Specify custom device makes and models through the REST API

The ExtraHop REST API enables you to specify custom makes and models for devices. You can update devices through the REST API Explorer or automate the procedure by reading device criteria from a CSV or similar file through a REST API script.

Specify a custom make and model through the REST API Explorer

Important:The REST API Explorer is not available on Reveal(x) 360.

Retrieve the ID of the device

Before you can specify a custom make and model for a device, you must retrieve the REST API ID of the device.

  1. In a browser, navigate to the REST API Explorer.
    The URL is the hostname or IP address of your sensor or console, followed by /api/v1/explore/. For example, if your hostname is seattle-eda, the URL is https://seattle-eda/api/v1/explore/.
  2. Click Enter API Key and then paste or type your API key into the API Key field.
  3. Click Authorize and then click Close.
  4. Click GET /devices.
  5. Click Try it out.
  6. Click the search_type drop-down and select a search filter. Then, enter a criterion that identifies the device in the value field.
    For example, to search for a device by IP address, select ip address and then type the IP address in the value field.
  7. Click Send Request.
    In the Response body section, note the id field of the device.

Specify a high value device

  1. Click PATCH /devices/{id}.
  2. Click Try it out.
  3. In the body field, type the following JSON object:
    {
        "custom_criticality": "critical"
    }
  4. In the id field, type the ID of the device that you retrieved in the previous procedure.
  5. Click Send Request.
    If the request is successful, a 204 response code appears in the Server response section.

Retrieve and run the example Python script

The ExtraHop GitHub repository contains an example Python script that reads custom makes and models from a CSV file and adds them to devices with specified IP addresses.

Important:The example python script authenticates to the sensor or console through an API key, which is not compatible with the Reveal(x) 360 REST API. To run this script with Reveal(x) 360, you must modify the script to authenticate with API tokens. See the py_rx360_auth.py script in the ExtraHop GitHub repository for an example of how to authenticate with API tokens.
  1. Go to the ExtraHop code-examples GitHub repository and download the contents of the specify_custom_make_model directory to your local machine.
  2. In a text editor, open the custom_config.csv file and add the IP address for each device you want to update along with the custom makes and models for each device.
    Note:The file contains two example entries. The script ignores the header row.
  3. In a text editor, open the specify_custom_make_model.py file and replace the following configuration variables with information from your environment:

    HOST: The IP address or hostname of the sensor or console

    API_KEY: The API key

  4. Run the following command:
    python3 specify_custom_make_model.py
    Note:If the script returns an error message that the SSL certificate verification failed, make sure that a trusted certificate has been added to your sensor or console. Alternatively, you can add the verify=False option to bypass certificate verification. However, this method is not secure and not recommended. The following code sends an HTTP GET request without certificate verification:
    requests.get(url, headers=headers, verify=False)
Published 2022-06-21