The ExtraHop system automatically discovers and classifies devices on your network. Based on the type of traffic and protocol activity associated with a device, the ExtraHop system can automatically assign a role to a device, such as database or file server, to classify device behavior. You can change a device role at anytime.
|Note:||After you change the role of a device, the device might be removed from or added to dynamic device groups that include a device role as criteria.|
- Log into the Web UI on the Discover or Command appliance.
Find a device and
then click the device name.
An overview page appears, which displays properties, traffic, and protocol activity for the selected device.
- Click Edit Properties .
In the Device Role section, click the drop-down list, and
then click one of the following roles:
Role Description Auto Assign the role that the ExtraHop system identified for the device, which appears in parentheses. Other Assign to a device when the device activity does not clearly identify a single role. Database Assign to a device that hosts a database instance. File Server Assign to a device that responds to read and write requests for files over NFS and CIFS/SMB protocols. Firewall Assign to a device that monitors incoming and outgoing network traffic and blocks traffic according to security rules. The ExtraHop system does not automatically assign the Firewall role to devices. Gateway Assign to a device that acts as a router or gateway. The ExtraHop system automatically assigns the gateway role to any L2 device associated with a large amount of unique IP addresses (past a certain threshold). Gateway device names include the router name such as Cisco B1B500. Unlike other L2 parent devices, you can add a gateway device to the watchlist for Advanced Analysis. Web Server Assign to a device that hosts web resources and responds to HTTP requests. Load Balancer Assign to a device that acts as a reverse proxy for distributing traffic across multiple servers. Vulnerability Scanner Assign to a device that runs vulnerability scanner programs. Domain Controller Assign to a device that acts as a domain controller for Kerberos, CIFS, and MSRPC server activity. DHCP Server Assign to a device whose main function is processing DHCP server activity. DNS Server Assign to a device whose main function is processing DNS server activity. Mobile Device Assign to a device that has a mobile operating system installed, such as iOS or Android. Web Proxy Server Assign to a device that processes HTTP requests between a device and another server.
- Click Save.