RevealX Enterprise Console Administration Guide

You can view the Active Device Count and Limit chart to monitor whether your active device count has exceeded the licensed limit.

1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
2. From the Status and Diagnostics section, click Active Device Count and Limit to view the chart.

You must configure an email server and sender before the ExtraHop system can send alert notifications, System Health notifications, or scheduled reports.

1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
2. In the Network Settings section, click Notifications.
3. Click Email Server and Sender.
4. In the SMTP Server field, type the IP address or hostname for the outgoing SMTP mail server.
   The SMTP server is the fully qualified domain name (FQDN) or IP address of an outgoing mail server that is accessible from the ExtraHop system. If the DNS server is set, then the SMTP server can be a FQDN, otherwise you must type an IP address.
5. In the SMTP Port field, type the port number for SMTP communication.
   Port 25 is the default value for SMTP, and port 465 is the default value for TLS encrypted SMTP.
6. From the Encryption drop-down menu, select one of the following encryption methods:

   None

   SMTP communication is not encrypted.

   TLS

   SMTP communication is encrypted through the Secure Socket Layer/Transport Layer Security protocol.

   STARTTLS

   SMTP communication is encrypted through STARTTLS.

7. In the Alert Sender Address field, type the email address for the notification sender.

   Note:

   The displayed sender address might be changed by the SMTP server. When sending through a Google SMTP server, for example, the sender email is changed to the username supplied for authentication, instead of the originally entered sender address.

8. (Optional): Select the Validate SSL Certificates checkbox to enable certificate validation.
   If you select this option, the certificate on the remote endpoint is validated against the root certificate chains specified by the trusted certificates manager. Note that the host name specified in the certificate presented by the SMTP server must match the hostname specified in your SMTP configuration or validation will fail. In addition, you must configure which certificates you want to trust on the Trusted Certificates page. For more information, see Add a trusted certificate to your ExtraHop system.
9. In the Report Sender Address field, type the email address responsible for sending the message.
   This field is only applicable when sending scheduled reports from an ExtraHop console or RevealX 360.
10. Select the Enable SMTP authentication checkbox.
11. In the Username and Password fields, type the SMTP server setup credentials.
12. (Optional): Click Test Settings, type your email address (50 characters maximum), and then click Send.
    You should receive an email message with the subject title ExtraHop Test Email.
13. Click Save.

Add a list of email addresses to a group, then select the group when you configure email settings to send System Health Notifications, an alert, or a scheduled report. Although you can specify individual email addresses, email groups are an effective way to manage your recipient list.

1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
2. In the Network Settings section, click Notifications.
3. Click Email Notification Groups.
4. Click Add Group.
5. In the Group Info section, configure the following information:

   Name: Type a name for the email group.

   System Health Notifications: Select this checkbox if you want the email group to receive system alerts that are generated under conditions such as:

   • A virtual disk is in a degraded state.
   • A physical disk is in a degraded state or has an increasing error count.
   • A necessary disk partition is missing for firmware, datastore, or packet capture data.
   • A device could not reconnect to ExtraHop Cloud Services.
   • A license is expired or expiring soon.
   • A backup for customizations and resources has failed.

6. In the Email Addresses text box, type the recipient email addresses that should receive the emails sent to this group. Email addresses can be entered one per line or separated by a comma, semicolon, or space. Email addresses are checked only for [name]@[company].[domain] format validation. There must be at least one email address in this text box for the group to be valid.
7. Click Save.

The state of the network can be monitored through the Simple Network Management Protocol (SNMP). SNMP collects information by polling devices on the network. SNMP enabled devices can also send alerts to SNMP management stations. SNMP communities define the group where devices and management stations running SNMP belong, which specifies where information is sent. The community name identifies the group.

