ExtraHop System User Guide

ExtraHop modules offer a combination of solutions, components, and cloud-based services that deliver value for multiple use cases.

Modules are available for Network Detection and Response (NDR) and Network Performance Monitoring (NPM), with additional modules for Intrusion Detection Systems (IDS) and Packet Forensics.

Administrators can grant users role-based access to the NDR module, NPM module, or both.

Network Performance Monitoring

The NPM module allows privileged users to complete the following types of system tasks.

• View, create, and modify custom dashboards. Users can also select a dashboard for their default landing page.
• Configure alerts and notification by email for those alerts.
• View performance detections.

Network Detection and Response

The NDR module allows privileged users to complete the following types of system tasks.

• View the Security Overview page.
• View security detections.
• View, create, and modify investigations.
• View threat briefings.

Users granted access to both modules are allowed to complete all of these tasks. See the Migration Guide to learn more about migrating users to role-based access with these modules.

These additional modules are also available for specific use cases:

Packet Forensics

The Packet Forensics module can be combined with either the NDR or NPM module to provide full packet capture, storage, and retrieval.

Intrusion Detection Systems

The IDS module must be combined with the NDR module and provides detections based on industry-standard IDS signatures. Most ExtraHop packet sensors are eligible for the IDS module, as long as the sensor is licensed for the NDR module.

Note:

Throughput might be affected when more than one module is enabled on the sensor.

ExtraHop sensors collect and store multiple depths of network interaction as metrics. Metrics are aggregated observations about endpoint interactions over time. Packetstores collect and store the raw data transferred between two endpoints as packets. Recordstores collect and store records, which are structured information about transaction, message, and network flows.

You can view and query all of these interactions from individual sensors or from a console that is connected to a complex deployment of sensors, packetstores, and recordstores.

For example, when a client sends an HTTP request to a web server, here is what each data type contains:

• The packet contains the raw data that was sent and received in the interaction.
• The related record contains the time-stamped metadata about the interaction: when the request happened, the IP address of the client and server, the requested URI, any error messages.
• The related metric (HTTP Requests) contains an aggregate of that interaction with other observed interactions during the specified time period, such as how many requests occurred, how many of those requests were successful, how many clients sent requests, and how many servers received the requests.

Both metrics and records can be customized to extract and store specific metadata with JavaScript-based triggers. While the ExtraHop system has over 4600 built-in metrics, you might want to create a custom metric that collects and aggregates 404 errors from only critical web servers. And, you might want to maximize your record storage space by only collecting transactions that occurred over a suspicious port.

After a device is discovered, the ExtraHop system begins to collect metrics based on the analysis level configured for that device. You can Find a device by their MAC address, IP address, or name (such as a hostname observed from DNS traffic, NetBIOS name, Cisco Discovery Protocol (CDP) name, DHCP name, or a custom name that you assigned to the device).

The ExtraHop system can discover and track devices by their MAC address (L2 Discovery) or by their IP addresses (L3 Discovery). L2 Discovery offers the advantage of tracking metrics for a device even if the IP address is changed or reassigned through a DHCP request. By default, the ExtraHop system is configured for L2 Discovery.

Device IPv4 and IPv6 addresses are discovered from Address Resolution Protocol (ARP) messages, Neighbor Discovery Protocol (NDP) responses, local broadcasts, or local subnet multicast traffic. The MAC address and IP address for devices appear in search results throughout the system with the device information.

L2 Discovery

In L2 Discovery, the ExtraHop system creates a device entry for every local MAC address discovered over the wire. IP addresses are mapped to the MAC address, but metrics are stored with the device MAC address even if the IP address changes.

IP addresses observed outside of locally-monitored broadcast domains are aggregated at one of the incoming routers in your network. If a device sends a DHCP request through a router acting as a DHCP relay agent, the ExtraHop system detects and maps the IP address to the device MAC address. If the IP address changes for the device with a subsequent request through the DHCP relay agent, the ExtraHop system updates its mapping and continues to keep track of the device metrics by the MAC address.

Both MAC address and IP address are discovered for the remote device.

If a DHCP relay agent is not configured, remote devices can be discovered by their IP addresses through Remote L3 Discovery.

Remote L3 Discovery

If the ExtraHop system detects an IP address that does not have associated ARP or NDP traffic, that device is considered a remote device. Remote devices are not automatically discovered, but you can add a remote IP address range and discover devices that are outside of the local network. A device entry is created for each IP address that is observed within the remote IP address range. (Remote devices do not have L2 parent entries.)

