This integration enables you to export Reveal(x) 360 detections to Cortex XSOAR and run response playbooks, as well as query Reveal(x) 360 packets and device activity.
To configure this integration, you must create Cortex XSOAR credentials and then add those credentials when you configure the ExtraHop Reveal(x) integration for Cortex XSOAR.
- You must have Cortex XSOAR version 6.5 or later.
- You must have the following Cortex XSOAR content packs:
- Base version 1.31.62 or later
- Common Playbooks version 2.2.4 or later
- Common Scripts version 1.11.22 or later
- Filters and Transformers version 1.0.2 or later
- CVE Search version 1.0.14 or later
- Log in to Reveal(x) 360.
- Click the System Settings icon and then click Integrations.
- Click the Cortex XSOAR tile.
Click Create Credential.
The page displays the generated ID and secret.
- Copy and store the ID and secret, which you will need to configure the ExtraHop Reveal(x) integration for Cortex XSOAR.
- Click Done.
- Download and install the ExtraHop integration for Cortex XSOAR from the XSOAR Marketplace according to the Cortex XSOAR Marketplace Overview documentation.
- From the installed integration, click Add Instance.
- Type a unique Name for the integration instance.
- Type the URL of the Reveal(x) 360 system this integration instance will connect to.
- Select On Cloud and enter the Client ID and Client Secret credentials that you created and copied from your Reveal(x) 360 system.
- Complete configuration of the integration instance according to the ExtraHop integration for Cortex XSOAR Reference documentation.