Add device cloud instance properties through the REST API

1. In a browser, navigate to the ExtraHop API Explorer.
   The URL is the hostname or IP address of your sensor or console, followed by /api/v1/explore/. For example, if your hostname is seattle-eda, the URL is https://seattle-eda/api/v1/explore/.
2. Click Enter API Key and then paste or type your API key into the API Key field.
3. Click Authorize and then click Close.
4. Find the ID of the device by searching for the device MAC address.
   1. Click Device and then click POST /devices/search.
   2. Click Try it out.
   3. In the body field, specify the following JSON, replacing MACADDRESS with the MAC address of your cloud device:

      {
        "filter": {
          "field": "macaddr",
          "operand": "MACADDRESS",
          "operator": "="
        }
      }

      Copy
   4. Click Send Request.
   5. In the Response body section, view and record the value of the id field for each device that is returned.
5. Add the cloud device metadata.
   1. Click PATCH /devices/{id}.
   2. Click Try it out.
   3. In the id field, specify an ID.
   4. In the body field, specify the following JSON, replacing the string values with properties from your cloud environment:

      {
        "cloud_account": "string",
        "cloud_instance_id": "string",
        "cloud_instance_name": "string",
        "cloud_instance_type": "string",
        "vpc_id": "string"
      }

      Copy
   5. Click Send Request.

The ExtraHop GitHub repository contains an example Python script that imports AWS EC2 instance properties into the ExtraHop system. The script maps network interfaces of EC2 instances to devices discovered on the ExtraHop system by MAC address.

requests.get(url, headers=headers, verify=False)

1. Go to the ExtraHop code-examples GitHub repository and download the add_cloud_props_lambda/add_cloud_props_lambda.py file to your local machine.
2. In a text editor, open the add_cloud_props_lambda.py file and replace the following configuration variables with information from your environment:

   HOSTNAME: The private IP address or hostname of the sensor or console EC2 instance.

   APIKEY: The ExtraHop API key.

3. Add the add_cloud_props_lambda.py file to a zip file with the requests Python module.
   The script imports the requests Python module, which is not available to Lambda functions by default. For information about creating a zip file to import third-party libraries into Lambda, see the AWS documentation.
4. In AWS, create a Lambda function.
   For more information about creating Lambda functions, see the AWS documentation.
5. On the Lambda function page, click Actions and select Upload a .zip file.
6. Select the zip file you created.

The ExtraHop GitHub repository contains an example Python script that imports Azure device properties into the ExtraHop system. The script assigns cloud device properties to every device discovered by the ExtraHop system with a MAC address that belongs to an Azure VM network interface. The script is designed to be run on a set time interval. Each time the script is run, it scans each VM and updates the corresponding devices in ExtraHop.

1. Go to the ExtraHop code-examples GitHub repository and download the add_cloud_props_azure/add_cloud_props_azure.py file to your local machine.
2. In a text editor, open the add_cloud_props_azure.py file and replace the following configuration variables with information from your environment:

   HOSTNAME: The IP address or hostname of the sensor or console.

   APIKEY: The ExtraHop API key.

3. Run the following command:

   python3 add_cloud_props_azure.py

   Copy

   Note:

   If the script returns an error message that the SSL certificate verification failed, make sure that a trusted certificate has been added to your sensor or console. Alternatively, you can add the verify=False option to bypass certificate verification. However, this method is not secure and not recommended. The following code sends an HTTP GET request without certificate verification: requests.get(url, headers=headers, verify=False) Copy