Only the IP address is discovered for the remote device.

Here are some recommendations about when to configure Remote L3 Discovery:

• Your client devices are on a network segment that is not directly tapped.
• Your organization has a remote office without an on-site ExtraHop system but users at that site access central data center resources that are directly monitored by an ExtraHop system. The IP addresses at the remote site can be discovered as devices.
• A cloud service or other type of off-site service hosts your remote applications and has a known IP address range. The remote servers within this IP address range can be individually tracked.

The ExtraHop system removes duplicate L2 and L3 frames and packets when metrics are collected and aggregated from your network activity by default.

The System Health page contains charts that display L2 and L3 duplicate packets that were removed by the ExtraHop system. Deduplication works across 10Gbps ports by default.

The ExtraHop system offers both machine-learning and rules-based detections that identify active or potential threats, network weaknesses that are vulnerable to exploits, and suboptimal configurations that can degrade network performance.

Additionally, charts, visualizations, and device activity maps enable proactive threat hunting.

The Network Activity dashboard enables you to monitor general information about application activity and performance from the transport through the application layers (L4 - L7) on your network.

Each chart in the Network Activity dashboard contains visualizations of network and protocol metric data that have been generated over the selected time interval, organized by region.

The Network Activity dashboard is a built-in, system dashboard that you cannot edit, delete, or add to a shared collection. However, you can copy a chart from the Network Activity dashboard and add it to a custom dashboard, or you can make a copy of the dashboard and edit it to monitor metrics that are relevant to you.

The following information summarizes each region and its charts.

Traffic Overview

Observe whether traffic bottlenecks are related to a specific application protocol or network latency. The Traffic Overview region contains the following charts:

Network Packets by L7 Protocol Avg Rate chart: Find the protocol that has the highest volume of packet transmissions over the application layer (L7) during the selected time interval.

All Activity Network Round Trip Time: The 95th percentile line shows you the upper range of the time that it took for packets to traverse the network. If this value is over 250ms, then network issues could be slowing down application performance. Round trip time is a measurement of the time between when a client or server sent a packet and received an acknowledgment.

Alerts: View up to 40 of the latest alerts that were generated, and their severity levels. Alerts are user-configured conditions that establish baseline values for specific protocol metrics.

Active Protocols

Observe how application performance is affected by the protocols that are actively communicating on the ExtraHop system. For example, you can quickly glance at charts that display server processing times and the ratio of errors to responses per protocol.

There is a chart for each active protocol. If you do not see a protocol you were expecting, applications might be not communicating over that protocol for the selected time interval.

For more information about protocols and to view metric definitions, see the ExtraHop Protocol Metrics Reference.

The Network Performance dashboard enables you to monitor how effectively data is transmitted over the data link, network, and transport (L2 - L4) layers.

Each chart in the Network Performance dashboard contains visualizations of network performance data that have been generated over the selected time interval, organized by region.

The Network Performance dashboard is a built-in, system dashboard that you cannot edit, delete, or add to a shared collection. However, you can copy a chart from the Network Performance dashboard and add the chart to a custom dashboard, or you can make a copy of the dashboard and edit the dashboard to monitor metrics that are relevant to you.

The following information summarizes each region.

Network L2 Metrics

Monitor the throughput rates over the data link (L2) layer by bits and packets, and monitor the types of frames transmitted. You can also determine how much data is sent to receivers by unicast, broadcast, or multicast distribution.

Network L4 Metrics

Monitor data transfer latency over the transport layer (L4). View TCP activity through connection, request, and response metrics. This data can indicate how effectively data is sent and received across the transport layer in your network.

Network Performance

Monitor how network performance is affecting applications. View overall network throughput by reviewing the throughput per application protocol and the magnitude of high TCP round trip times.

Network L3 Metrics

View data throughput at the network layer (L3) and see packets and traffic by TCP/IP protocols.

DSCP

View a breakdown of packets and traffic by Differentiated Services code points, which is part of the DiffServ network architecture. Every IP packet contains a field to express the priority of how the packet should be handled, which is called differentiated services. The values for the priorities are called code points.

Multicast Groups

View traffic that is sent to multiple receivers in a single transmission, and see packets and traffic by each receiver group. Multicast traffic on a network is organized into groups based on destination addresses.

