ExtraHop Glossary

ActiveMQ is an open-source, message broker from Apache.

An activity map is a dynamic visual representation of the L4-L7 protocol activity between devices in your network. You can view real-time information about which devices and services are talking to each other across your network.

Records, packets, activity maps, detections, and charts with L2-L7 protocol metrics are available for devices receiving this analysis level. Prioritize a group or add a device to the watchlist to specify which devices should receive Advanced Analysis.

An alert is a custom configuration of settings, such as a time interval, metric value, and metric calculations that occur on assigned data sources. An alert is generated when configured conditions are met. Notifications can be sent through channels such as email or SNMP.

The AppFlow protocol was developed by Citrix. This protocol is an extension of the IPFIX standard for monitoring network traffic. You can collect AppFlow traffic with the ExtraHop NetFlow module.

In the ExtraHop system, applications are user-defined containers that you can associate with multiple devices and protocols for a unified view of built-in metrics. These containers can represent distributed applications on your network environment. You can create a basic application or an advanced application through the Trigger API. The default All Activity application is available to all ExtraHop users.

This ExtraHop chart type displays metric values as a line that connects data points over time, with the area between the line and axis filled in with color.

Assets are devices and device groups in your environment, as well as related networks, applications, and users.

Through this service, ExtraHop analysts can perform an unbiased analysis of your network data and report on areas in your IT infrastructure where improvements can be made.

(ExtraHop Reveal(x) only) Most network attacks tend to follow familiar patterns or phases. These phases can be assembled into an attack chain to characterize the progression of an attack. ExtraHop Reveal(x) detects unusual network behavior associated with different attack chain phases, including command and control (C&C), reconnaissance, exploit, lateral movement, and actions on objective.

The audit log on the ExtraHop system provides data about the operations of the system, broken down by component. For example, when you log in to the ExtraHop system, the successful or failed event is logged as an entry to the audit log.

This ExtraHop chart type displays the total value of metric data as horizontal bars.

The box plot chart displays variability for a distribution of metric data. Each box plot includes three or five data points. With five data points, the box plot contains a box, upper and lower whisker lines, and a tick mark. With three data points, the line contains upper and lower whisker lines, and a tick mark.

Berkeley Packet Filter (BPF) is a program for filtering network packets. The BPF syntax enables users to write filters that quickly drill down on specific packets to see the essential information.

Built-in groups contain devices that are automatically grouped together based on their network protocol traffic, such as CIFS clients, or by the role assigned to the device, such as Domain Controllers. A device with multiple types of traffic might appear in more than one built-in group. You can select built-in groups as a metric source for charts, alerts, triggers, and activity maps.

This ExtraHop chart type displays data calculations for a distribution of metric values over time. A line at each time interval displays three or five data points. If the line has five data points, it contains a body, middle tick mark, an upper shadow line, and a lower shadow line. If the line has three data points, it contains a middle tick mark.

A client is an application or system that accesses a service made available by a server.

A group of the same type of ExtraHop appliances that are joined together, such as the Explore appliance.

This ExtraHop chart type displays metric values as vertical bars over a specified time period.

The ExtraHop Command appliance provides a unified view of data collected from sensors (Discover appliances), recordstores, and packetstores that are distributed across data centers, branch offices, and the public cloud.

Cross-origin resource sharing (CORS) allows you to access the ExtraHop REST API across domain-boundaries and from specified web pages without requiring the request to travel through a proxy server. You can configure one or more allowed origins or you can allow access to the ExtraHop REST API from any origin. Only administrative users can view and edit CORS settings.

In the ExtraHop system, this top-level metric type represents the number of events that occurred over a specific time period. You can view count metrics as a rate or a total count.

A dashboard is a customizable HTML page that displays different views of your network through widgets such as charts. In addition to custom dashboards, the ExtraHop system provides the following built-in dashboards: Activity dashboard, Network dashboard, and Security dashboard (Reveal(x) only).

In the ExtraHop system, this top-level metric type represents a distribution of data that can be calculated into percentiles values.

The ExtraHop system removes duplicate L2 and L3 frames and packets when metrics are collected and aggregated from your network activity by default. L2 deduplication removes identical Ethernet frames (where the Ethernet header and the entire IP packet must match); L3 deduplication removes TCP or UDP packets with identical IP ID fields on the same flow (where only the IP packet must match).

