|
| 1 | +--- |
| 2 | +id: extrahop-revealx-360 |
| 3 | +title: ExtraHop RevealX 360 |
| 4 | +sidebar_label: ExtraHop RevealX 360 |
| 5 | +description: The ExtraHop RevealX 360 app for Sumo Logic provides security analysts with critical visibility into your ExtraHop RevealX 360 environment. |
| 6 | +--- |
| 7 | + |
| 8 | +import useBaseUrl from '@docusaurus/useBaseUrl'; |
| 9 | + |
| 10 | +<img src={useBaseUrl('img/send-data/extrahop-revealx-360-icon.png')} alt="extrahop-revealx-360-icon" width="150"/> |
| 11 | + |
| 12 | +The ExtraHop RevealX 360 app offers powerful network detection and response capabilities, providing organisations with in-depth visibility into security threats throughout their environment. By centralizing detection data such as total detections, average risk scores, MITRE attack techniques, and destination device activity, this app allows security teams to quickly identify, prioritize, and investigate suspicious activities. |
| 13 | + |
| 14 | +By leveraging real-time metrics and contextual threat information, the app highlights patterns of malicious behavior, high-risk destinations, and devices originating from embargoed locations. This insight helps teams monitor evolving risks, identify vulnerable assets, and understand the tactics and techniques targeting their networks. |
| 15 | + |
| 16 | +With its comprehensive detection summaries, geographical breakdowns, and detailed device-level insights, the ExtraHop RevealX 360 app empowers organizations to respond effectively to emerging threats. By maintaining a clear view of their security posture, teams can act swiftly, reduce dwell time, and strengthen defenses to protect critical systems and data. |
| 17 | + |
| 18 | +:::info |
| 19 | +This app includes [built-in monitors](#extrahop-revealx-360-alerts). For details on creating custom monitors, refer to [Create monitors for ExtraHop RevealX 360 app](#create-monitors-for-extrahop-revealx-360-app). |
| 20 | +::: |
| 21 | + |
| 22 | +## Log types |
| 23 | + |
| 24 | +The Sumo Logic app for ExtraHop RevealX 360 ingests [detection events](https://docs.extrahop.com/current/detections-create-notification-rule/) via a webhook. |
| 25 | + |
| 26 | +## Sample log messages |
| 27 | + |
| 28 | +```json title="Detection log" |
| 29 | +{ |
| 30 | + "mitre_techniques": [ |
| 31 | + { |
| 32 | + "id": "T1021", |
| 33 | + "name": "Remote Services" |
| 34 | + }, |
| 35 | + { |
| 36 | + "id": "T1078", |
| 37 | + "name": "Valid Accounts" |
| 38 | + }, |
| 39 | + { |
| 40 | + "id": "T1570", |
| 41 | + "name": "Lateral Tool Transfer" |
| 42 | + } |
| 43 | + ], |
| 44 | + "recommended": true, |
| 45 | + "time": 1755070340426, |
| 46 | + "dst": { |
| 47 | + "type": "device", |
| 48 | + "ipaddr": null, |
| 49 | + "hostname": null, |
| 50 | + "role": "victim", |
| 51 | + "endpoint": "server", |
| 52 | + "username": null, |
| 53 | + "device": { |
| 54 | + "oid": 17550703405, |
| 55 | + "macaddr": "0E:C9:8B:2C:62:F3", |
| 56 | + "name": "pc2.i.rx.tours", |
| 57 | + "ipaddrs": [ |
| 58 | + "109.248.151.179" |
| 59 | + ] |
| 60 | + } |
| 61 | + }, |
| 62 | + "id": 17550703402, |
| 63 | + "url": "https://envio1206.duckdns.org/extrahop/#/detections/detail/17550703402/?from=1755070340&until=1755070340&interval_type=DT", |
| 64 | + "risk_score": 65, |
| 65 | + "recommended_factors": [ |
| 66 | + "top_offender" |
| 67 | + ], |
| 68 | + "additional_participants": [], |
| 69 | + "categories_ids": [ |
| 70 | + "sec", |
| 71 | + "sec.lateral", |
| 72 | + "sec.attack" |
| 73 | + ], |
| 74 | + "properties": {}, |
| 75 | + "type": "New SMB Executable File Transfer Activity", |
| 76 | + "description": "pc2.i.rx.tours received an executable file. This is the first time in several weeks ExtraHop observed this activity. Check unexpected files for malware.\nExample of a suspicious transferred file path. View more in investigation steps\n\nADMIN$\\xxFDMxx.exe\n", |
| 77 | + "src": { |
| 78 | + "type": "device", |
| 79 | + "ipaddr": "109.248.151.179", |
| 80 | + "hostname": null, |
| 81 | + "role": "offender", |
| 82 | + "endpoint": "client", |
| 83 | + "username": null, |
| 84 | + "device": { |
| 85 | + "oid": 17550703400, |
| 86 | + "macaddr": "0E:86:1F:88:60:E9", |
| 87 | + "name": "pc3.i.rx.tours" |
| 88 | + } |
| 89 | + }, |
| 90 | + "title": "New SMB Executable File Transfer Activity" |
| 91 | +} |
| 92 | +``` |
| 93 | + |
| 94 | +## Sample queries |
| 95 | + |
| 96 | +```sql title="Total Detections" |
| 97 | +_sourceCategory=Labs/extraHop |
| 98 | +| json "id", "time", "url", "src.username", "risk_score", "mitre_techniques[*].name", "dst.device.name", "dst.device.macaddr", "dst.device.ipaddrs.[*]", "dst.ipaddr", "type", "title", "description", "recommended_factors", "categories_ids", "dst.hostname", "dst.role" as id, time, url, src_username, risk_score, mitre_techniques, dst_device_name, dst_device_mac_address, dst_device_ip_list, dst_device_ip_2, type, title, description, recommended_factors, categories_ids, dst_hostname, dst_role nodrop |