The Security Hardening dashboard enables you to monitor general information about potential security threats on your network.

The Security Hardening dashboard is a built-in, system dashboard that you cannot edit, delete, or add to a shared collection. However, you can copy a chart from the Security Hardening dashboard and add it to a custom dashboard, or you can make a copy of the dashboard and edit it to monitor metrics that are relevant to you.

The following information summarizes each region and its charts.

Threat Intelligence

Observe the number of connections and transactions that contain suspicious hostnames, IP addresses, or URIs found in threat intelligence. Click a blue metric value or metric name in the legend to drill down on a suspicious metric. A detail page appears that displays a red camera icon next to the suspicious object. Click the red camera icon to learn about the threat intelligence source.

Note:

Threat intelligence metrics display a zero value for one or more of the following reasons: Your ExtraHop RevealX subscription does not include threat intelligence. You have not enabled threat intelligence for your ExtraHop RevealX system. You have not directly uploaded custom threat collections to your sensors. Contact ExtraHop Support for help uploading a custom threat collection to you ExtraHop-managed sensors. No suspicious objects were found.

TLS - Sessions

Observe the number of active TLS sessions with weak cipher suites on your network. You can see which clients and servers are participating in those sessions along with which cipher suites those sessions are encrypted with. DES, 3DES, MD5, RC4, null, anonymous, and export cipher suites are considered to be weak because they include an encryption algorithm that is known to be vulnerable. Data encrypted with a weak cipher suite is potentially insecure.

You can also observe the number of TLS sessions established with TLS v1.0 and which clients are participating in those sessions. Known vulnerabilities are associated with TLS v1.0. If you have a high number of TLS v1.0 sessions, consider configuring servers to support the latest version of TLS.

TLS - Certificates

Observe which TLS certificates in your network are self-signed, wildcard, expired, and expiring soon. Self-signed certificates are signed by the entity that issues the certificate, rather than a trusted certificate authority. Although self-signed certificates are cheaper than certificates issued by a certificate authority, they are also vulnerable to man-in-the-middle attacks.

A wildcard certificate applies to all first-level subdomains of a given domain name. For example, the wildcard certificate *.company.com secures www.company.com, docs.company.com, and customer.company.com. Although wildcard certificates are cheaper than individual certificates, wildcard certificates create a greater risk if they are compromised because they can apply to any number of domains.

Vulnerability Scans

Observe which devices are scanning applications and systems on your network to search for weaknesses and potential targets, such as high value devices. In the left chart, you can identify which devices are sending the most scan requests, which are HTTP requests associated with known scanner activity. In the right chart, you can see which user-agents are associated with the scan requests. The user-agent can help you determine if scan requests are associated with known vulnerability scanners such as Nessus and Qualys.

DNS

Observe which DNS servers are most active on your network and the total number of reverse DNS lookup failures those servers have encountered. A reverse DNS lookup failure occurs when a server issues an error in response to a client request for a pointer (PTR) record. Failures in reverse DNS lookups are normal, but a sudden or steady increase in failures on a specific host might indicate that an attacker is scanning your network.

You can also observe the number of address mapping and text record queries on your network. A large or sudden increase in these types of queries can be an indicator of a potential DNS tunnel.

The Generative AI dashboard enables you to monitor traffic from OpenAI tools on your network.

Each chart in the Generative AI Tools dashboard contains visualizations of traffic associated with the OpenAI cloud service for tools such as ChatGPT. View traffic that was generated during a selected time interval, organized by region.

The Generative AI Tools dashboard is a built-in, system dashboard, and you cannot edit, delete, or add system dashboards to a collection. However, you can copy a chart from the Generative AI Tools dashboard and add the chart to a custom dashboard, or you can make a copy of the dashboard and edit the dashboard to monitor metrics that are relevant to you.

The following information summarizes each region and its charts.

Generative AI Tools

Monitor traffic to OpenAI-based tools observed on your network. Learn when traffic occurred, how much data was transferred, and which internal endpoints participated.

The Active Directory dashboard enables you to track Kerberos server activity for Active Directory user and computer accounts as well as services such as global catalog and group policies.

Each chart in the Active Directory dashboard contains visualizations of of Active Directory account data that have been generated over the selected time interval, organized by region.