1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
2. In the Network Settings section, click Notifications.
3. Under Notifications, click SNMP.
4. On the SNMP Settings page, in the SNMP Monitor field, type the hostname for the SNMP trap receiver.
   Separate multiple hostnames with commas.
5. In the SNMP Community field, type the SNMP community name.
6. In the SNMP Port field, type the SNMP port number for your network that is used by the SNMP agent to respond back to the source port on the SNMP manager.
   The default response port is 162.
7. (Optional): Click Test Settings to verify that your SNMP settings are correct.
   If the settings are correct, you should see an entry in the SNMP log file on the SNMP server similar to this example, where 192.0.2.0 is the IP address of your ExtraHop system and 192.0.2.255 is the IP address of the SNMP server:
   A response similar to this example displays:

   Connection from UDP: [192.0.2.0]:42164->[ 192.0.2.255]:162

   Copy
8. Click Save.

The syslog export option enables you to send alerts or audit logs from an ExtraHop system to any remote system that receives syslog input for long-term archiving and correlation with other sources.

1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
2. In the Network Settings section, click Notifications, then click Syslog.
3. In the Destination field, type the IP address of the remote syslog server.
4. From the Protocol drop-down menu, select TCP or UDP.
   This option specifies the protocol over which the information will be sent to your remote syslog server.
5. In the Port field, type the port number for your remote syslog server.
   The default value is 514.
6. Click Test Settings to verify that your syslog settings are correct.
   If the settings are correct, you should see an entry in the syslog log file on the syslog server similar to the following:

   Jul 27 21:54:56 extrahop name="ExtraHop Test" event_id=1

   Copy
7. Click Save.
8. (Optional): Modify the format of syslog messages.
   By default, syslog messages are not compliant with RFC 3164 or RFC 5424. However, you can format syslog messages to be compliant by modifying the running configuration file.
   1. Click Admin.
   2. Click Running Config (Unsaved Changes).
   3. Click Edit Config.
   4. Add an entry under syslog_notification, where the key is rfc_compliant_format and the value is either rfc5424 or rfc3164.
      The syslog_notification section should look similar to the following code:

          "syslog_notification": {
              "syslog_destination": "192.168.0.0",
              "syslog_ipproto": "udp",
              "syslog_port": 514,
              "rfc_compliant_format": "rfc5424"
          }

      Copy
   5. Click Update.
   6. Click Done.
9. (Optional): Modify the time zone referenced in syslog timestamps.
   By default, syslog timestamps reference UTC time. However, you can modify timestamps to reference the ExtraHop system time by modifying the running configuration file.
   1. Click Admin.
   2. Click Running Config (Unsaved Changes).
   3. Click Edit Config.
   4. Add an entry under syslog_notification where the key is syslog_use_localtime and the value is true.
      The syslog_notification section should look similar to the following code:

          "syslog_notification": {
              "syslog_destination": "192.168.0.0",
              "syslog_ipproto": "udp",
              "syslog_port": 514,
              "syslog_use_localtime": true
          }

      Copy
   5. Click Update.
   6. Click Done.

You must upload a .pem file that includes both a private key and either a self-signed certificate or a certificate-authority certificate.

1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
2. In the Network Settings section, click TLS Certificate.
3. Click Manage certificates to expand the section.
4. Click Choose File and navigate to the certificate that you want to upload.
5. Click Open.
6. Click Upload.
7. Save the running configuration file

1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
2. In the Network Settings section, click TLS Certificate.
3. Click Manage certificates to expand the section.
4. Click Build SSL self-signed certificate based on hostname.
5. On the Generate Certificate page, click OK to generate the TLS self-signed certificate.

   Note:

   The default hostname is extrahop.

6. Save the running configuration file

A certificate signing request (CSR) is a block of encoded text that is given to your Certificate Authority (CA) when you apply for a TLS certificate. The CSR is generated on the ExtraHop system where the TLS certificate will be installed and contains information that will be included in the certificate such as the common name (domain name), organization, locality, and country. The CSR also contains the public key that will be included in the certificate. The CSR is created with the private key from the ExtraHop system, making a key pair.