Detail metrics provide you with a metric value for a specific key, such as a client IP address, server IP address, URI, hostname, referrer, certificate, or method. When you drill down from a top-level metric in the ExtraHop system to a detail metric, you can gain insight into how a specific device, method, or resource is affecting the network.

Detections are unexpected deviations from normal patterns in device or application behavior. The ExtraHop Machine Learning service identifies detections from stored ExtraHop system data with a proprietary algorithm that combines time series decomposition, unsupervised learning, heuristics, and ExtraHop unique domain expertise.

Devices are endpoints in your environment that have been automatically discovered and classified by the ExtraHop system.

Device discovery is the process by which ExtraHop builds and maintains a list of active devices associated with monitored network traffic. The ExtraHop system can discover and track devices by their MAC address (L2 Discovery) or by their IP addresses (L3 Discovery). When L2 Discovery is enabled, the ExtraHop system creates a device entry for every local MAC address discovered over the wire. IP addresses are mapped to the MAC address, but metrics are stored with the device MAC address even if the IP address changes. When L3 Discovery is enabled, the ExtraHop system creates and links two entries for each local discovered device: an L2 parent entry with a MAC address and an L3 child entry with IP addresses and the MAC address.

Device groups, also known as custom groups, can be either static or dynamic. You must manually identify and assign individual devices to a static group. Alternatively, you can configure rules to automatically assign devices to a dynamic group.

The ExtraHop Discover appliance (EDA) is a sensor that provides the ability to analyze and visualize all of your network, application, client, infrastructure, and business data. Sensors passively collect a copy of unstructured wire data—all of the transactions on your network—and transforms this data into structured wire data. Sensors can be connected to recordstores and packetstores and to an ExtraHop Command appliance or ExtraHop Reveal(x) 360 for centralized management and a unified view of collected and stored data.

Records, packets, detections, and information about protocol activity are available for devices in Discovery Mode. Adjust analysis priorities to elevate a device or endpoint from Discovery Mode to Standard or Advanced Analysis.

In the ExtraHop system, this top-level metric type represents the number of unique events that occurred during a selected time interval. The distinct count metric provides an estimate of the number of unique items placed into a set during the selected time interval. Estimates are calculated with the HyperLogLog algorithm.

DNS (Domain Name System) is the naming system for network hosts and resources that are connected to the Internet. DNS servers map IP addresses to hostnames.

Dynamic baselines are trend lines on dashboards that help you distinguish between normal and abnormal activity. The ExtraHop system calculates dynamic baselines based on historical data. To generate data points on a dynamic baseline, the ExtraHop system calculates the median value for a specified period of time.

Endpoints are internal or external hostnames and IP addresses observed by the ExtraHop system. Internal endpoints are located on your local or remote network, and external endpoints are located outside of your local or remote network.

Encapsulated Remote SPAN (ERSPAN) enables you to send source traffic on one switch to a destination on another switch, while traversing a Layer 3 boundary.

An event represents activity detected from your network or from your ExtraHop system. Triggers can be written to collect the data associated with an event to create custom metrics.

The ExtraHop Explore appliance (EXA) stores transaction and flow records sent from a connected sensor (Discover appliance). You can view, save, and search the structured flow and transaction information about events on your network with a simple, unified UI, with no modifications to your existing applications or infrastructure.

A fingerprint is a unique, alphanumeric identifier assigned to all Discover, Explore, and Trace appliances.

A flow is a set of packets that are part of a single transaction between two endpoints. Similar to how the ExtraHop system can identify flows from wire data, flows from machine data on remote networks can be sent to the ExtraHop system for analysis. Flows are identified through their unique combination of IP protocol (TCP/UDP), source and destination IP addresses, and source and destination ports. This combination is called a 5-tuple.

A flow network device can have multiple interfaces. Instead of looking at flow information for the entire device, you can look at flow information for a specific interface on the device.

A flow network is a network device that sends information about flows seen across the device. Similar to how the ExtraHop system can identify flows from wire data, the ExtraHop system can receive flow information from remote network devices, also called flow exporters.

(ExtraHop Reveal(x) 360 only) A flow sensor collects data from flow logs, instead of from packets.

A Flow Stall is a TCP metric in the ExtraHop system that measures network congestion. A Flow Stall is counted when there are three consecutive retransmission timeouts (RTOs) observed on a single flow of data between devices. An RTO represents a 1-5 second delay as a device waits to resend data that might have been lost over a congested connection.