The Active Directory dashboard is a built-in, system dashboard that you cannot edit, delete, or add to a shared collection. However, you can copy a chart from the Active Directory dashboard and add it to a custom dashboard, or you can make a copy of the dashboard and edit it to monitor metrics that are relevant to you.

The following information summarizes each region and its charts.

Account Summary

Observe the number of Active Directory accounts in your environment in the following charts:

Total Accounts: Total number of user accounts and of computer accounts.

Privileged Accounts: Total number of privileged accounts that successfully logged in, that received a login error, and that sent a service access request.

Authentication Errors

Observe the number of Active Directory accounts with authentication errors in the following charts:

User Account Errors: Total number of user account login errors due to invalid passwords, expired passwords, and disabled accounts. Displayed as a line chart and a list chart.

Computer Account Errors: Total number of computer account login errors due to invalid passwords, expired passwords, and disabled accounts. Displayed as a line chart and a list chart.

Account Errors: Total number of errors for any account type due to account lockouts and due to time errors. Displayed as a line chart and a list chart.

Authentication Error Details

Observe details about Active Directory accounts that had authentication errors in the following charts:

User Accounts: Usernames associated with user accounts that failed to login. This chart also displays the number of times each user account received an error due to an invalid password or an expired account.

Computer Accounts: Client IP addresses and hostnames associated with user accounts that failed to login. This chart also displays the number of times each user account received an error due to an invalid password or an expired account.

Ticket Granting Service

Observe transaction data associated with the Kerberos ticket granting service in the following charts:

Transactions: Total number of service ticket requests and the number of unknown service principal name (SPN) errors.

Transactions: Total number of service ticket requests.

Unknown SPN Errors by SPN: Number of unknown SPN errors listed by the SPN that sent the error.

Unknown SPN Errors by Client: Number of unknown SPN errors listed by the client that received the error.

Total Unknown SPN Errors: Total number of unknown SPN errors.

Group Policy

Observe SMB transaction data associated with the group policy in the following charts:

Transactions: Total number of group policy responses and of group policy errors.

Transactions: Total number of group policy responses and of group policy errors, in addition to the server processing time taken to send the first packet in response after receiving the last packet of the group policy request.

LDAP

Observe LDAP transaction data with the following charts:

Transactions: Total number of LDAP responses and errors.

Transactions: Total number of LDAP responses and errors, in addition to the server processing time taken to send the first packet in response after receiving the last packet of the request.

Insecure LDAP Credentials: Total number of plaintext bind requests. Displayed as a line chart and a list chart.

Global Catalog

Observe transaction data associated with the global catalog in the following charts:

Transactions: Total number of global catalog responses and errors.

Transactions: Total number of global catalog responses and errors, in addition to the server processing time taken to send the first packet in response after receiving the last packet of the global catalog request.

DNS Service Records

Observe DNS service record transaction data in the following charts:

Transactions: Total number of service record responses and errors.

Transactions: Total number of service record responses and errors, in addition to the server processing time taken to send the first packet in response after receiving the last packet of the request.

The System Health dashboard provides a large collection of charts that enable you to make sure that your ExtraHop system is running as expected, to troubleshoot issues, and to assess areas that are affecting performance. For example, you can monitor the number of packets processed by the ExtraHop system to ensure that packets are continuously captured.

Each chart in the Network Performance dashboard contains visualizations of system performance data that have been generated over the selected time interval, organized by region.

The System Health dashboard is a built-in, system dashboard that you cannot edit, delete, or add to a shared collection. However, you can copy a chart from the System Health dashboard and add it to a custom dashboard, or you can make a copy of the dashboard and edit it to monitor metrics that are relevant to you.

The System Usage dashboard enables you to monitor how users are interacting with the ExtraHop system.

Each chart in the System Usage dashboard contains visualizations of user interactions with the ExtraHop system and detections that have been generated over the selected time interval, organized by region.

The following information summarizes each region and its charts.

ExtraHop Users

Observe user login activity and the current number of active users on the ExtraHop system.

Active Users and Logins: The number of times users have logged in to the ExtraHop system, and current snapshots of active users. The line chart displays current active users, and the column chart displays the number of user logins over time. A login is counted every time a user logs in to the system, including multiple logins by a single user.

Top User Logins: Users with the most logins on the ExtraHop system over the selected time interval.

Active Users and Logins: The number of users that are currently active on the ExtraHop system, and the total number of user logins over the selected time interval.