1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
2. In the Network Settings section, click TLS Certificate.
3. Click Manage certificates and then click Export a Certificate Signing Request (CSR).
4. In the Subject Alternative Names section, type the DNS name of the ExtraHop system.
   You can add multiple DNS names and IP addresses to be protected by a single TLS Certificate.
5. In the Subject section, complete the following fields.
   Only the Common Name field is required.

   Field	Description	Examples
   Common Name	The fully qualified domain name (FQDN) of the ExtraHop system. The FQDN must match one of the Subject Alternative Names.	*.example.com discover.example.com
   E-mail Address	The email address of the primary contact for your organization.	webmaster@example.com
   Organizational Unit	The division of your organization handling the certificate.	IT Department
   Organization	The legal name of your organization. This entry should not be abbreviated and should include suffixes such as Inc, Corp, or LLC.	Example, Inc.
   Locality/City	The city where your organization is located.	Seattle
   State/Province	The state or province where your organization is located. This entry should not be abbreviated.	Washington
   Country Code	The two-letter ISO code for the country where your organization is located.	US

6. Click Export.
   The CSR file is automatically downloaded to your computer.

1. In the Access Settings section, click Support Access.
2. Click Generate SSH Key.
3. Copy the encrypted key from the text box and email the key to your ExtraHop representative.
4. Click Done.

To prevent SSH access to the ExtraHop system with an existing SSH key, you can revoke the current SSH key. A new SSH key can also be regenerated if needed.

1. In the Access Settings section, click Support Access.
2. Click Generate SSH Key.
3. Choose one of the following options:
   • Click Regenerate SSH Key and then click Regenerate.

     Copy the encrypted key from the text box and email the key to your ExtraHop representative and then click Done.

   • Click Revoke SSH Key to prevent SSH access to the system with the current key.

By adding a local user account, you can provide users with direct access to your ExtraHop system and restrict their privileges as needed by their role in your organization.

1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
2. In the Access Settings section, click Users.
3. Click Add User.
4. In the Personal Information section, in the Login ID field, type the username that users will log in to the sensor with, which cannot contain any spaces.
   For example, adalovelace.
5. In the Full Name field, type a display name for the user.
   The name can contain spaces. For example, Ada Lovelace.
6. In the Password field, type the password for this account.

   Note:

   On sensors and consoles, the password must meet the criteria specified by the global password policy. On ExtraHop recordstores and packetstores, passwords must be 5 characters or more.

7. In the Confirm Password field, re-type the password from the Password field.
8. In the Authentication Type section, select Local.
9. In the User Type section, select the type of privileges for the user.
   • System and access administration privileges enables full read and write access to the ExtraHop system, including Administration settings.
   • Limited privileges enable you to select from a subset of privileges and options.

   Note:

   For more information, see the User privileges section.

10. Click Save.

Add a user account for LDAP or SAML users when you want to provision the remote user before that user logs in to the ExtraHop system. After the user is added to the system, you can add them to local groups or share items directly with them before they log in through the LDAP or SAML provider.

1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
2. In the Access Settings section, click Users.
3. Click Add User.
4. In the Personal Information section, type the following information:

   Login ID: The email address that the user logs in to their LDAP or SAML SSO identity provider with.

   Note:

   Only lowercase email addresses are supported for remote users.

   Full Name: The first and last name of the user.

5. In the Authentication Type section, select Remote.
6. Click Save.

The ExtraHop system supports the Lightweight Directory Access Protocol (LDAP) for authentication and authorization. Instead of storing user credentials locally, you can configure your ExtraHop system to authenticate users remotely with an existing LDAP server. Note that ExtraHop LDAP authentication only queries for user accounts; it does not query for any other entities that might be in the LDAP directory.

