RevealX 360 Setup and Administration Guide

The System and Access Administration privilege is granted to the email address that you provided during sign up.

1. Open your Welcome to ExtraHop RevealX 360 email.
2. Click the URL link to your RevealX 360 environment.
3. At the login page, enter your email address and temporary password included in the email.
4. Click Sign In.
5. On the Change Password screen, enter a new password in both password fields and then click Send.
6. From the Multi-Factor Authentication Setup page, scan the QR code or manually enter the code that appears into your authenticator app.
7. Enter the code provided by your authentication app into the Code field and then click Complete Setup.
8. On the Success page, click Continue.

1. From the Overview page, click System Settings and then click User Access.
2. In the Users section, click View Users.
3. Click Create.
4. Enter the email address, first name, and last name of the new user.
5. In the Sensor Access section, select sensor tags to grant packet access to sensors.
   Click Manage Sensor Tags to create, edit, or delete tags. Learn more about Sensor Access Control.
6. In the System Access section, select one of the following privileges.

   Privilege	Description
   System and access administration	Create and modify all objects and settings, including Administration pages, in RevealX 360.
   System administration	Create and modify objects and settings, excluding User Access and API Access on the Administration page.
   Full write	Create and modify all objects and settings, excluding Administration pages.
   Limited write	Create, modify, and share dashboards. Create and modify tuning rules. Create and modify detection and threat briefing notification rules.
   Personal write	Create personal dashboards and modify dashboards shared with the logged-in user.
   Full read-only	View objects in the ExtraHop system.
   Restricted read-only	View dashboards shared with this user.

7. In the NDR Module Access section, select one of the following privileges.

   Privilege	Description
   Full access	Access to network detections.
   No access	No access to network detections.

8. In the NPM Module Access section, select one of the following privileges.

   Privilege	Description
   Full access	Access to performance detections.
   No access	No access to performance detections.

9. In the Packet and Session Key Access section, select one of the following privileges:

   Privilege	Description
   Packets and session keys	Search and download packets and associated session keys.
   Packets only	Search and download packets.
   Packet headers only	Search and download packet headers.
   Packet slices only	Search and download a set number of bytes at the beginning of a packet. By default, the number of downloadable bytes is 64. Adjust the number of downloadable bytes with the Packet Slice Download Control setting under Global Policies.
   No access	No access to packets.

10. Click Save.
    The user is sent an email that includes the URL of the RevealX 360 environment and their temporary password. The temporary password expires in 7 days.
11. Click Done.

Administrators can configure global policies that apply to all users who access the system.

1. From the Overview page, click System Settings and then click User Access.
2. From the Global Policies section, specify one or more of the following options.

   Option	Description
   Device Group Edit Control	Select to control whether all users with limited write privileges can create and edit device groups. When this policy is selected, all limited write users can create device groups and add other limited write users as editors to their device groups.
   Packet Slice Download Control	Specify the number of bytes that users with the packet slices only privileges can download. Bytes are counted from the beginning of the packet. The default value of this setting is 64 bytes, which will typically include the packet header in downloads.
   Default Dashboard	Specify the dashboard that users see when they log in to the system. Only dashboards shared with all users can be set as a global default. Users can override this default setting from the command menu of any dashboard.
   File Extraction Password	(NDR module only) Specify a required password that you can share with approved users to unzip files extracted and downloaded from a packet query.

3. Click Save Changes.

Configure a list of IPv4 addresses and CIDR blocks that are allowed to access the RevealX 360 system and the RevealX 360 REST API.

1. From the Overview page, click System Settings and then click User Access.
2. In the Allow List section click, Enable Allow List.
3. Type a comma-separated list of the IPv4 addresses or CIDR blocks that are allowed to access the system. IPv6 addresses are not supported.
4. Click Save. It can take several minutes for the allow list to become active.

The System Time page displays the default system time settings and the default display time configured for your ExtraHop system.

1. From the Overview page, click System Settings and then click All Administration.
2. From the Console Settings section, click System Time.
3. From the Default System Time drop-down list, select the time zone you want.
4. From the Default Display Time for Users section, select one of the following options:
   • Browser time
   • System time
   • UTC
5. Click Save Changes.

The AI Search Assistant enables you to search for devices with questions, or prompts, written in natural, everyday language to quickly build complex queries.

1. From the Overview page, click the System Settings icon and then click All Administration.
2. From the Console Settings section, click AI Search Assistant.
3. Enable the AI Search Assistant by selecting I agree to enable AI search assistant and send natural language searches to ExtraHop Cloud Services.
4. Click Save Changes.

Discovered devices are automatically named based on multiple sources of network data. When multiple names are found for a device, a default order of precedence is applied. You can change the order of precedence.

1. From the Overview page, click System Settings and then click All Administration.
2. From the Console Settings section, click Device Name Precedence.
3. Click and drag device names to create a new order of precedence.
4. Click Save.
   Click Revert to Default to undo your changes.

Detection tracking enables you to assign a detection to a user, set the status, and add notes. You can track detections directly in the ExtraHop system, with a third-party external ticketing system, or with both methods.

1. From the Overview page, click System Settings and then click All Administration.
2. From the Console Settings section, click Detection Tracking.
3. Select one or both of the following methods for tracking detections:
   • Select Enable ExtraHop users to track detections from within the ExtraHop system.
   • Select Enable external integrations, such as SOAR or ticket tracking systems, to track detections through the ExtraHop Rest API.
4. (Optional): After you select the option to enable external integrations, specify the URL template for your ticketing system and add the $ticket_id variable at the appropriate location. For example, type a complete URL such as https://jira.example.com/browse/$ticket_id. The $ticket_id variable is replaced with the ticket ID associated with the detection.
   After the URL template is configured, you can click the ticket ID in a detection to open the ticket in a new browser tab.
   

Endpoint lookup enables you to specify external IP address tools that are available for retrieving up information about endpoints within the ExtraHop system. For example, when you click or hover over an IP address, lookup tool links are displayed so that you can easily find information about that endpoint.

The following lookup links are configured by default and can be modified or deleted:

• ARIN Whois Lookup
• VirusTotal Lookup

1. From the Overview page, click System Settings and then click All Administration.
2. From the Console Settings section, click Endpoint Lookup.
3. In the URL Template field, type the URL of the lookup tool.

   The URL must include the $ip variable, which is replaced with the IP address of the endpoint upon lookup. For example, https://search.arin.net/rdap/?query=$ip

4. In the Display Name field, type the name link as you want it to appear.
5. Select one of the following Display Options:
   • Show this link on all endpoints
   • Show this link on external endpoints
   • Show this link on internal endpoints
   • Do not show this link
6. Click Save.

The Integrations page displays a catalog of products and solutions from third-party vendors that work with the ExtraHop system. Integrations can provide insight into how your devices are communicating in your environment or improve your ability to investigate threats and issues. Click a tile to view more information about the integration.

Multi-factor Authentication (MFA) is a security enhancement that requires you to provide two forms of credentials when you log in to your account. In addition to your ExtraHop credentials, you must supply credentials from a 3rd-party authenticator app.

1. Choose a device, such as a computer or mobile device (phone or tablet), on which you can install apps.
2. Download and install an authentication app on the device. Here are some popular options:
   • Android and iOS: Google Authenticator, Authy
   • Windows and macOS: 1Password, OTP Manager
   • Chrome extensions: Authenticator
3. Open a new browser and sign in to your ExtraHop RevealX 360 system.
4. Follow the instructions to scan or enter the code that appears on the ExtraHop Multi-Factor Authentication setup screen, and then enter the credentials provided by your authenticator app.