The ExtraHop system automatically discovers and classifies devices on your network. Based on the type of traffic and protocol activity associated with a device, the ExtraHop system can automatically assign a role to a device, such as database or file server, to classify device behavior. You can change a device role at anytime.
|Note:||After you change the role of a device, the device might be removed from or added to dynamic device groups that include a device role as criteria.|
- Log into the Web UI on the Discover or Command appliance.
Find a device and
then click the device name.
An overview page appears, which displays properties, traffic, and protocol activity for the selected device.
- Click Edit Properties .
In the Device Role section, click the drop-down list, and
then click one of the following roles:
Role Description Auto Assign the role that the ExtraHop system identified for the device, which appears in parentheses. Database Assign to a device that hosts a database instance. DHCP Server Assign to a device whose main function is processing DHCP server activity. DNS Server Assign to a device whose main function is processing DNS server activity. Domain Controller Assign to a device that acts as a domain controller for Kerberos, CIFS, and MSRPC server activity. File Server Assign to a device that responds to read and write requests for files over NFS and CIFS/SMB protocols. Firewall Assign to a device that monitors incoming and outgoing network traffic and blocks traffic according to security rules. The ExtraHop system does not automatically assign the Firewall role to devices. Gateway Assign to a device that acts as a router or gateway. The ExtraHop system might automatically assign the gateway role to any L2 device associated with a large amount of unique IP addresses (past a certain threshold). Gateway device names include the router name such as Cisco B1B500. Unlike other L2 parent devices, you can add a gateway device to the watchlist for Advanced Analysis. Load Balancer Assign to a device that acts as a reverse proxy for distributing traffic across multiple servers. Medical Device Assign to a device that is specifically designed for healthcare needs and medical environments. The ExtraHop system looks for DICOM traffic to identify devices for the Medical Device role. Mobile Device Assign to a device that has a mobile operating system installed, such as iOS or Android. PC Assign to a device such as a laptop, desktop, Windows VM, or macOS device. The ExtraHop system looks for recent DNS, HTTP, and SSL client traffic to identify end user devices for the PC role. Printer Assign to a device that enables users to print text and graphics from other connected devices. The ExtraHop system does not automatically assign the Printer role to devices. VoIP Phone Assign to a device that manages voice over IP (VoIP) phone calls. Vulnerability Scanner Assign to a device that runs vulnerability scanner programs. Web Proxy Server Assign to a device that processes HTTP requests between a device and another server. Web Server Assign to a device that hosts web resources and responds to HTTP requests. Other Assign to a device when the device activity does not clearly identify a single role.
- Click Save.