ExtraHop Reveal(x) 360

Adds a device to the watchlist in ExtraHop.

Target: ExtraHop integration target or HTTP Endpoint for "your-tenant.api.cloud.extrahop.com" with a path of "/api/v1"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Add the device to the watchlist
[] Check if the request was successful:
[]> If it wasn't, output an error

More information about this API: https://docs.extrahop.com/current/rx360-rest-api/#watchlist

ExtraHop Reveal(x) 360 - Add Device to Watchlist

prod-nam

prod-eu

prod-apjc

Assigns a device to a static device group in ExtraHop.

Target: ExtraHop integration target or HTTP Endpoint for "your-tenant.api.cloud.extrahop.com" with a path of "/api/v1"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Assign the device to the device group
[] Check if the request was successful:
[]> If it wasn't, output an error

More information about this API: https://docs.extrahop.com/current/rx360-rest-api/#device-group

ExtraHop Reveal(x) 360 - Assign Device to Device Group

Gets an OAuth access token for the ExtraHop API. If you're using an integration-provided target for ExtraHop, you don't need to generate an access token yourself (Cisco XDR will do it for you).

Target: HTTP Endpoint for "your-extrahop-api-token-url.extrahop.com" with no path

Account Key: HTTP Basic Authentication with your client ID as the username and secret as the password

Steps:
[] Request an access token
[] Check if the request was successful:
[]> If it was, attempt to extract the token and expiration time and set the output variables
[]> If it wasn't, output an error

More information about this API: https://docs.extrahop.com/current/rx360-rest-api/#generate-a-rest-api-token

ExtraHop Reveal(x) 360 - Get Access Token

Fetches a list of observed DNS names for a specific device from ExtraHop using its device ID.

Target: ExtraHop integration target or HTTP Endpoint for "your-tenant.api.cloud.extrahop.com" with a path of "/api/v1"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Fetch the device DNS names
[] Check if the request was successful:
[]> If it was, set the output variables
[]> If it wasn't, output an error

More information about this API: https://docs.extrahop.com/current/rx360-rest-api/#device

ExtraHop Reveal(x) 360 - Get Device DNS Names

Fetches a list of devices in a specific device group from ExtraHop using a group ID.

Target: ExtraHop integration target or HTTP Endpoint for "your-tenant.api.cloud.extrahop.com" with a path of "/api/v1"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Fetch the device group's devices
[] Check if the request was successful:
[]> If it was, set the output variables
[]> If it wasn't, output an error

More information about this API: https://docs.extrahop.com/current/rx360-rest-api/#device-group

ExtraHop Reveal(x) 360 - Get Device Group Devices

Fetches a specific device group from ExtraHop using its group ID.

Target: ExtraHop integration target or HTTP Endpoint for "your-tenant.api.cloud.extrahop.com" with a path of "/api/v1"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Fetch the device group
[] Check if the request was successful:
[]> If it was, set the output variables
[]> If it wasn't, output an error

More information about this API: https://docs.extrahop.com/current/rx360-rest-api/#device-group

ExtraHop Reveal(x) 360 - Get Device Group by ID

Gets a list of device groups from ExtraHop.

Target: ExtraHop integration target or HTTP Endpoint for "your-tenant.api.cloud.extrahop.com" with a path of "/api/v1"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Request a list of device groups
[] Check if the request was successful:
[]> If it was, attempt to extract data and set the output variables
[]> If it wasn't, output an error

More information about this API: https://docs.extrahop.com/current/rx360-rest-api/#device-group

ExtraHop Reveal(x) 360 - Get Device Groups

Fetches a list of device groups a given device belongs to from ExtraHop.

Target: ExtraHop integration target or HTTP Endpoint for "your-tenant.api.cloud.extrahop.com" with a path of "/api/v1"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Fetch the device group list for the device
[] Check if the request was successful:
[]> If it was, set the output variables
[]> If it wasn't, output an error

More information about this API: https://docs.extrahop.com/current/rx360-rest-api/#device

ExtraHop Reveal(x) 360 - Get Device Groups for Device

Fetches a list of observed IP addresses for a specific device from ExtraHop using its device ID.

Target: ExtraHop integration target or HTTP Endpoint for "your-tenant.api.cloud.extrahop.com" with a path of "/api/v1"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Fetch the device IP adresses
[] Check if the request was successful:
[]> If it was, set the output variables
[]> If it wasn't, output an error

More information about this API: https://docs.extrahop.com/current/rx360-rest-api/#device

ExtraHop Reveal(x) 360 - Get Device IP Addresses

Fetches a specific device from ExtraHop using its device ID.

Target: ExtraHop integration target or HTTP Endpoint for "your-tenant.api.cloud.extrahop.com" with a path of "/api/v1"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Fetch the device
[] Check if the request was successful:
[]> If it was, set the output variables
[]> If it wasn't, output an error

More information about this API: https://docs.extrahop.com/current/rx360-rest-api/#device

ExtraHop Reveal(x) 360 - Get Device by ID

Gets a list of devices on the watchlist from ExtraHop.

Target: ExtraHop integration target or HTTP Endpoint for "your-tenant.api.cloud.extrahop.com" with a path of "/api/v1"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Request a list of watchlisted devices
[] Check if the request was successful:
[]> If it was, attempt to extract data and set the output variables
[]> If it wasn't, output an error

More information about this API: https://docs.extrahop.com/current/rx360-rest-api/#watchlist

ExtraHop Reveal(x) 360 - Get Watchlist Devices

Removes a device from a static device group in ExtraHop.

Target: ExtraHop integration target or HTTP Endpoint for "your-tenant.api.cloud.extrahop.com" with a path of "/api/v1"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Remove the device from the device group
[] Check if the request was successful:
[]> If it wasn't, output an error

More information about this API: https://docs.extrahop.com/current/rx360-rest-api/#device-group

ExtraHop Reveal(x) 360 - Remove Device from Device Group

Removes a device from the watchlist in ExtraHop.

Target: ExtraHop integration target or HTTP Endpoint for "your-tenant.api.cloud.extrahop.com" with a path of "/api/v1"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header
[] Remove the device from the watchlist
[] Check if the request was successful:
[]> If it wasn't, output an error

More information about this API: https://docs.extrahop.com/current/rx360-rest-api/#watchlist

ExtraHop Reveal(x) 360 - Remove Device from Watchlist

Searches ExtraHop for matching detections.

Target: ExtraHop integration target or HTTP Endpoint for "your-tenant.api.cloud.extrahop.com" with a path of "/api/v1"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header and request payload
[] Request a list of detections
[] Check if the request was successful:
[]> If it was, set the output variables
[]> If it wasn't, output an error

More information about this API: https://docs.extrahop.com/current/rx360-rest-api/#detections

ExtraHop Reveal(x) 360 - Search Detections

Searches ExtraHop for matching devices.

Target: ExtraHop integration target or HTTP Endpoint for "your-tenant.api.cloud.extrahop.com" with a path of "/api/v1"

Account Key: None if using an integration-provided target, access token if using an HTTP Endpoint target

Steps:
[] Build the authorization header and request payload
[] Request a list of devices
[] Check if the request was successful:
[]> If it was, attempt to extract data and set the output variables
[]> If it wasn't, output an error

More information about this API: https://docs.extrahop.com/current/rx360-rest-api/#device