1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
2. In the Access Settings section, click Remote Authentication.
3. From the Remote authentication method drop-down menu, select LDAP and then click Continue.
4. In the Hostname field, type the hostname or IP address of the LDAP server. If you are configuring a hostname, make sure that the DNS entry of the ExtraHop system is properly configured.
5. In the Port field, type the port number on which the LDAP server is listening.
6. From the Server Type drop-down menu, select Posix or Active Directory.
7. (Optional): In the Bind DN field, type the bind DN. The bind DN is the user credentials that allow you to authenticate with the LDAP server to perform the user search. The bind DN must have list access to the base DN and any OU, groups, or user account required for LDAP authentication. If this value is not set, then an anonymous bind is performed. Note that anonymous binds are not enabled on all LDAP servers.
8. (Optional): In the Bind Password field, type the bind password. The bind password is the password required when authenticating with the LDAP server as the bind DN specified above. If you are configuring an anonymous bind, leave this field blank. In some cases, an unauthenticated bind is possible, where you supply a Bind DN value but no bind password. Consult your LDAP administrator for the proper settings.
9. From the Encryption drop-down menu, select one of the following encryption options.

   None: This options specifies cleartext TCP sockets. All passwords are sent across the network in cleartext in this mode.

   LDAPS: This option specifies LDAP wrapped inside TLS.

   StartTLS: This option specifies TLS LDAP. (TLS is negotiated before any passwords are sent.)

10. Select Validate SSL Certificates to enable certificate validation. If you select this option, the certificate on the remote endpoint is validated against the root certificates as specified by the trusted certificates manager. You must configure which certificates you want to trust on the Trusted Certificates page. For more information, see Add a trusted certificate to your ExtraHop system.
11. In the Refresh Interval field, type a time value or leave the default setting of 1 hour.
    The refresh interval ensures that any changes made to user or group access on the LDAP server are updated on the ExtraHop system.
12. In the Base DN field, type the base distinguished name (DN).
    The Base DN is the point from where a server will search for users. Only user groups within the base DN can access the ExtraHop system. The users can be direct members of the base DN or nested within an OU within the base DN if the Whole Subtree option is selected for the Search Scope specified below.

    Important:

    For recordstores and packetstores, all users that can access the recordstore or packetstore are granted administrative privileges. You can further restrict access with the Full Access DN field.

13. In the Search Filter field, type a search filter.
    Search filters enable you to define search criteria when searching the LDAP directory for user accounts.

    Important:

    The ExtraHop system automatically adds parentheses to wrap the filter and will not parse this parameter correctly if you add parentheses manually. Add your search filters in this step and in step 5b, similar to the following example: cn=atlas* |(cn=EH-*)(cn=IT-*) Copy In addition, if your group names include the asterisk (*) character, the asterisk must be escaped as \2a. For example, if your group has a CN called test*group, type cn=test\2agroup in the Search Filter field.

14. From the Search Scope drop-down menu, select one of the following options.
    Search scope specifies the scope of the directory search when looking for user entities.

    Whole subtree: This option looks recursively under the group DN for matching users.

    Single level: This option looks for users that exist in the base DN only; not any subtrees.

15. For recordstores and packetstores, in the Full Access DN field, type a DN within the base DN.
    This option further restricts recordstore or packetstore access to only the specified DN.

    Important:

    All users that can access the recordstore or packetstore are granted administrative privileges.

16. (Optional): For sensors and consoles, select the Import user groups from LDAP server checkbox and configure the following settings to import user groups.

    Note:

    Importing LDAP user groups enables you to share dashboards with those groups. The imported groups appear on the User Group page in the Administration settings.

    1. In the Base DN field, type the base DN.
       The Base DN is the point from where a server will search for user groups. The base DN must contain all user groups that will have access to the ExtraHop system. The user groups can be direct members of the base DN or nested within an OU within the base DN if the Whole Subtree option is selected for the Search Scope specified below.
    2. In the Search Filter field type a search filter.
       Search filters enable you to define search criteria when searching the LDAP directory for user groups.

