Users can access the ExtraHop appliance in three ways: through a set of pre-configured user accounts, through local user accounts configured on the appliance, or through remote user accounts configured on existing authentication servers, such as LDAP, SAML, Radius, and TACACS+.
This topic is about default and local accounts. See Remote Authentication to learn how to configure remote accounts.
- This account provides full system read and write privileges on the Web UI, Admin UI, and Shell, which is the ExtraHop command-line interface (CLI). On physical appliances, the default password for this account is the service tag number on the front of the appliance. On virtual appliances, the default password is default.
- The shell account, by default, has access to non-administrative shell commands in the ExtraHop CLI. On physical appliances, the default password for this account is the service tag number on the front of the appliance. On virtual appliances, the default password is default.
|Note:||The default ExtraHop password for either account when deployed in Amazon Web Services (AWS) is the string of numbers after the -i in the instance ID.|
ExtraHop appliances supports remote authentication for user access. Remote authentication enables organizations that have authentication systems such as LDAP (OpenLDAP or Active Directory, for example), SAML, RADIUS, or TACACS+ to enable all or a subset of their users to log into the appliance with their existing credentials. SAML single sign-on authentication is only available on Command and Discover appliances.
Centralized authentication provides the following benefits:
- User password synchronization.
- Automatic creation of ExtraHop accounts for users without administrator intervention.
- Management of ExtraHop privileges based on user groups.
- Administrators can grant access to all known users or restrict access by applying LDAP filters.
If you choose to auto-provision users when you configure SAML authentication, then the user is automatically added to the list of local users when they log in for the first time. However, you can create a remote SAML user account on the ExtraHop appliance when you want to provision a remote user before that user has logged into the appliance. Privileges are assigned to the user by the provider. After the user is created, you can add them to local user groups.
User groups enable you to manage access to shared content by group instead of by individual user. Dashboards and activity maps can be shared with a user group, and any user who is added to the group automatically has access. You can create a local user group—which can include remote and local users. Alternatively, if your appliance is configured for remote authentication through LDAP, you can configure settings to import your LDAP user groups.
- Click Create User Group to create a local group. The user group appears in the list. Then, select the checkbox next to the user group name and select users from the Filter users... drop-down list. Click Add Users to Group.
- (LDAP only) Click Refresh All User Groups or select multiple LDAP user groups and click Refresh Users in Groups.
- Click Reset User Group to remove all shared content from a selected user group. If the group no longer exists on the remote LDAP server, the group is removed from the user group list.
- Click Enable User Group or Disable User Group to control whether any group member can access shared content for the selected user group.
- Click Delete User Group to remove the selected user group from the appliance.
- View the following properties for listed user groups:
- Group Name
- Displays the name of the group. To view the members in the group, click the group name.
- Displays Local or Remote as the type of user group.
- Displays the number of users in the group.
- Shared Content
- Displays the number of user-created dashboards and activity maps that are shared with the group.
- Displays whether the group is enabled or disabled on the appliance. When the status is Disabled, the user group is considered empty when performing membership checks; however, the user group can still be specified when sharing content.
- Members Refreshed (LDAP only)
- Displays the amount of time elapsed since the group membership was refreshed. User
groups are refreshed under the following conditions:
- Once per hour, by default. The refresh interval setting can be modified on the page.
- An administrator refreshes a group by clicking Refresh All User Groups or Refresh Users in Group, or programmatically through the REST API. You can refresh a group from the User Group page or from within the Member List page.
- A remote user logs into the ExtraHop Web UI or Admin UI for the first time.
- A user attempts to load a shared dashboard that they do not have access to.
Administrators determine the level of access and functionality users have with the ExtraHop Web and Admin UIs. In addition to setting the privilege level for the user, you can add certain options that can apply to any user privilege level.
For information about user privileges for the REST API, see the REST API Guide.
Set the privilege level for your user to determine which areas of the ExtraHop appliance they can access.
|Unlimited||Full Write||Limited Write||Personal Write||Full Read-Only||Restricted Read-Only|
|Create, view, and load shared activity maps||Y||Y||Y||Y||Y||N|
|Save activity maps||Y||Y||Y||Y||N||N|
|Share activity maps||Y||Y||Y||N||N||N|
|View alert history||Y||Y||Y||Y||Y||N|
|Create and modify alerts||Y||Y||N||N||N||N|
|Create a bundle||Y||Y||N||N||N||N|
|Upload and apply a bundle||Y||Y||N||N||N||N|
|View list of bundles||Y||Y||Y||Y||Y||N|
|Create and modify custom pages||Y||Y||N||N||N||N|
|View and organize dashboards||Y||Y||Y||Y||Y||Y|
|Create and modify dashboards||Y||Y||Y||Y||N||N|
|View detections and provide feedback||Y||Y||Y||Y||Y||N|
|View Analysis Priorities page||Y||Y||Y||Y||Y||N|
|Add and modify analysis levels for groups||Y||Y||N||N||N||N|
|Add devices to a watchlist||Y||Y||N||N||N||N|
|Transfer priorities management||Y||Y||N||N||N||N|
|Create and modify device groups||Y||Y||N||N||N||N|
|Records (Explore appliance)|
|View record queries||Y||Y||Y||Y||Y||N|
|View record formats||Y||Y||Y||Y||Y||N|
|Create, modify, and save record queries||Y||Y||N||N||N||N|
|Create, modify, and save record formats||Y||Y||N||N||N||N|
|Scheduled Reports (Command appliance)|
|Create, view, and manage scheduled reports||Y||Y||Y||N||N||N|
|Create and modify triggers||Y||Y||N||N||N||N|
|Access the ExtraHop Admin UI||Y||N||N||N||N||N|
|Connect to other appliances||Y||N||N||N||N||N|
|Manage other appliances (Command appliance)||Y||N||N||N||N||N|