Dashboards

Observe how often users are viewing dashboards and which dashboards are viewed the most.

Dashboard Views: Total dashboard views over time. A dashboard view is counted when a dashboard appears following a user login, click, or direct navigation through a shared URL.

Top Viewed Dashboards: Dashboards with the highest number of views.

Total Dashboard Views: The total number of dashboard views over the selected time interval.

Detections

Observe information about detections that are generated by the ExtraHop system and how users are viewing and tracking detections.

Detection Views: Two values are displayed in this line chart: Detection List Views counts the number of clicks on the detection list when grouped by detection type, and Detection Detail Views counts the number of times a detection detail page appears following a user login, click, or direct navigation through a shared URL. Click on either metric name in the legend to drill down by detection type.

Top Viewed Detections: The detection types that were viewed the most over the selected time interval.

Total Detection Views: The total values for both detection list views and detection detail views over the selected time interval.

Detection Tracking (line chart): The number of detections that were closed with and without action taken, and the number of detections that were acknowledged over time.

Detection Tracking (list chart): The total number of detections that were closed with and without action taken, the number of investigations created, and the total number of detections that were set to the Acknowledged status over the selected time interval. The list also includes the number of detections that are currently set to the In Progress status.

Total Closed Detections: The total number of detections that were closed with and without action taken over the selected time interval. The Total Closed Detections values include detections that were hidden after the detection status was set.

Recommended Detections: The number of detections that were recommended for triage, also known as Smart Triage, during the selected time interval.

Top Recommended Detections: The detection types that were recommended for triage the most during the selected time interval.

Total Closed Recommended Detections: The total number of recommended detections that were closed with and without action taken during the selected time interval.

Detection Types

Observe which detection types were generated the most by the ExtraHop system and how users are interacting with those detections.

Top Viewed Detection Types: The number of detection list views and detection detail views for the detection types that have occurred over the selected time interval.

Investigations

Observe information about user-created investigations, investigations recommended by the ExtraHop system, and how users are viewing and interacting with investigations.

Investigation Views: The number of user-created and recommended investigation views over time. An investigation view is counted when an investigation is displayed following a user login, click, or direct navigation through a shared URL.

Top Viewed Investigations: The types of user-created and recommended investigations that were viewed the most during the selected time interval.

Total Investigation Views: The total number of user-created and recommended investigation views during the selected time interval.

Investigations Created: The number of investigations that were created over time, listed by investigations created by users and by investigations that were recommended by the ExtraHop system.

Top Recommended Investigations: The investigation types that were recommended by the ExtraHop system the most during the selected time interval.

Total Investigations Created: The total number of investigations created by users and the total number of investigations that were recommended by the ExtraHop system during the selected time interval.

Threat Briefings

Observe information about threat briefings that provide guidance about potential threats to your network and how users are viewing them.

Threat Briefing Views: The number of threat briefing views over time. A threat briefing view is counted when a threat briefing detail page is displayed following a user click or direct navigation through a shared URL.

Top Viewed Threat Briefings: The threat briefings that were viewed the most during the selected time interval.

Total Threat Briefing Views: The total number of threat briefings that were viewed during the selected time interval.

By clicking on a device name, you can view all of the information discovered about the device by the ExtraHop system on the Device Overview page. The Device Overview page is divided into three sections: a top-level summary, a properties panel, and an activity panel.

https://example-eda/extrahop/#/metrics/devices//0026b94c03810000/overview/&tab=detections

Metrics are real-time measurements of your network traffic that the ExtraHop system calculates from network or flow data. Metrics collected from device traffic can be viewed in built-in charts and graphs from a device page.

Click a built-in metric page from the left pane to view top-level device metrics or client and server metrics by protocol. Click a chart to drill down to detail metric pages, which display metric values for a specific key (such as a client or server IP address).

In addition to network and TCP built-in pages, devices display built-in metric pages for associated cloud services if data is available. See the Protocol Metrics Reference for more information about what data is available on built-in device pages.

The ExtraHop system provides thousands of built-in metrics. Here are some ways you can gain further insight about your devices

• Create a chart to visualize specific metrics and save the chart to a dashboard.
• Create an activity map to view peer device relationships over specified protocols.
• Write a trigger to create custom metrics or create an application container to collect metrics for specific devices.

Type an IP address in the global search field or click an IP address link from a Device Overview page to view details about an IP address.

