ExtraHop Features

Management (9)

Dashboards and Reports: Access pre-built and custom reports and dashboards.
Workflow Management: Creates new or streamlines existing workflows to better handle IT support tickets and service.
Administration Console: Provides Administration tools/console that are easy to use and learn for routine maintenance tasks
Performance Baseline: Sets a standard performance baseline by which to compare live network activity.
Data Visualization: Charts or graphs live and historical network performance for quick status checking and analysis.
Path Analysis: Gives insights into which specific network paths are performing suboptimally.
Extensibility: Allows for customized support for hybrid environments
Workflow Automation: Streamline the flow of work processes by establishing triggers and alerts that notify and route information to the appropriate people when their action is required within the compensation process.
Unified Visibility: Provides all-encompassing display and analysis of environments, resources, traffic, and activity across networks.

Operations (3)

Governance: Allows users to create, edit, and relinquish user access privileges.
Logging and Reporting: Provides required reports to manage business. Provides adequate logging to troubleshoot and support auditing.
API / Integrations: Application Programming Interface - Specification for how the application communicates with other software. API's typically enable integration of data, logic, objects, etc. with other software applications.

Security Controls (4)

Anomaly Detection: Constantly monitors acivity related to user behavior and compares activity to benchmarked patterns.
Data Loss Prevention: Stores data securely either on premise or in an adjacent cloud database to prevent loss of data at rest.
Security Auditing: Analyzes data associated with security configurations and infrastructure to provide vulnerability insights and best practices.
Cloud Gap Analytics: Analyzes data associated with denied entries and policy enforcement, giving information of better authentication and security protocols.

Administration (7)

Risk Scoring: Provides risk scoring for suspicious activity, vulnerabilities, and other threats.
Secrets Management: Provides tools for managing authentication credentials such as keys and passwords.
Security Auditing: Analyzes data associated with security configurations and infrastructure to provide vulnerability insights and best practices.
Configuration Management: Monitors configuration rule sets and policy enforcement measures and document changes to maintain compliance.
Compliance: Supports compliance with PII, GDPR, HIPPA, PCI, and other regulatory standards.
Administration Console -: Provides a centralized console for administation tasks and unified control.
API / integrations: Application Programming Interface - Specification for how the application communicates with other software. API's typically enable integration of data, logic, objects, etc. with other software applications.

Monitoring (3)

Continuous Image Assurance: Provides image verification features to establish container approval requirements and continuously monitor for policy violations to identify containers with known vulnerabilities, malware, and other threats.
Behavior Monitoring: Constantly monitors acivity related to user behavior and compares activity to benchmarked patterns and fraud indicators.
Observability: Generate insights across IT systems utilizing event metrics, logging, traces, and metadata.

Protection (4)

Dynamic Image Scanning: Scans application and image source code for security flaws without executing it in a live environment
Runtime Protection: Monitors container activities and detects threats across containers, networks, and cloud service providers.
Workload Protection: Protects compute resources across a networks and cloud service providers. Serves as Firewall and prompts additional authentication for suspicious users.
Network Segmentation: Allows administrative control over network components, mapping, and segmentation.

Prevention (5)

Intrusion Prevention: Enforces security paramaters to prevent unauthorized access.
Firewall: Protects servers, data center infrastructure and information from a variety of attacks and malware threats.
Encryption: Provide some level of encryption of information, protecting sensitive data while it exists within the data center.
Security hardening: Facilitates system and network security by identifying and remediating vulnerabilities
Cloud Data Protection: Provides high quality and wide scope of in-cloud and offline data security capabilities.

Detection (6)

Intrusion Detection: Detects unauthorized access and use of privileged systems.
Security Monitoring: Detects anomalies in functionality, user accessibility, traffic flows, and tampering.
Anti-Malware / Malware Detection: Provides multiple techniques and information sources to alert users of malware occurrences.
Multi-Network Monitoring: Provides monitoring capabilities for multiple networks at once.
Asset Discovery: Detect new assets as they enter a network and add them to asset inventory.
Anomaly Detection: Constantly monitors activity related to user behavior and compares activity to benchmarked patterns

Functionality (12)

Performance Monitoring: Continuously monitors network performance across the entire span of a network.
Alerting: Sends alerts via pop-up notifications, texts, emails, or calls regarding network issues or failures.
Improvement Suggestions: Suggests potential remedies or improvements to slowdowns, errors, or failures.
Multi-Network Capability: Provides monitoring capabilities for multiple networks at once.
Multi-Network Capability: Provides monitoring capabilities for multiple networks at once.
Anomaly Detection: Constantly monitors activity related to user behavior and compares activity to benchmarked patterns.
Network Visibility: Provides all-encompassing display and analysis of environments, resources, traffic, and activity across networks.
Scalability: Provides features to allow scaling for large organizations.
Incident Alerts: Gives alerts when incidents arise. Some responses may be automated, but users will still be informed.
Anomaly Detection: Constantly monitors activity related to user behavior and compares activity to benchmarked patterns.
Continuous Analysis: Constantly monitors traffic and activity. Detects anomalies in functionality, user accessibility, traffic flows, and tampering.
Decryption: Facilitates the decryption of files and data stored using cryptographic algorithms.

