Start Demo

Specify a network locality

Network localities enable you to classify traffic from IP addresses and CIDR blocks as internal or external to your network. You can also specify a name for each locality such as "DMZ" or "guest network" and filter by that name in devices and records.

Here are some important considerations about these settings:

  • Designating network localities affects detections and triggers as well as related features such as notifications, overview pages, and the Security Operations report.
  • If your ExtraHop deployment includes a console, we recommend that you transfer management of all connected sensors to the console.
  • For ExtraHop RevealX 360, these settings are synchronized across all connected sensors. You should not configure these settings on individual sensors.
  • For ExtraHop RevealX Enterprise, when you transfer management to a connected console, these settings are synchronized across all sensors. Otherwise, network locality settings must be configured on all sensors and consoles.
  • You must have full write privileges to change these settings.
Video:See the related training: Configure Network Localities
  1. Log in to the ExtraHop system through https://<extrahop-hostname-or-IP-address>.
  2. Click the System Settings icon and then click Network Localities.
  3. Click Create.
  4. In the Network Locality Name field, type a unique name.
  5. (Optional): In the Description field, type information about the network locality.
  6. In the Network Locality Type section, select Internal or External, based on the classification you want to apply to the IP addresses and CIDR blocks.
  7. In the IP Addresses and CIDR Blocks field, type the IP addresses and CIDR blocks you want to add to the locality. You must enter a unique range of addresses or blocks.
  8. Click Save.

Next steps

  • From the Assets page, find devices by network locality.
  • Drill down on a metric by client, server, or IP address and select Internal or External as the Network Locality in the trifield filter.
  • Filter records by specifying one of the following filters:
    • Network Locality Name
    • Client Network Locality Name
    • Server Network Locality Name
    • Sender Network Locality Name
    • Receiver Network Locality Name
Last modified 2024-08-07