The following information appears for an IP address seen on a device:

• Each device where the IP address is currently observed, regardless of the selected time interval.
• Each device where the IP address was previously observed within the selected time interval, including the timestamp from when the IP address was last seen on the device.

If L2 Discovery is enabled, both IPv4 and IPv6 addresses might be simultaneously observed on the device, or different IP addresses might be assigned to the device by DHCP over time.

The following information appears for an IP address associated with a device:

• The geolocation of the IP address and links to the ARIN Whois website.
• Each device where the associated IP address was seen outside of the network at any time during the selected time interval. For example, a VPN client on your network might be associated with an external IP address on the public internet.
• Any cloud services associated with the IP address.
• The IP address of the device as seen by the ExtraHop system on your network.
• The timestamp when the associated IP address was last seen on the device.

Here are some ways you can view additional IP address and device information:

• Hover over a device name to view device properties.
• Click a device name to view the Device Overview page.
• Click Search for Records to start a record query that is filtered by the IP .
• Click Search for Packets to start a packet query that is filtered by this device.

Custom devices enable you to collect metrics for devices that are outside of your local network or when you have a group of devices that you want to aggregate metrics for as a single device. These devices can even be different physical interfaces that are located on the same device; aggregating the metrics for these interfaces can make it easier to understand how heavily taxed your physical resources are as a whole, rather than by interface.

You might create a custom device to track individual devices outside of your local broadcast domain or to collect metrics about several known IP addresses or CIDR blocks from a remote site or cloud service. You can collect remote site metrics for custom devices to learn how remote locations consume services and to gain visibility into traffic between remote sites and a data center. See the Protocol Metrics Reference for a full list of remote site metrics and descriptions.

After you create a custom device, all of the metrics associated with the IP addresses and ports are aggregated into a single device that collects L2-L7 metrics. A single custom device counts as one device towards your licensed capacity for Advanced Analysis or Standard Analysis, which enables you to add a custom device to the watchlist. Any triggers or alerts are also assigned to the custom device as a single device.

While custom devices aggregate metrics based on their defined criteria, the metric calculations are not treated the same as for discovered devices. For example, you might have a trigger assigned to a custom device that commits records to a recordstore. However, the custom device is not shown as either a client or a server in any transaction records. The ExtraHop system populates those attributes with the device that corresponds to the conversation on the wire data.

Custom devices can affect the overall system performance, so you should avoid the following configurations:

• Avoid creating multiple custom devices for the same IP addresses or ports. Custom devices that are configured with overlapping criteria might degrade system performance.
• Avoid creating a custom device for a broad range of IP addresses or ports, which might degrade system performance.

If a large number of custom devices is affecting your system performance, you can delete or disable a custom device. The unique Discovery ID for the custom device always remains in the system. See Create a custom device to monitor remote office traffic to familiarize yourself with custom devices.

A device group is a user-defined collection that can help you track metrics across multiple devices that are typically grouped by shared attributes such as protocol activity.

You can create a static device group that requires you to manually add or remove a device from the group. Or, you can create a dynamic device group that includes criteria that determines which devices are automatically included in the group. For example, you can create a dynamic device group based on the device discovery time that adds devices that are discovered during a specific time interval.

By default, the Device Group page includes the following dynamic device groups that you can overwrite or delete:

New Devices (Last 24 Hours)

Includes assets and endpoints that were first seen by the ExtraHop system over the last 24 hours.

New Devices (Last 7 Days)

Includes assets and endpoints that were first seen by the ExtraHop system over the last 7 days.

The ExtraHop system also includes built-in dynamic device groups by role and by protocol. You can assign built-in device groups as a metric source for objects such as charts, alerts, triggers, and activity maps. You cannot overwrite or delete a built-in device group, but you can add filter criteria and save it as a new device group.

From the Devices page, click a device count for a role or protocol, such as Domain Controller or SMB clients, to view the Device Group Overview page. Clicking the filter at the top of the page enables you to add additional criteria and update the page data on demand instead of requiring you to create a device group.

There is no performance impact to collecting metrics with device groups. However, we recommend that you prioritize these groups by their importance to make sure that the right devices receive the highest level of analysis.

Device groups are a good choice when you have devices that you want to collectively apply as a source. For example, you could collect and display metrics for all of your high-priority production web servers in a dashboard.

By creating a device group, you can manage all of those devices as a single metric source instead of adding them to your charts as individual sources. However, note that any assigned triggers or alerts are assigned to each group member (or individual device).

