatically assign a role to a device, such as database or file server, to classify device behavior. You can change a device role at anytime.

Note:After you change the role of a device, the device might be removed from or added to dynamic device groups that include a device role as criteria.
  1. Log into the Web UI on the Discover or Command appliance.
  2. Find a device and then click the device name.
    An overview page appears, which displays properties, traffic, and protocol activity for the selected device.
  3. Click Edit Properties .
  4. In the Device Role section, click the drop-down list, and then click one of the following roles:
    Role Description
    Auto Assign the role that the ExtraHop system identified for the device, which appears in parentheses.
    Database Assign to a device that hosts a database instance.
    DHCP Server Assign to a device whose main function is processing DHCP server activity.
    DNS Server Assign to a device whose main function is processing DNS server activity.
    Domain Controller Assign to a device that acts as a domain controller for Kerberos, CIFS, and MSRPC server activity.
    File Server Assign to a device that responds to read and write requests for files over NFS and CIFS/SMB protocols.
    Firewall Assign to a device that monitors incoming and outgoing network traffic and blocks traffic according to security rules. The ExtraHop system does not automatically assign the Firewall role to devices.
    Gateway Assign to a device that acts as a router or gateway. The ExtraHop system might automatically assign the gateway role to any L2 device associated with a large amount of unique IP addresses (past a certain threshold). Gateway device names include the router name such as Cisco B1B500. Unlike other L2 parent devices, you can add a gateway device to the watchlist for Advanced Analysis.
    Load Balancer Assign to a device that acts as a reverse proxy for distributing traffic across multiple servers.
    Medical Device Assign to a device that is specifically designed for healthcare needs and medical environments. The ExtraHop system looks for DICOM traffic to identify devices for the Medical Device role.
    Mobile Device Assign to a device that has a mobile operating system installed, such as iOS or Android.
    PC Assign to a device such as a laptop, desktop, Windows VM, or macOS device. The ExtraHop system looks for recent DNS, HTTP, and SSL client traffic to identify end user devices for the PC role.
    Printer Assign to a device that enables users to print text and graphics from other connected devices. The ExtraHop system does not automatically assign the Printer role to devices.
    VoIP Phone Assign to a device that manages voice over IP (VoIP) phone calls.
    Vulnerability Scanner Assign to a device that runs vulnerability scanner programs.
    Web Proxy Server Assign to a device that processes HTTP requests between a device and another server.
    Web Server Assign to a device that hosts web resources and responds to HTTP requests.
    Other Assign to a device when the device activity does not clearly identify a single role.
  5. Click Save.
Published 2020-10-14 20:01