| 99 | + |
| 100 | +| extract field=mitre_techniques "\"?(?<techniques>[\w\s\-&.,]*)\"?[,\n\]]" multi nodrop |
| 101 | +| extract field=dst_device_ip_list "\"?(?<dst_device_ip_1>[\w\s\-&.,]*)\"?[,\n\]]" nodrop |
| 102 | +| if (isBlank(dst_device_ip_1), dst_device_ip_2, dst_device_ip_1) as dst_device_ip |
| 103 | + |
| 104 | +| where techniques matches "*" |
| 105 | + |
| 106 | +| count by id, time, url, src_username |
| 107 | +| count |
| 108 | +``` |
| 109 | + |
| 110 | +## Setup |
| 111 | + |
| 112 | +### Source configuration |
| 113 | + |
| 114 | +Follow the below steps to configure the Hosted Collector to receive ExtraHop RevealX 360 events: |
| 115 | + |
| 116 | +1. In the Sumo Logic portal, create a new [Hosted Collector](/docs/send-data/hosted-collectors/configure-hosted-collector/) or use an existing one. Then add an [HTTP Logs and Metrics Source](/docs/send-data/hosted-collectors/http-source/logs-metrics/#configure-an-httplogs-and-metrics-source). |
| 117 | +2. Configure **Source Category** in the HTTP source - for example, `webhook/extrahop-revealx` - for the ExtraHop RevealX 360 integration. |
| 118 | +3. Copy and save the endpoint URL of the source. |
| 119 | + |
| 120 | +### Vendor configuration |
| 121 | + |
| 122 | +Configure the webhook integration in ExtraHop RevealX 360 to send events to the Sumo Logic HTTP source. Once configured, it will be triggered each time the events occur within your Extrahop RevealX 360 account. |
| 123 | + |
| 124 | +To configure the ExtraHop RevealX 360 webhook, refer to the [ExtraHop RevealX 360 Documentation](https://docs.extrahop.com/current/detections-create-notification-rule/). |
| 125 | + |
| 126 | +### Installing the ExtraHop RevealX 360 app |
| 127 | + |
| 128 | +import AppInstall2 from '../../reuse/apps/app-install-v2.md'; |
| 129 | + |
| 130 | +<AppInstall2/> |
| 131 | + |
| 132 | +## Viewing ExtraHop RevealX 360 dashboards |
| 133 | + |
| 134 | +import ViewDashboards from '../../reuse/apps/view-dashboards.md'; |
| 135 | + |
| 136 | +<ViewDashboards/> |
| 137 | + |
| 138 | +### Security |
| 139 | + |
| 140 | +The **ExtraHop RevealX 360 - Security** dashboard provides a comprehensive overview of network detection activities and the overall security posture of your environment. It offers insights into total detections, average risk scores, and the distribution of techniques over time, allowing teams to quickly identify unusual patterns and potential areas of concern. |
| 141 | + |
| 142 | +This dashboard helps security teams monitor detection trends, track changes in risk levels, and gain insights into the most frequently observed MITRE techniques, top destination devices, and key targets on the network. It also highlights detections linked to high-risk or embargoed geolocations, offering valuable context for prioritizing investigations. |
| 143 | + |
| 144 | +By consolidating these insights into a unified view, the dashboard enhances threat detection, supports more informed response actions, and strengthens defenses against evolving network-based attacks.< br/><img src=' https://sumologic-app-data-v2.s3.us-east-1.amazonaws.com/dashboards/Extrahop+RevealX+360/Extrahop-RevealX-360-Security.png' alt="Extrahop-RevealX-360-Security" style={{border:'1px solid gray'}} /> |
| 145 | + |
| 146 | +## Create monitors for ExtraHop RevealX 360 app |
| 147 | + |
| 148 | +import CreateMonitors from '../../reuse/apps/create-monitors.md'; |
| 149 | + |
| 150 | +<CreateMonitors/> |
| 151 | + |
| 152 | +### ExtraHop RevealX 360 alerts |
| 153 | + |
| 154 | +| Name | Description | Trigger Type (Critical / Warning / MissingData) | Alert Condition | |
| 155 | +|:--|:--|:--|:--| |
| 156 | +| `ExtraHop RevealX 360 - Destination Devices from Embargoed Geo Locations` | This alert is fired when events originating from embargoed locations are detected, ensuring adherence to security restrictions and protocols. | Critical | Count > 0 | |
| 157 | +| `ExtraHop RevealX 360 - Critical Detections` | This alert is fired when detections are identified with a risk score greater than 70, signaling high-severity threats that require immediate investigation and remediation. | Critical | Count > 0 | |
| 158 | + |
| 159 | +## Upgrade/Downgrade the ExtraHop RevealX 360 app (Optional) |
| 160 | + |
| 161 | +import AppUpdate from '../../reuse/apps/app-update.md'; |
| 162 | + |
| 163 | +<AppUpdate/> |
| 164 | + |
| 165 | +## Uninstalling the ExtraHop RevealX 360 app (Optional) |
| 166 | + |
| 167 | +import AppUninstall from '../../reuse/apps/app-uninstall.md'; |
| 168 | + |
| 169 | +<AppUninstall/> |
0 commit comments