Goodput refers to the amount of useful data that is transferred over the L4 application layer per unit time. In this context, useful means that retransmissions are discarded as duplicate packets along with any protocol overhead or other non-application data found on the wire. Goodput is always lower than the throughput, and roughly corresponds to the size of the payload bytes for any protocol running on TCP (such as a CIFS file or HTTP request) over the transfer time.

This ExtraHop chart type displays a distribution of metric data over time, where color represents a concentration of data.

High value is a designation for devices on your network that you or the ExtraHop system might consider significant to your business applications, workflows, or infrastructure. A device is considered high value if the ExtraHop system observes the device providing authentication or essential services, or if a user manually specifies a device as high value.

This ExtraHop chart type displays a distribution of metric data as vertical bars, or bins.

ICMP (Internet Control Message Protocol) is a protocol that network devices send error and query messages through.

An investigation is a user-managed grouping of detections that enable users to view multiple detections in a single timeline and map. Investigations can help determine whether suspicious behavior is a valid threat and if a threat is part of a larger attack campaign.

The Integrated Dell Remote Access Controller (iDRAC) provides remote access to ExtraHop appliances. After you enable and configure iDRAC, you can power cycle the system, view console messages, and review hardware monitoring and boot logs.

The network layer in the OSI model. In the ExtraHop system, L3 metrics provide IP address information for nodes that communicate over the monitored network.

A level-triggered alert is generated at specified intervals for as long as the metric value remains above the configured threshold.

This ExtraHop chart type displays metric values as a line, which connects a series of data points over time.

This ExtraHop chart type displays metric values as a line, which connects data points over time, with the option to display another metric as a column chart underneath.

This ExtraHop chart displays metric values in a list across multiple columns with optional sparklines.

The Link Layer Discovery Protocol (LLDP) is a protocol that network devices communicate their identity and capabilities through.

In the ExtraHop system, this top-level metric type is a single data point that represents the maximum value from a specified time period.

In the ExtraHop system, a metric is a measurement of observed network behavior. Metrics are generated from network traffic, and then each metric is associated with a source. The ExtraHop system provides built-in, or default, metrics based on observed network traffic from wire data. You can also create custom metrics in the ExtraHop system by writing a trigger to collect metrics based on a specific event.

The Metric Catalog is a tool for viewing information about built-in and custom metrics in the ExtraHop system. You also can delete and edit custom metrics through the Metric Catalog.

The Metric Explorer is a tool for configuring dashboard charts. In the Metric Explorer, you can add multiple sources and metrics to a chart and immediately preview how metric data will appear.

Acronym for not a number. In the Trigger API, a property with a numeric data type displays NaN if the property value is undefined or cannot be represented as a number.

In the ExtraHop system, a network is the entry point into the network capture, and metrics are collected for network capture attributes, network alerts, and network traffic details. These metrics provide a summary of all network activity retrieved in the capture.

A network byte is a metric that displays the throughput rate of the ExtraHop capture process.

(ExtraHop Reveal(x) only) Network health indicators are a set of metrics that show you general trends related to network and security health. Network health indicators might signal weaknesses or issues in network performance or potentially suspicious activity. These metrics can be found at the bottom of the Network Overview page.

An individual ExtraHop appliance within a cluster.

The open data stream (ODS) service enables you to send wire data to a remote third-party system, such as MongoDB or Kafka. You must write a trigger to identify and collect the data you want to export and configure settings through the ExtraHop Administration settings.

The Packets feature enables you to search for and download packets for selected transactions through a sensor (Discover appliance), Command appliance or Reveal(x) 360. This feature requires an ExtraHop Trace appliance or other supported packetstore.

You can configure a sensor (Discover appliance) to send raw packets to an ExtraHop Trace appliance or to a configured packet capture disk for long-term storage and retrieval.

Participants are endpoints that are participating as an offender or victim in a detection.

Perfect Forward Secrecy (PFS) is an encryption method that enables short-term, completely private key exchanges between clients and servers. You can license the ExtraHop system to decrypt PFS SSL/TLS sessions from Windows servers where the ExtraHop PFS agent software is installed. Without PFS, those sessions could not be decrypted, and the data from those exchanges would be obscured.

PCAP (packet capture) consists of an application programming interface (API) for capturing network traffic and storing it to a database.

This ExtraHop chart displays metric data as a portion or percentage of a whole.

Port mirroring occurs when a network switch sends a copy of network packets from one switch port (or an entire VLAN) to a network monitoring connection on another switch port.

A protocol defines the format and the order of messages exchanged between two or more devices, as well as the actions taken on the transmission and receipt of a message or other event.

