Customize a device

The ExtraHop system automatically discovers and classifies devices on your network. You can search for devices by their observed IP address, hostname, activity, or MAC address. Optionally, customize the following device information to optimize your search results:

Add a custom device name

The ExtraHop system automatically names devices by passively monitoring naming protocol traffic (DNS, DHCP, NETBIOS, CDP). If naming protocol traffic is not observed for a device, the device name displays the IP address for L3 devices or the MAC address for L2 devices. In either condition, you can replace the automatic device name with a custom name. The custom name will appear throughout the ExtraHop system.

Note:The ExtraHop system does not perform DNS lookups for device names. The ExtraHop system derives the DNS name for a device by observing DNS traffic over wire data. For more information, see Device discovery.
  1. Log into the Web UI on the Discover or Command appliance.
  2. Click Metrics and select Device in the left pane.
  3. Find a device and then click the device name. A protocol page appears, which displays traffic and protocol activity for the selected device.
  4. Select Overview in the left pane below the device name.
  5. In the Manage Device section in the upper right corner of the page, click Properties.
  6. Click Display custom name.
  7. Type a custom name in the field.
  8. Click Save.

Change a device role

Based on the type of traffic and protocol activity associated with a device, the ExtraHop system can automatically assign a role to a device, such as database or file server, to classify device behavior. You can add or change a device role at anytime.

  1. Log into the Web UI on the Discover or Command appliance.
  2. Find a device and then click the device name. A protocol page appears, which displays traffic and protocol activity for the selected device.
  3. Select Overview in the left pane below the device name.
  4. In the Manage Device section in the upper right corner of the page, click Properties.
  5. In the Device Role section, click the drop-down list and select one of the following roles:

    Gateway: Assign to a device that acts a router or gateway. The ExtraHop system automatically assigns the gateway role to an L2 device with a large amount of unique IP addresses (past a certain threshold) are associated with that device. Gateway device names include the router name (for example, “Cisco B1B500”). Unlike an L2 parent device, Gateway devices are a type of L2 device that is counted against a device limit.

    Database (DB) server: Assign to a device when there are database responses sent from this device.

    File server: Assign to a device when there are NFS and CIFS responses sent from this device.

    Web (WWW) Server: Assign to a device when there are observed HTTP responses sent from this device.

    Auto (Default): Assign to a device when the traffic does not clearly identify a single role.

    Load balancer: Assign to a device to classify the device as a reverse proxy that distributes traffic across multiple servers. The ExtraHop system does not automatically assign the Load balancer role to a device.

    Firewall: Assign to a device that monitors incoming and outgoing network traffic and blocks traffic according to security rules. The ExtraHop system does not automatically assign the Firewall role to a device.

  6. Click Save.

Add a device tag

Device tags are user-defined labels that you can attach to a device. Tags can help differentiate devices in the ExtraHop system that share a common attribute or characteristic. You can then search for devices or create dynamic device groups based on the device tag.

Device tags can only be created and added to individual devices from a device protocol page.

  1. Log into the Web UI on the Discover or Command appliance.
  2. Click Metrics and then click Devices in the left pane.
  3. Find a device and then click the device name. A protocol page appears, which displays traffic and protocol activity for the selected device.
  4. Select Overview in the left pane below the device name.
  5. In the Manage Device section in the upper right corner of the page, click Properties.
  6. Click the Tags tab.
  7. In the Add Device Tags section, click the drop-down list.
  8. Select a device tag from the list, or type to filter the list of device tags. If the device tag name does not exist, you can create a new tag by completing the following steps:
    1. Type a name for the new device tag. The label, New Tag, appears next to the new name.
    2. Press Enter.
  9. Click Save.
    You can remove a device tag from a device by repeating steps 1-4 and then selecting the red x icon next to the tag. To permanently delete a tag from the ExtraHop system, see Rename a device tag.

Rename a device tag

  1. Log into the Web UI on the Discover or Command appliance.
  2. Click the System Settings icon and then click Device Tags.
  3. Click the device tag name. The Tag Properties window opens.
  4. To rename the device tag, type a new name in the Name field. Then click the red x icon.
  5. Click OK.
    Note:To delete a device tag, select the checkbox next to the device tag and then click Delete.
Published 2017-08-14 22:08