Change a device role

The ExtraHop system automatically discovers and classifies devices on your network. Based on the type of traffic and protocol activity associated with a device, the ExtraHop system can automatically assign a role to a device, such as database or file server, to classify device behavior. You can change a device role at anytime.

Note:After you change the role of a device, the device might be removed from or added to dynamic device groups that include a device role as criteria.
  1. Log into the Web UI on the Discover or Command appliance.
  2. Find a device and then click the device name.
    An overview page appears, which displays properties, traffic, and protocol activity for the selected device.
  3. Click Edit Properties .
  4. In the Device Role section, click the drop-down list, and then click one of the following roles:
    Role Description
    Auto Assign the role that the ExtraHop system identified for the device, which appears in parentheses.
    Other Assign to a device when the device activity does not clearly identify a single role.
    Database Assign to a device that hosts a database instance.
    File Server Assign to a device that responds to read and write requests for files over NFS and CIFS/SMB protocols.
    Firewall Assign to a device that monitors incoming and outgoing network traffic and blocks traffic according to security rules. The ExtraHop system does not automatically assign the Firewall role to devices.
    Gateway Assign to a device that acts as a router or gateway. The ExtraHop system automatically assigns the gateway role to any L2 device associated with a large amount of unique IP addresses (past a certain threshold). Gateway device names include the router name such as Cisco B1B500. Unlike other L2 parent devices, you can add a gateway device to the watchlist for Advanced Analysis.
    Web Server Assign to a device that hosts web resources and responds to HTTP requests.
    Load Balancer Assign to a device that acts as a reverse proxy for distributing traffic across multiple servers.
    Vulnerability Scanner Assign to a device that runs vulnerability scanner programs.
    Domain Controller Assign to a device that acts as a domain controller for Kerberos, CIFS, and MSRPC server activity.
    DHCP Server Assign to a device whose main function is processing DHCP server activity.
    DNS Server Assign to a device whose main function is processing DNS server activity.
    Mobile Device Assign to a device that has a mobile operating system installed, such as iOS or Android.
    Web Proxy Server Assign to a device that processes HTTP requests between a device and another server.
  5. Click Save.
Published 2019-04-08 14:41