The ExtraHop system discovers device names by passively monitoring naming protocols, including DNS, DHCP, NETBIOS, and Cisco Discovery Protocol (CDP).

If a name is not discovered through a naming protocol, the default name is derived from device attributes, such as MAC addresses and IP addresses. For some devices discovered on flow sensors, the ExtraHop system assigns names based on the role of the device such as Internet Gateway or Amazon DNS Server. You can also create a custom name or set a cloud instance name for a device.

A device can be identified by multiple names, which appear as Known Aliases on the Device Overview page. If a device has multiple names, the order of display precedence is specified in Administration settings. You can search by any name to find a device.

If a device name does not include a hostname, the ExtraHop system has not yet observed naming protocol traffic associated with that device. The ExtraHop system does not perform DNS lookups for device names.

Based on the type of traffic associated with the device or the device model, the ExtraHop system automatically assigns a role to the device, such as a gateway, file server, database, or load balancer. The Other role gets assigned to devices that cannot be identified.

A device can only be assigned one role at a time. You can manually change a device role, or the ExtraHop system might re-assign a different role if observed traffic and behavior changes. For example, if a PC has been repurposed into a Web server, you might change the role immediately, or the change might be observed over time and the role updated by the system.

The ExtraHop system identifies the following roles:

Icon	Role	Description
	Custom Device	A user-created device that collects metrics based on specified criteria. The ExtraHop system automatically assigns this role when you create a custom device. You cannot manually assign the Custom role to a device.
	Attack Simulator	A device that runs breach and attack simulation (BAS) software to simulate attacks in a network.
	Database	A device that primarily hosts a database instance.
	DHCP Server	A device that primarily processes DHCP server activity.
	DNS Server	A device that primarily processes DNS server activity.
	Domain Controller	A device that acts as a domain controller for Kerberos, SMB, and MSRPC server activity.
	File Server	A device that responds to read and write requests for files over NFS and SMB protocols.
	Firewall	A device that monitors incoming and outgoing network traffic and blocks traffic according to security rules. The ExtraHop system does not automatically assign this role to devices.
	Gateway	A device that acts as a router or gateway. The ExtraHop system looks for devices associated with a large amount of unique IP addresses (past a certain threshold) when identifying gateways. Gateway device names include the router name such as Cisco B1B500. Unlike other L2 parent devices, you can add a gateway device to the watchlist for Advanced Analysis.
	IP Camera	A device that sends image and video data through the network. The ExtraHop system assigns this role based on the device model.
	Load Balancer	A device that acts as a reverse proxy for distributing traffic across multiple servers.
	Medical Device	A device designed for healthcare needs and medical environments. The ExtraHop system might assign this role if a device is a known medical make and model or if the device processes DICOM traffic.
	Mobile Device	A device that has a mobile operating system installed, such as iOS or Android.
	NAT Gateway	A device that acts as a Network Address Translation (NAT) gateway. The ExtraHop system might assign this role if a device is associated with four or more OS fingerprint families or with four or more hardware or vendor makes and models. After a device is assigned this role, device properties for software, hardware make and model, and authenticated users no longer appear for the device.
	PC	A device such as a laptop, desktop, Windows VM, or macOS device that processes DNS, HTTP, and TLS client traffic.
	Printer	A device that enables users to print text and graphics from other connected devices. The ExtraHop system assigns this role based on the device model or on traffic observed over mDNS (multicast DNS).
	VoIP Phone	A device that manages voice over IP (VoIP) phone calls.
	VPN Client	An internal device that communicates with a remote IP address. If VPN client discovery is enabled, the ExtraHop system automatically assigns this role to internal devices communicating with remote IP addresses through a VPN gateway. You cannot manually assign the VPN Client role to a device.
	VPN Gateway	A device that connects two or more VPN devices or networks together to bridge remote connections. The ExtraHop system assigns this role to devices with a large number of external VPN peers if automatic classification for this role is enabled in the running configuration file.
	Vulnerability Scanner	A device that runs vulnerability scanner programs.
	Web Proxy Server	A device that processes HTTP requests between a device and another server.
	Web Server	A device that primarily hosts web resources and responds to HTTP requests.
	Wi-Fi Access Point	A device that creates a wireless local area network and projects a wireless network signal to a designated area. The ExtraHop system assigns this role based on the device model.