       Important:

       For group search filters, the ExtraHop system implicitly filters on the objectclass=group, and so objectclass=group should not be added to this filter.

    3. From the Search Scope drop-down menu, select one of the following options.
       Search scope specifies the scope of the directory search when looking for user group entities.

       Whole subtree: This option looks recursively under the base DN for matching user groups.

       Single level: This option looks for user groups that exist in the base DN; not any subtrees.

17. Click Test Settings.
    If the test succeeds, a status message appears near the bottom of the page. If the test fails, click Show details to see a list of errors. You must resolve any errors before you continue.
18. Click Save and Continue.

You can configure your ExtraHop system to enable users to log in to the system through the Google identity management service.

The ExtraHop system supports Remote Authentication Dial In User Service (RADIUS) for remote authentication and local authorization only. For remote authentication, the ExtraHop system supports unencrypted RADIUS and plaintext formats.

1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
2. In the Access Settings section, click Remote Authentication.
3. From the Remote authentication method drop-down menu, select RADIUS and then click Continue.
4. On the Add RADIUS Server page, type the following information:

   Host

   The hostname or IP address of the RADIUS server. Make sure that the DNS of the ExtraHop system is properly configured if you specify a hostname.

   Secret

   The shared secret between the ExtraHop system and the RADIUS server. Contact your RADIUS administrator to obtain the shared secret.

   Timeout

   The amount of time in seconds that the ExtraHop system waits for a response from the RADIUS server before attempting the connection again.

5. Click Add Server.
6. (Optional): Add additional servers as needed.
7. Click Save and Finish.
8. From the Privilege assignment options drop-down menu, choose one of the following options:
   • Remote users have full write access

     This option grants remote users full write access to the ExtraHop system. In addition, you can grant additional access for packet downloads, TLS session keys, NDR module access, and NPM module access.

   • Remote users have full read-only access

     This option grants remote users read-only access to the ExtraHop system. In addition, you can grant additional access for packet downloads, TLS session keys, NDR module access, and NPM module access.

9. (Optional): Configure packet and session key access. Select one of the following options to allow remote users to download packet captures and TLS session keys.
   • No access
   • Packet slices only
   • Packet headers only
   • Packets only
   • Packets and session keys
10. (Optional): Configure NDR and NPM module access (On sensors and consoles only).
    • No access
    • Full access
11. Click Save and Finish.
12. Click Done.

The ExtraHop system supports Terminal Access Controller Access-Control System Plus (TACACS+) for remote authentication and authorization.

1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
2. In the Access Settings section, click Remote Authentication.
3. From the Remote authentication method drop-down menu, select TACACS+, and then click Continue.
4. On the Add TACACS+ Server page, type the following information:

   Host: The hostname or IP address of the TACACS+ server. Make sure that the DNS of the ExtraHop system is properly configured if you are entering a hostname.

   Secret: The shared secret between the ExtraHop system and the TACACS+ server. Contact your TACACS+ administrator to obtain the shared secret.

   Note:

   The secret cannot include the number sign (#).

   Timeout: The amount of time in seconds that the ExtraHop system waits for a response from the TACACS+ server before attempting to connect again.

5. Click Add Server.
6. (Optional): Add additional servers as needed.
7. Click Save and Finish.
8. For recordstores and packetstores, click Done and then skip to configuring the TACACS+ server. For sensors and consoles, complete the remaining steps below.
9. From the Permission assignment options drop-down menu, choose one of the following options:
   • Obtain privileges level from remote server

     This option allows remote users to obtain privilege levels from the remote server. You must also configure permissions on the TACACS+ server.

   • Remote users have full write access

     This option grants remote users full write access to the ExtraHop system. In addition, you can grant additional access for packet downloads, TLS session keys, NDR module access, and NPM module access.