A protocol page is a built-in page that includes built-in charts with top-level metrics about your assets. These metric charts can be copied to your dashboards.

Records are structured flow and transaction information about events on your network that can be sent to an Explore appliance or other supported recordstore for storage. Then, you can query for records from a sensor (Discover appliance), Command appliance, or Reveal(x) 360.

A record format is a schema on read that determines how each record is displayed in the ExtraHop system. The ExtraHop system has built-in record formats for all built-in record types, and although you cannot modify a built-in record format, you can create a custom record format.

Record types link stored records with the record format in the ExtraHop system. Requires an Explore appliance or other supported recordstore.

You can configure a sensor (Discover appliance) to send transaction-level data to an Explore appliance or to a data warehouse for long-term storage and retrieval. ExtraHop Cloud Recordstore is provided for Reveal(x) 360. Supported third-party data warehouses include Google BigQuery and Splunk.

A region is a dashboard component that contains widgets.

Reveal(x) 360 provides SaaS-based visibility and management across on-premises and cloud-based connected environments. The Reveal(x) 360 console provides a single view of data collected from multiple sensors (ExtraHop Discover appliances), packetstores, and recordstores, which can be distributed across data centers, branch offices, and the public cloud.

Reveal(x) Enterprise is a subscription-based offering of ExtraHop products that include a sensor (ExtraHop Discover appliance) to collect wire data and additional components based on the plan type.

(ExtraHop Reveal(x) only) A risk score is a numeric indicator of the severity of a detection. Risk scores are based on several factors, such as where the detection falls in the attack chain, the vulnerability of the detection protocol, and the level of impact the detection could have on the network. Scoring is on a scale from 1-99, with 99 being the most severe.

Remote packet capture (RPCAP) is a software implementation for packet forwarding that is similar to a physical tap. If you want to monitor network traffic for devices that are not directly connected to your wire data feed, you can forward packets through the cloud and analyze that data through the ExtraHop system.

Remote Switched Port Analyzer (RSPAN) provides remote monitoring of multiple switches across a switched network. RSPAN is a way to get traffic from a SPAN source on one switch to a SPAN destination on another switch that is connected via a trunk.

Note:

RSPAN requires that the source and destination chassis are in the same Layer 2 domain.

The debug log is a component of the Trigger Editor in the ExtraHop system. The debug log displays exceptions and output from debug statements in trigger scripts.

In the ExtraHop system, this top-level metric type represents a summary of data that provides a mean (average) and standard deviation over a specified time period. Sampleset metrics typically summarize data about a detail metric.

The Session Description Protocol (SDP) is a protocol that defines multimedia streaming sessions.

A server is a hardware system dedicated to hosting one or more services for users or clients on the network. In the context of Internet Protocol (IP) networking, a server is a program that operates as a socket listener.

A site is a wire data feed analyzed by the ExtraHop system that represents a physical or logical area of your network, such as a data center, branch office, or cloud workload. You can view assets, detections, and other data from a specific site or across multiple sites.

In the ExtraHop system, this top-level metric type represents a data point that represents a single point in time. Snapshot metrics include ratios, current connections, and established TCP connections.

The Simple Network Management Protocol (SNMP) is a layer-7 protocol for collecting, organizing, exchanging, and modifying information about managed devices on IP networks.

Sources are assets that can be assigned to charts, triggers, and alerts to provide access to metric collections.

Port mirroring on a Cisco Systems switch is generally referred to as Switched Port Analyzer (SPAN). SPAN copies traffic and sends it to a destination for network analysis.

Records, packets, detections, activity maps, protocol activity, and charts with throughput and packet metrics are available for devices receiving Standard Analysis. Adjust analysis priorities to elevate a device or endpoint from Standard Analysis to Advanced Analysis.

This ExtraHop chart type displays metric values in a column chart, where the color of the columns represents the status and severity of an alert assigned to the source and metric selected in the chart.

(ExtraHop Reveal(x) only) Structured Threat Information eXpression (STIX) is the language and serialization format for standardizing, conveying, and sharing data about cyber threat intelligence data. The STIX format is commonly supported by the threat intelligence community and platforms. You can upload STIX files through the ExtraHop system or the REST API as a custom threat collection. Custom threat collections must be formatted in STIX as TAR or TAR.GZ files.

This ExtraHop chart type displays metric values across rows and columns in a table.

