Search for a device through the REST API

1. In a browser, navigate to the REST API Explorer.
   The URL is the hostname or IP address of your ExtraHop system, followed by /api/v1/explore/. For example, if your hostname is seattle-eda, the URL is https://seattle-eda/api/v1/explore/.
2. Click Enter API Key and then paste or type your API key into the API Key field.
3. Click Authorize and then click Close.
4. Click Device to display device operations.
5. Click POST /devices/search.
6. Click Try it out.
   The JSON schema is automatically added to the body parameter text box.
7. In the body text box, type your search criteria.
   The following search criteria returns a device with an IP address of 10.10.10.200:

   {
     "filter": {
       "field": "ipaddr",
       "operand": "10.10.10.200",
       "operator": "="
     }
   }
   

   Copy

The ExtraHop GitHub repository contains an example Python script that searches for a list of devices by IP address. The script then outputs the ExtraHop discovery ID for each IP address.

1. Go to the ExtraHop code-examples GitHub repository and download the search_device/search_device.py file to your local machine.
2. In a text editor, open the search_device.py file and replace the following configuration variables with information from your environment:

   HOST: The IP address or hostname of the ExtraHop system.

   APIKEY: The API key generated from the ExtraHop system.

   IP_ADDR_LIST: An array of IP addresses.

3. Run the following command:

   python3 search_device.py

   Copy

   Note:

   If the script returns an error message that the SSL certificate verification failed, make sure that a trusted certificate has been added to your ExtraHop system. Alternatively, you can add the verify=False option to bypass certificate verification. However, this method is not secure and not recommended. The following code sends an HTTP GET request without certificate verification: requests.get(url, headers=headers, verify=False) Copy