   • Remote users have full read-only access

     This option grants remote users read-only access to the ExtraHop system. In addition, you can grant additional access for packet downloads, TLS session keys, NDR module access, and NPM module access.

10. (Optional): Configure packet and session key access. Select one of the following options to allow remote users to download packet captures and TLS session keys.
    • No access
    • Packet slices only
    • Packet headers only
    • Packets only
    • Packets and session keys
11. (Optional): Configure NDR and NPM module access (On sensors and consoles only).
    • No access
    • Full access
12. Click Save and Finish.
13. Click Done.

Users with system and access administration privileges can configure whether users can generate API keys for the ExtraHop system. You can allow only local users to generate keys, or you can also disable API key generation entirely.

1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
2. In the Access Settings section, click API Access.
3. In the Manage API Access section, select one of the following options:
   • Allow all users to generate an API key: Local and remote users can generate API keys.
   • Only local users can generate an API key: Remote users cannot generate API keys.
   • No users can generate an API key: No API keys can be generated by any user.
4. Click Save Settings.

Cross-origin resource sharing (CORS) allows you to access the ExtraHop REST API across domain-boundaries and from specified web pages without requiring the request to travel through a proxy server.

1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
2. In the Access Settings section, click API Access.
3. In the CORS Settings section, specify one of the following access configurations.
   • To add a specific URL, type an origin URL in the text box, and then click the plus (+) icon or press ENTER.

     The URL must include a scheme, such as HTTP or HTTPS, and the exact domain name. You cannot append a path; however, you can provide a port number.

   • To allow access from any URL, select the Allow API requests from any Origin checkbox.

     Note:

     Allowing REST API access from any origin is less secure than providing a list of explicit origins.

4. Click Save Settings and then click Done.

You must generate an API key before you can perform operations through the ExtraHop REST API. Keys can be viewed only by the user who generated the key or by users with system and access administration privileges. After you generate an API key, add the key to your request headers or the ExtraHop REST API Explorer.

1. In the Access Settings section, click API Access.
2. In the Generate an API Key section, type a description for the new key, and then click Generate.
3. Scroll down to the API Keys section and copy the API key that matches your description.

You can upload your own GeoIP database to the ExtraHop system to ensure that you have the latest version of the database or if your database contains internal IP addresses that only you or your company know the location of.

1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
2. In the System Configuration section, click Geomap Data Source.
3. Click GeoIP Database.
4. In the City-level Database section, select Upload New Database.
5. Click Choose File and navigate to the new city-level database file on your computer.
6. Click Save.

You can override missing or incorrect IP addresses that are in the GeoIP database. You can enter a comma-delimited list or tabbed list of overrides into the text box.

1. Under System Configuration, click Geomap Data Source.
2. Click IP Location Override.
3. In the text box, type or paste a tab or comma-delimited list of overrides in the following format:

   IP address, latitude, longitude, city, state or region, country name, ISO
   alpha-2 country code

   Copy

   For example:

   10.10.113.0/24, 38.907231, -77.036464, Washington, DC, United States, US
   10.10.225.25, 47.6204, -122.3491, Seattle, WA, United States, US

   Copy
4. Click Save.

When you modify any of the system configuration settings on an ExtraHop system, you must confirm the updates by saving the running configuration file. If you do not save the settings, the changes are lost when your ExtraHop system restarts.

1. Click View and Save Changes.
   
2. Review the comparison between the old running configuration and the current (unsaved) running configuration, and then select from the following options:
   • If the changes are correct, click Save.
   • If the changes are not correct, click Cancel and then revert the changes by clicking Revert config.

You can download the running configuration file to your workstation. You can open this text file and make changes to it locally, before copying those changes into the Running Config window.

1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
2. In the Appliance Settings section, click Running Config.
3. Click Download config as a file.