Automation (4)

Metadata Management: Indexes metadata descriptions for easier searching and enhanced insights
Artificial Intelligence & Machine Learning: Facilitates Artificial Intelligence (AI) or Machine Learning (ML) to enable data ingestion, performance suggestions, and traffic analysis.
Response Automation: Reduces time spent remedying issues manually. Resolves common network security incidents quickly.
Continuous Analysis: Constantly monitors traffic and activity. Detects anomalies in functionality, user accessibility, traffic flows, and tampering.

Incident Management (3)

Incident Logs: Information on each incident is stored in databases for user reference and analytics.
Incident Alerts: Gives alerts when incidents arise. Some responses may be automated, but users will still be informed.
Incident Reporting: Produces reports detailing trends and vulnerabilities related to their network and infrastructure.

Analysis (9)

File Analysis: Identifies potentially malicious files and applications for threats files and applications for abnormalities and threats.
Memory Analysis: Analyzes infortmation from a computer or other endpoint's memory dump for information removed from hard drive.
Registry Analysis: Identifies recently accessed files and applications for abnormalities and threats.
Email Analysis: Parses and/or extracts emails and associated content for malware, phishing, other data that can be used in investigations.
Linux Analysis: Allows for parsing and/or extraction of artifacts native to Linux OS including but not limited to system logs, SSH activity, and user accounts.
Incident Reporting: Produces reports detailing trends and vulnerabilities related to their network and infrastructur
Network Visibility: Provides all-encompassing display and analysis of environments, resources, traffic, and activity across networks.
Metadata Enrichment: Facilitates Artificial Intelligence (AI) such as Machine Learning (ML) to enable data ingestion, performance suggestions, and traffic analysis.
Metadata Management: Indexes metadata descriptions for easier searching and enhanced insight

Remediation (3)

Response (3)

Incident Alerts: Gives alerts when incidents arise. Some responses may be automated, but users will still be informed.
Response Orchestration: Integrates additional security tools to automate security and incident response processes.
Response Automation: Reduces time spent remedying issues manually. Resolves common network security incidents quickly

Detection & Response (4)

Response Automation: Reduces time spent remedying issues manually. Resolves common network security incidents quickly.
Threat Hunting: Facilitates the proactive search for emerging threats as they target servers, endpoints, and networks.
Rule-Based Detection: Allows administrators to set rules specified to detect issues related to issues such as sensitive data misuse, system misconfiguration, lateral movement, and/or non-compliance.
Real-Time Detection: Constantly monitors system to detect anomalies in real time.

Analytics (3)

Threat Intelligence: Stores information related to common threats and how to resolve them once incidents occur.
Artificial Intelligence & Machine Learning: Facilitates Artificial Intelligence (AI) such as Machine Learning (ML) to enable data ingestion, performance suggestions, and traffic analysis.
Data Collection: Collects information from multiple sources to cross reference and build contextual to correlate intelligence.

Generative AI (3)

Monitoring - Network Monitoring (3)

360-Degree Network Visibility: Offers full observability of all network environments, including on-premises, cloud, SD-WAN, WLAN, and edge computing.
Automated Network Discovery: Automatically detects and maps all network devices and architectures, reducing manual effort and improving visibility.
Real-Time Monitoring: Provides true real-time network monitoring to detect and resolve issues instantly, rather than relying on near-time data.

Analytics - Network Monitoring (2)

Security - Network Monitoring (3)

Network Performance - Network Monitoring (2)

AI Automation - Network Monitoring (3)

Machine Learning-Based Anomaly Detection: Uses machine learning to identify network anomalies, preventing security and performance issues before they escalate.
Self-Healing Networks: Automates corrective actions for common network issues, reducing downtime and manual intervention.
Predictive Network Maintenance: Leverages AI to anticipate hardware failures, capacity issues, and performance bottlenecks before they occur.

Agentic AI - Intrusion Detection and Prevention Systems (IDPS) (2)

Agentic AI - Extended Detection and Response (XDR) Platforms (3)

Agentic AI - Cloud Detection and Response (CDR) (3)

Agentic AI - Network Monitoring (7)

Autonomous Task Execution: Capability to perform complex tasks without constant human input
Multi-step Planning: Ability to break down and plan multi-step processes
Cross-system Integration: Works across multiple software systems or databases
Adaptive Learning: Improves performance based on feedback and experience
Natural Language Interaction: Engages in human-like conversation for task delegation
Proactive Assistance: Anticipates needs and offers suggestions without prompting
Decision Making: Makes informed choices based on available data and objectives