After you receive your initial email from ExtraHop Networks, there are a few procedures you must complete before you can start analyzing your traffic. This guide provides procedures for basic setup and administration of the Reveal(x) 360 system.
The Okta administrator role is granted to the email address that you provided during sign up.
- Open your Welcome to ExtraHop Reveal(x) 360 email.
Click Activate Now.
The user setup page appears.
- Type your desired password in the password fields.
- Select a forgotten password question from the drop-down list and then type your answer.
- Select a security image.
Click Create My Account.
You are redirected to the Okta User Home page and can begin adding users.
|Note:||The ExtraHop Okta implementation includes a subset of Okta features. Some features, such as removing users, are not available.|
If your ExtraHop system is deployed in an environment with a firewall, you must open access to ExtraHop Cloud Services. For Reveal(x) 360 systems that are connected to self-managed sensors, you must also open access to the ExtraHop Cloud Recordstore.
For access to ExtraHop Cloud Services, your sensors must be able to resolve DNS queries for *.extrahop.com and access TCP 443 (HTTPS) from the IP address that corresponds to your sensor license:
- 184.108.40.206 (Portland, U.S.A.)
- 220.127.116.11 (Sydney, Australia)
- 18.104.22.168 (Frankfurt, Germany)
For access to the ExtraHop Cloud Recordstore, your sensors must be able to access outbound TCP 443 (HTTPS) to these fully-qualified domain names:
You can also review the public guidance from Google about computing possible IP address ranges for googleapis.com.
Before users can log in to Reveal(x) 360, the Okta administrator must create users and assign them to groups that determine their privileges.
Here are some important considerations about users and user groups:
- You cannot remove a user. Deactivate the user to remove their ability to access the Reveal(x) 360 system.
- You cannot create your own user groups. You must assign users to the built-in ExtraHop groups.
- You cannot modify the built-in groups.
|Note:||Optionally, you can configure Reveal(x) 360 to manage users through an existing supported SAML 2.0 identity provider.|
- Log in to Okta through https://extrahop-cloud.okta.com with the Okta administrator account credentials.
- At the top of the user home page, click Admin.
- From the Directory drop-down menu, select People.
- Click Add Person and complete all fields. The Secondary email field is optional.
In the Groups field, start by typing your
customer-specific domain name and select one of the following groups. A user can
only be a member of one group.
Note: Each group is preceded by your customer-specific domain name and customer ID, similar to the following example: example_company-a0O1E00001Lfn4LUAR-FullReadOnly-NoPackets. For more information about privileges, see User privileges. Privilege Description OktaAdmin Add, activate, deactivate, unlock users, and reset passwords in ExtraHop Okta. Create and modify all objects and settings, including Administration pages in Reveal(x) 360. ApplianceAdmin Create and modify all objects and settings, including Administration pages. FullWrite-NoPackets Create and modify all objects and settings, excluding Administration pages. FullWrite-FullPackets FullWrite privileges, plus view and download packets. Requires Ultra package. FullWrite-FullPacketsWithKeys FullWrite privileges, plus view and download packets and any associated stored SSL session keys. Requires Ultra package. LimitedWrite-NoPackets Create, modify, and share dashboards. LimitedWrite-FullPackets LimitedWrite privileges, plus view and download packets. Requires Ultra package. LimitedWrite-FullPacketsWithKeys LimitedWrite privileges, plus view and download packets and any associated stored SSL session keys. Requires Ultra package. PersonalWrite-FullPackets Create personal dashboards and modify dashboards shared with the logged-in user, view and download packets captured through triggers and the ExtraHop Trace Appliance. PersonalWrite-NoPackets Create personal dashboards and modify dashboards shared with the logged-in user. FullReadOnly-NoPackets View objects in the ExtraHop system. FullReadOnly-FullPackets FullReadOnly privileges, plus view and download packets. Requires Ultra package. RestrictedReadOnly-NoPackets View dashboards shared with the logged-in user.
- Select the Send user activation email now checkbox.
- Click Save. Alternatively, click Save and Add Another to add additional users. The user is sent an activation email with instructions about how to complete their account setup. After the account is set up, the user can log in to Reveal(x) 360 through https://extrahop-cloud.okta.com with their email address.
You cannot remove a user, but you can deactivate a user to remove their ability to access the Reveal(x) system.
- In the Okta Admin Console, from the Directory drop-down menu, select People.
- From the More Actions drop-down menu, click Deactivate.
- Select the checkbox next to the name of the user or users you want to deactivate.
- Click Deactivate Selected.
- In the Deactivate Person dialog box, click Deactivate.
After you have configured your users in Okta, click My Apps and then click your Reveal(x) 360 application icon under the Work tab. You are forwarded to your Reveal(x) 360 environment where you can add sensors to monitor your network traffic.
ExtraHop-managed Reveal(x) sensors for AWS can be selected and deployed from within the Reveal(x) 360 Console.
Self-managed sensors and Trace appliances can also be connected from within the Reveal(x) 360 Console. Note that if you have an existing Command appliance, you must disconnect the Command appliance before connecting your self-managed sensors to Reveal(x) 360.
Integrate Reveal(x) 360 with CrowdStrike by enabling device links. If CrowdStrike is installed on a device, links appear on the device overview page in Reveal(x) 360. Click the link to open the device entry in CrowdStrike Falcon.
CrowdStrike device links are disabled by default.
- Log in to the Reveal(x) 360 system with an account that has OktaAdmin or ApplianceAdmin (cloud setup) privileges.
- Click the System Settings icon and then click Administration.
- Click Integrations.
- On the CrowdStrike tile, click Configure.
- Select the checkbox to display links.
- Click Save.