By default, the ExtraHop system synchronizes the system time through the *.extrahop.pool.ntp.org network time protocol (NTP) servers. If your network environment prevents the ExtraHop system from communicating with these time servers, you must configure an alternate time server source.

1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
2. In the Appliance Settings section, click System Time.
3. Click Configure Time.
4. From the Select time zone drop-down menu, select your time zone.
5. Click Save and Continue.
6. On the Time Setup page, select one of the following options:
   • Set time manually

     Note:

     You cannot manually set the time for sensors that are managed by a console or RevealX 360.

   • Set time with NTP server
7. Select Set time with NTP server and then click Select.
   The ExtraHop time servers, 0.extrahop.pool.ntp.org, 1.extrahop.pool.ntp.org, 2.extrahop.pool.ntp.org, and 3.extrahop.pool.ntp.org appear in the first four Time Server fields by default.
8. In the Time Server fields, type the IP address or fully qualified domain name (FQDN) for the time servers.
   You can specify up to nine time servers.

   Tip:	After adding the fifth time server, click Add Server to display up to four additional timer server fields.

9. Click Done.

When you purchase a new protocol module, service, or feature, the updated license is automatically available on the ExtraHop system. However you must apply the updated license to the system through the Administration settings for the new changes to take effect.

1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
2. In the Appliance Settings section, click License.
   A message appears about the availability of your new license.
   
   
3. Click Apply new license.
   The capture process restarts, which might take a few minutes.

   Note:

   If your license is not automatically updated, troubleshoot licensing server connectivity or contact ExtraHop Support.

If ExtraHop Support provides you with a license file, you can install this file on your appliance to update the license.

1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
2. In the Appliance Settings section, click License.
3. Click Manage License.
4. Click Update.
5. In the Enter License text box, enter the licensing information for the module.
   Paste the license text provided to you by ExtraHop Support. Be sure to include all of the text, including the BEGIN and END lines, as shown in the example below:

   -----BEGIN EXTRAHOP LICENSE-----
   serial=ABC123D;
   dossier=1234567890abcdef1234567890abcdef;
   mod_cifs=1;
   mod_nfs=1;
   mod_amf=0;
   live_capture=1;
   capture_upload=1;
   ...
   ssl_decryption=0;
   +++;
   ABCabcDE/FGHIjklm12nopqrstuvwXYZAB12345678abcde901abCD;
   12ABCDEFG1HIJklmnOP+1aA=;
   =abcd;
   -----END EXTRAHOP LICENSE-----

   Copy
6. Click Update.

1. In the system health email notification, note which machine has the problematic disk.
2. Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
3. In the Appliance Settings section, click Disks.
4. Under the section for the disk type (for example, Datastore), find the problematic disk and note the slot number.
   Click RAID Disk Details to display more details.

   Important:

   Keep the failed disk until data has been successfully copied to the new disk.

5. Insert an identical disk into an available slot.
   The system detects the new disk and adds a new row (Disk Error Action) with a link to replace the bad disk.
6. Verify the new disk information:
   • Under Unused Disks on the Disk Details page, verify that the new disk is the same size, speed, and type as the disk being replaced.

   • Mouse over the old and new disks in the Drive Map. The new disk displays the message "Unconfigured(good), Spun Up."

     
7. Under the section for the disk type, click Replace with Disk in slot #n in the Disk Error Action row.

   The data begins copying over. The Copy Status row displays the progress. Mousing over the disk in the Drive Map shows the status.

   
8. After copying is complete, make sure that the copy process was successful:
   • Settings button and Settings page no longer display error messages.
   • Disk page shows the old disk under the Unused Disk section
9. Remove the old disk.

   The Drive Map now shows the new disk in green.

   

1. In the Appliance Settings section, click Disks.
   If the Drive Map shows the slot where the SSD is installed in red, you must replace the SSD.
2. Insert the SSD drive into the slot where the previous SSD was installed and wait for the LED on the drive to turn green.
3. In the Administration settings, refresh the browser.