In the ExtraHop system, TCP (Transmission Control Protocol) metrics provide information about the reliable transfer of packets between a source and destination. Through TCP metrics, ExtraHop provides visibility into which devices are connected to each other, when devices send data, if there are errors in the data, what protocols are communicated through, and so on.

A TCP RST packet is sent to prevent a TCP connection from being established or to forcibly terminate an existing connection. Sometimes resets are sent when the receiving device failed to ACK the SYN packet, or it failed to acknowledge another packet sent and retransmitted later in the transaction. In some cases, TRCP RSTs indicates that an error occurred. High volumes of outbound resets should be investigated to determine if they are expected behavior or indicative of a larger issue.

(ExtraHop Reveal(x) only) Threat briefings provide guidance about potential threats to your network from both industry-wide security events and machine-learning analysis of your network. Threat briefings might include detections of scans, exploits, and indicators of compromise (IOC) that are related to the threat.

(ExtraHop Reveal(x) only) A threat collection is a data set of suspicious IP addresses, hostnames, and URIs that enables your Reveal(x) system to identify indicators of compromise and display threat intelligence in system charts and records.

Threat intelligence is known data about suspicious IP addresses, hostnames, and URIs that can help identify risks to your organization. These data sets, called threat collections, are available by default in your Reveal(x) system and from free and commercial sources in the security community.

The Time Selector is a tool that enables you to specify a time interval for the collection and presentation of network data in the ExtraHop system. There are two types of Time Selectors: a Global Time Selector for specifying global time intervals and a Region Time Selector for specifying region time intervals in a dashboard.

A timestamp is a digital record of the time a particular event occurred. In the ExtraHop system, you can select the default timestamp, or configure external timestamps such as Gigamon or Anue through the Running Configuration file.

A top-level, or base, metric gives you a sum of data for a specified time period. Top-level metrics provide you with a big-picture value to help identify what is happening on your network. You can then drill down on a top-level metric to view detail metrics. There are different types of top-level metrics that provide different information, which include count, dataset, maximum, sampleset, and snapshot metric types. Understanding metrics types is essential to writing triggers and configuring charts.

A topnset is the top 1,000 key-value pairs calculated for the time interval you specify in the Time Selector. A topnset is not a complete data set because a topnset only represents the key-values that are recorded for a specific aggregation roll up (based on a specified time interval), and is limited to up to 1,000 keys per topnset.

The ExtraHop Trace appliance (ETA) continuously collects network packets and connects to a sensor (ExtraHop Discover appliance) to enable you to quickly retrieve all packets that match a set of search criteria within a given time interval.

The ExtraHop Reveal(x) Ultra appliance combines the functions of a sensor (Discover appliance) and a Trace appliance to both analyze and collect your network data and to store network packets.

This ExtraHop chart displays the total value for one or more metrics. Selecting more than one metric will display the metric values side-by-side.

Virtual packet loss (VPL) refers to a phenomenon that affects fully or partially virtualized applications. VPL creates symptoms that suggests network congestion and is often undetected by traditional network monitoring and application performance management (APM) tools. VPL occurs when a hypervisor schedules CPU time for an excessive number of virtual machines (VMs) and prevents those VMs from responding fast enough to TCP acknowledgments. VPL can be detected by a combination of application awareness and advanced TCP analysis.

A Virtual Local Area Network (VLAN) is a logical grouping of traffic or devices on a network. VLAN information is extracted from VLAN tags, if the traffic mirroring process preserves the tags on the mirror port.

Individual devices on the watchlist are guaranteed Advanced Analysis. Typically, high-value endpoints are added to the watchlist. Advanced Analysis is an analysis level where records, packets, activity maps, and charts with L2-L7 protocol metrics are available for devices. You can remove devices from the watchlist at any time.

Widgets are configurable dashboard components that can be added to a region for different functions. Widget types are chart, text box, alert, activity groups, and networks (Command appliance and Reveal(x) 360 only).

Wire data is created when data in flight is analyzed as traffic is sent over the network. Through real-time full-stream processing, unstructured data is reassembled into structured wire data that can be analyzed in real time. Wire data encompasses L2-L7 data that spans the entire application delivery chain and provides the most comprehensive, wide-reaching visibility.

A Zero Window is a TCP metric in the ExtraHop system that measures application congestion. When a device advertises a Zero Window message to the sender device during data transfer, this means that the device can no longer accept data because the device's receive window (a buffer for incoming data) is full. The Zero Window message tells the sender to pause data transfer until further notice.