What's New

While release notes provide a comprehensive view of our release updates, here is a preview of our most exciting features in ExtraHop 9.9.

Users in Detections

Usernames are now included in detection participant information when available. You can filter detections by user, see specific users that are linked to detections in detection summaries and participant information, and add a participant username as a tuning rule or detection notification criteria.

Detection Log

Detection details now contain a time-stamped log of activity associated with the detection. The detection log lists every update associated with the detection and the tuning rules associated with specific activity.

Bulk Actions

You can now add all the detections in a detection summary to an investigation. From the new Bulk Actions drop-down menu, you can track all detections in the summary or add all detections to an investigation.

Cloud-updated Device Properties

(RevealX 360 only) Added support to display cloud-updated device properties obtained from integrations configured on your ExtraHop system, such as CrowdStrike. You can filter by cloud device properties to find a device and to create a dynamic device group.

For Administrators

File Hash Lookup Links

Added the ability to configure external lookup tool links to easily look up SHA-256 file hashes for RevealX 360 and RevealX Enterprise. VirusTotal Lookup is configured by default. Configured links are displayed on Devices, Files, Records, and Detections pages.

Inactive Device Deletion

You can specify when and how the system automatically deletes inactive devices from the ExtraHop system. You can delete devices that have been inactive for a specified number of days and you can delete inactive devices after the sensor has discovered over a specified number of devices.

Login Screen Message

(RevealX Enterprise only) You can add a custom message to the login screen of your ExtraHop system to display graphics and logos and to convey information to users such as password requirements, policy statements, support links, or maintenance announcements. The login screen message supports text and graphics in Markdown syntax.

For API Developers

REST API

Added the /users/{username}/lock endpoint to the User resource, which enables you to unlock user accounts. This endpoint is accessible only if you have configured the system to automatically lock user accounts after a specified number of failed login attempts through the running configuration file.