Triggers FAQ

Where should I create a trigger if I have a Command appliance or Reveal(x) 360?

Triggers can be created on individual ExtraHop systems or on Command appliances and Reveal(x) 360 that are connected to multiple ExtraHop systems. When you create a trigger on a Command appliance or Reveal(x) 360 system, the trigger runs on any connected system where the trigger event occurs.

How do I unassign a trigger?

There are two methods for removing a trigger assignment:

• Open the device or group the trigger is assigned to and click Assignments from the top-right corner of the page. On the Triggers tab, click the remove (X) icon next to each trigger assignment you want to remove from the source.
• Open the trigger you want and click the Assignments tab to view which sources the trigger is assigned to. Click the remove (X) icon next to each device or device group you want to remove the trigger assignment from.

How do I disable or enable a trigger?

There are two methods to enable or disable a trigger from the Triggers page in System Settings:

• From the list of triggers, select the checkbox next to each trigger, and then click Enable or Disable from the upper-right corner.
• Open the trigger you want, and then select or deselect Disable Trigger.

Can I copy a trigger?

You can create a new trigger by copying an existing one.

1. Log in to the ExtraHop system through https://<extrahop-hostname-or-IP-address>.
2. Click the System Settings icon , and then click Triggers.
3. From the table on the Triggers page, select the checkbox next to the trigger that you want to copy.
4. Click Copy.

The copied trigger is added to the table with "(copy)" appended to the trigger name. By default, the copied trigger is not assigned to any devices or device groups.

Can I automatically indent trigger code?

You can automatically indent code in the trigger editor by pressing ALT + SHIFT + F.