Configure lookup links

You can configure a list of external tools that are available for retrieving information about IP addresses and SHA-256 file hashes within the ExtraHop system. Lookup tool links are usually displayed when you click or hover over an IP address or file hash from Devices, Files, Records, or Detections pages. Click the link to launch the lookup tool, which will search for the associated IP address or file hash.

Here are some considerations about configuring lookup links:

• You must have System and Access Administration or System Administration (RevealX 360 only) user privileges.
• You can configure up to 15 lookup links of each type.
• The following lookup links are configured by default and can be modified or deleted:
  • ARIN Whois Lookup (IP addresses only)
  • VirusTotal Lookup

1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
2. Configure an IP address lookup link by clicking the IP Address tab and completing the following steps:
   1. Click Add Lookup Link.
   2. In the URL Template field, type the URL of the lookup tool.
      The URL must include the $ip variable, which is replaced with the IP address of the endpoint upon lookup. For example, https://search.arin.net/rdap/?query=$ip
   3. In the Display Name field, type the name of the link as you want it to appear.
   4. Select one of the following Display Options:
   • Show this link on all endpoints
   • Show this link on external endpoints
   • Show this link on internal endpoints
   • Do not show this link
3. Click Save.
4. Configure a file hash lookup link, by clicking the IP Address tab and completing the following steps:
   1. Click Add Lookup Link.
   2. In the URL Template field, type the URL of the lookup tool.
      The URL must include the $filehash variable, which is replaced with the SHA-256 hash of the file upon lookup. For example: https://www.virustotal.com/gui/search/$filehash
   3. In the Display Name field, type the name of the link as you want it to appear.
   4. Select one of the following Display Options:
   • Show this link on all files
   • Do not show this link
5. Click Save.