Download PDF

Thank you! We will contact you soon to ask how we can improve our documentation. We appreciate your feedback.

Was this topic helpful?

Yes No

Thank you for your feedback. Can we contact you to ask follow up questions?

How can we improve?

Prioritize groups for Standard Analysis

The ExtraHop system classifies every device it discovers on your network. Your platform determines the total analysis capacity, which is the number of devices, or endpoints, that can receive Standard Analysis. On the Analysis Priorities page, you can target specific device groups or activity groups for Standard Analysis as needed, based on their importance to your network. Groups are ranked in an ordered list, so you can let the ExtraHop system know which devices are the most important to you.

Here are some important considerations about Standard Analysis:

If there is still room in Advanced Analysis, devices in the top-most groups in the Standard Analysis section will receive Advanced Analysis.
You must have full write privileges to edit analysis priorities.

The following steps show you how to prioritize devices, such as HTTP servers and DNS servers, for Standard Analysis:

Note:

You can manage these settings centrally from a Command appliance.

Log in to the ExtraHop system through https://<extrahop-hostname-or-IP-address>.
Click the System Settings icon and then click Analysis Priorities.
If you are managing analysis priorities from a Command appliance, find the Discover appliance with the devices you want to prioritize in the Manage Priorities from this Command Appliance section, and then click Edit Properties in the row that contains the Discover appliance.
Prioritize groups by completing the following steps:
1. In the For Standard Analysis section, click adding a group to add the initial group or Add Group to add additional groups.
2. In the Group drop-down list, type the name of a device group or activity group and then click the group name from the search results. For example, type HTTP servers and select the HTTP Servers activity group.
3. (Optional): In the Note field, type information about the group such as why this group is a priority for Standard Analysis.

In the Automatically Fill section, make sure On is selected.

Note:

If your system is having performance issues, then click Off. This selection will remove devices and make sure that only devices in prioritized groups receive Standard Analysis.

At the top of the page, click Save.

Next steps

Here are some additional ways to manage and refine groups receiving Standard Analysis:

If you add multiple groups, the groups are prioritized from top to bottom. Click the upper left icon next to Group, and then drag the group to another position in the ordered list.
Click the check icon to collapse the group. Click the pencil icon to expand the group again, as shown in the following figure.
Click the go to icon next to a group name to navigate to the device group page. The device group page displays which devices and how many devices are in the group. The icon is only available when the group is collapsed.
Click the x icon to remove a group from the list, as shown in the following figure.