ExtraHop Reveal(x) for IT Operations Reviews

Auto discovery and auto classification of the entire data-center application environment allows ExtraHop to be functional within hours of providing the EDA with a data feed. There is no product I have seen that even comes close to the speed at which it becomes operational.

The administrative overhead to install and manage the tool is ridiculously low. It is completely agentless, passive, and requires zero configuration on any end device for it to work. The only engineering required is providing the data feed. The time administrators normally spend on system administration can be funnelled into customization instead.

The degree to which the tool can be customized is near limitless. Just about anything on the wire can be a metric or a transaction record. It is most broadly used for operational analytics, but has many use cases for security, clinical, and business analytics as well.

The big data back end is a game changer. Every single network flow and application transaction can produce records. The EXA is still in its initial version having only been released a few months ago, and is already very useful. There are numerous improvements already in the pipeline for the next releases that will make it an even better analytics tool.

Like most organizations, the one where I worked had no functional tier 2. This is because systems are so complex the vast majority of support required engineering resources. This also means that any performance ticket could wind up with just about any engineering group and often multiple groups would have to be engaged for troubleshooting. ExtraHop provides metrics and dashboards that allow IT staff to quickly triage issues and get them to the right group for remediation without having to play hot potato with multiple tickets. It makes the idea of building an effective tier 2 operations team a feasible one.

Enterprise applications and heavy network performance analysis. Specific focus on n tier applications with heavy reliance on L7 protocols

Must-have tool for advanced network/enterprise operation centers to fill in the performance gaps that host based and network performance management solutions leave. Provides the ability to execute systems and application management without being dependent on application language or APM agent qualifications.

Extensive use cases on joint workflow using ExtraHope ITOA and 3rd party APM toolsets- including real-time visualizations of business services performance mashed up and merged against L7 dependent protocols- this allows us to understand the correlation of business services degradation with performance issues with L7 protocols including HTTP, FTP and additional network services.

The focus of the solution has been more on interpreting the interrelationships or interactions between different components within the IT infrastructure. We're talking about that application portfolio and those interdependencies between different components of the network landscape.

We're just trying to identify the application interdependencies, which normally reside on different servers, including web servers, database servers, enterprise service bus, et cetera, up to your presentation layer before we start moving stuff around. 

Normally, the reason why we use these tools is to understand what assets we have, where they're deployed, and how they enter and operate before we decide to go move something from point A to point B. The solution is going to allow me to establish a wave or migration plan where you have different waves of migration and then you actually have move groups to try and get your application moved from A to  B seamlessly. A to B could be on-premise to on-premise. It could be on-premise to cloud. Et cetera.

The solution can tell me what components can I deploy, for example, into a cloud space, without having to refactor my applications since that can be quite time-consuming and costly.

Our primary use case is network security.

The most valuable features are security detections, perimeter detection, dashboards, and alerts.

We are using it for IT operations monitoring and it's great. From our point of view, it's a very good product.

The biggest benefit is that our customers can assess what happens in their networks. For example, they can see why an application is slow.

ExtraHop is basically an NDR solution - Network Detection and Response. It's a cloud-based offering.

If you want to look at real-time traffic to see what's happening in and out, in terms of malicious traffic throughout the network, you can reveal the suspicious activity using the ExtraHop NDR solution. 

It maps the complete network topology so it looks for devices and it builds a complete network, builds a path. It looks for the misconfiguration of the devices and so on. It gives you full 360-degree visibility into your entire infrastructure. For example, it can show you what components are residing, what vulnerabilities it has, and so forth.

When it comes to ExtraHop, it has a very useful feature. Not only can you look at the protocol import level. It also has a live PCAP analysis. Therefore, even if you have PCAP files, Packet Capture files, you can run and have a live recording of the PCAP. That's something this is unique. Otherwise, it's very similar to NetBrain. I wouldn't call it an NDR, however, ExtraHop is mainly comparable to an NDR provider.

The solution is stable.

The setup is simple. 

• Wire data analytics
• Programmability of the platform

You cannot hide from the wire. All truth lives in the packets, and ExtraHop gets them to talk!

It has greatly reduced our MTTR and root cause.

Our primary use case is to seek out the root cause of problems that have been difficult to find. We use it for security anomaly monitoring, as well as performance monitoring.

We have been able to improve the mean time to resolution by several hours in some cases. We have also used it to make architectural decisions based on traffic patterns. It has been instrumental in finding problems that have been difficult to solve.