   The Drive Map shows the SSD slot in yellow because the drive is not configured.

   
4. Next to SSD Assisted Packet Capture, click Enable.
   
5. Click OK to add the packet capture drive.

   The page refreshes and the Drive Map shows the SSD as green and the Status changes to Online, Spun Up.

   
   
   

1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
2. In the Records section, click Recordstore.
3. Select Enable BigQuery as the recordstore.

   Important:

   If you are migrating to BigQuery from a connected ExtraHop recordstore, you will no longer be able to access records stored on the recordstore.

4. In the Project ID field, type the ID for your BigQuery project.
   You can find the project ID in the BigQuery API console.
5. In the JSON Credential File field, click Choose File and select one of the following files:
   • The credential file saved from your BigQuery service account.

     See the Google Cloud documentation on how to create a service account and generate a service account key.

   Important:

   Create your service account with the following BigQuery roles: BigQuery Data Editor BigQuery Data Viewer BigQuery User

   • The configuration file from your workload identity pool.
6. (Optional): If you chose the configuration file from your workload identity pool in the previous step, select Authenticate through local Identity Provider for Workload Identity Federation and type the credentials from your identity provider in the following fields:
   • Token URL
   • Client ID
   • Client Secret
7. Click Test Connection to verify that your sensor can communicate with the BigQuery server.
8. Click Save.

If you have an ExtraHop console connected to your ExtraHop sensors, you can configure and manage the recordstore settings on the sensor, or transfer the management of the settings to the console. Transferring and managing the recordstore settings on the console enables you to keep the recordstore settings up to date across multiple sensors.

1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
2. In the Records section, click Recordstore.
3. From the Recordstore settings drop-down menu, select the console and then click Transfer Ownership.
   If you later decide to manage the settings on the sensor, select this sensor from the Recordstore settings drop-down menu and then click Transfer Ownership.

1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
2. In the Records section, click Recordstore.
3. Select Enable Splunk as the recordstore.
4. In the Record Ingest Target section, complete the following fields:

   Splunk Ingest Host: The hostname or IP address of your Splunk server.

   HTTP Event Collector Port: The port for the HTTP Event Collector to send records over.

   HTTP Event Collector Token: The authentication token you created in Splunk for the HTTP Event Collector.

5. In the Record Query Target section, complete the following fields:

   Splunk Query Host: The hostname or IP address of your Splunk server.

   REST API Port: The port to send record queries over.

   Authentication Method: The authentication method, which depends on your version of Splunk.

   For Splunk versions later than 7.3.0, select Authenticate with token, and then paste your Splunk authentication token. For instructions on how to create an authentication token, see the Splunk documentation.

   For Splunk versions earlier than 7.3.0, select Authenticate with username and password, and then type your Splunk credentials.

6. Clear the Require certificate verification checkbox if your connection does not require a valid TLS certificate.

   Note:

   Secure connections to the Splunk server can be verified through trusted certificates that you upload to the ExtraHop system.

7. In the Index Name field, type the name of the Splunk index where you want to store records.
   The default index on Splunk is called main, however, we recommend that you create a separate index for your ExtraHop records, and type the name of that index. For instructions for creating an index, see the Splunk documentation.
8. (ExtraHop sensor only) Click Test Connection to verify that the ExtraHop system can reach your Splunk server.
9. Click Save.

If you have an ExtraHop console connected to your ExtraHop sensors, you can configure and manage the recordstore settings on the sensor, or transfer the management of the settings to the console. Transferring and managing the recordstore settings on the console enables you to keep the recordstore settings up to date across multiple sensors.

1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
2. In the Records section, click Recordstore.
3. From the Recordstore settings drop-down menu, select the console and then click Transfer Ownership.
   If you later decide to manage the settings on the sensor, select this sensor from the Recordstore settings drop-down menu and then click Transfer Ownership.