What's New

While release notes provide a comprehensive view of our release updates, here is a preview of our most exciting features in ExtraHop 9.4.

Detection Triage

The ExtraHop system now recommends detections for triage based on contextual analysis of several factors in your environment. Recommendations are highlighted in Triage on the Detections page and on the Security Overview page.

Detection Summary

The Summary view on the Detections page aggregates information by detection type or source and enables you to tune and track multiple detections at once.

External Scanning Services

ExtraHop now identifies external scanning services and flags them as participants in detections. You can create tuning rules for a specific external scanning service or hide all detections involving an external scanning service.

Geolocation Map

Renamed the Countries tab to Geolocation on the Perimeter Overview page and replaced the halo visualization with an interactive world map. The Geolocation map indicates traffic between internal endpoints and geographic locations, which are highlighted in a contrasting color on the map. The intensity of the contrasting color represents the amount of traffic at that geolocation. Click a highlighted geolocation from the map to view the total amount of inbound or outbound traffic associated with connected internal endpoints.

Language Selection

The ExtraHop system enables you to display French or German in select areas of the user interface and in the documentation.

Netskope Integration

This integration enables you to configure ExtraHop sensors to ingest packets from your Netskope solution to detect threats, discover and monitor devices, and gain insight into traffic. Reveal(x) 360 users can navigate to the Netskope integration page to view sensor connection status.

Reveal(x) 360

The ExtraHop system now enables you to create a system notification rule to email a recipient list whenever the recordstore cannot connect to a sensor to receive records and when the connection is restored.

If you have added a custom identity provider, the ExtraHop system automatically sends identity provider (IdP) certificate expiration notifications to all users with System and Access Administration privileges. Emails are sent 1 month, 2 weeks, and 1 week prior to the certificate expiration date.