Pretty easy to setup once you know the basics of spanning your traffic correctly and even easier since it has dedup engine, It has a user friendly interface which present clearly the security detection and network analytics for the security and network team. In addition of providing a lot of detection as an IDS do, it also monitor host behavior to prevent privilege escalation or large data transfer per example. As a network specialist I specially enjoy the monitoring of our network health through advanced tcp analysis and protocol errors. Extrahop 360 have a powerful engine that let us do fast searches and that keeps a large amount of metadata so we can go back in time. Review collected by and hosted on G2.com.

All our detection are sent to our Log Rhythm SIEM to centralize all of our device traps, but since there's no official integration with it, it's not parsed correctly and it seems like it'll need a lot of work to integrate it. Depending on how you do your SSL decryption, it could need some custom integration with their dev team to integrate it. QOS monitoring is a must for most networks having an increased demand for voice and video traffic, but Extrahop has some gaps regarding that compared to some other products like Corvil. I wouldn't go back to Corvil though... Review collected by and hosted on G2.com.