ExtraHop Reveal(x) Reviews

Name: ExtraHop Reveal(x)
Brand: ExtraHop Networks
Rating: 4 (12 reviews)

4.3 out of 5

12 reviews
100% willing to recommend

409 followers

What is ExtraHop Reveal(x)?

ExtraHop Reveal(x) is a highly effective network traffic analysis (NTA) solution that leverages a cloud-native architecture to empower organizations to overcome a world filled with increasingly sophisticated threats. It identifies 25% more threats than its competitors. Additionally, organizations that employ Reveal(x) say they resolve issues 77% percent faster than they would if they were using other similar solutions.

Get the ExtraHop Reveal(x) Buyer's Guide and find out what your peers are saying about ExtraHop Reveal(x), Darktrace, Vectra AI and more!

ExtraHop Reveal(x) is the #4 ranked solution in Network Traffic Analysis tools and #8 ranked solution in top Network Detection and Response (NDR) solutions. PeerSpot users give ExtraHop Reveal(x) an average rating of 8.6 out of 10. ExtraHop Reveal(x) is most commonly compared to Darktrace: ExtraHop Reveal(x) vs Darktrace. ExtraHop Reveal(x) is popular among the large enterprise segment, accounting for 65% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a financial services firm, accounting for 16% of all views.

Helped 814,763 peers since 2012

Featured reviews

Jordan Swanson

Information Security Assurance Engineer at School District of Lee County

I rate ExtraHop Reveal(x) 10 out of 10. This is more of a nice-to-have rather than a must-have solution. Something like a CrowdStrike or a next-gen AV is an essential product, whereas NDR is more of a nice-to-have thing. If you only have a little bit of traffic, you're probably not going to get anything out of it. It's better for a medium-to-large enterprise. It's more appropriate for companies wh a massfootprints or industrial applications using use nonstandard devices. It's helpful for things that use SCADA, the Internet of Things, somethingings that don't fit neatly into other management categories. Itty common for industrial, construction, or maintenance devices to be a little lackluster in their security. Major breaches like the Colonial Pipeline hack and attempted hacks on nuclear power plants all went through Internet of Things vulnerabilities and other devices where security wasn't part of their plan. This helps you cover yourself by monitoring the traffic. With something like CrowdStrike, you need to put the CrowdStrike sensor on it, but Reveal(x) looks at everything on the network.

Read full review

John Boake

Senior monitoring engineer at Fiserv

Agent management could certainly use some focus. It should also be a little bit easier to work with collections. We should be able to nest collections within collections. There should be better nesting. The beautiful thing about the company that runs ExtraHop is that when we go to them with feature requests or with things that we would like to see, they're really good at getting them added. The most recent one that we're looking for is being able to limit the packets that users can download. So, if you're an administrator, you should be able to download a full packet capture with the full packet, but if you're just an engineer or an application person just looking at your application header traffic, you don't need to see any payload data. We want to be able to limit that traffic. We want to limit who can see the payload, and we can do that. The vendor is putting that into the tool for us. It's going to be done before the end of the year.

Read full review

Henry-Steinhauer

Systems Engineer at LifePoint Health

We've been able to leverage the information to show other vendors we use that there are issues with the SaaS solution they provide to our EMR physicians. At the top of every hour, they were doing a data recovery operation in the event of an outage of some sort. That was preventing our physicians from using the application. It only lasted about five minutes, but the physicians had to stop working. Of course, when they called the support desk and finally reached a support person, the vendor insisted it was our problem, not theirs. This data helped to prove it was their problem. They eventually brought in some other consultants from the hardware vendor and corrected the issue.

Read full review

ExtraHop Reveal(x) mindshare

Product category:

As of November 2024, the mindshare of ExtraHop Reveal(x) in the Network Traffic Analysis (NTA) category stands at 21.0%, up from 14.5% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Network Traffic Analysis (NTA)

Key learnings from peers

Last updated Aug 6, 2024

Valuable Features

ExtraHop Reveal(x)'s most valuable features include in-depth information, easy setup, historical and behavioral analysis, incident cards, integration with other tools, machine learning, analytics, network visibility, threat detection, dynamic triggers, seamless integration with CrowdStrike, ability to decrypt SSL traffic, customizable dashboards, reports, and full attack chain tracking. It provides real-time packet flow inspection, out-of-the-box functionality, and captures DNS tunneling without customization.

"With ExtraHop Reveal(x), it gives me more visibility into the packets. It doesn't provide the entire packet capture, but it offers more information on how connections are made at the network layer. This can be helpful for detecting network attacks. Additionally, I really like the customizable dashboards and reports. The incident dashboard and alerts provide a good summary initially, and diving deeper into them gives more detailed information. It's also great for analyzing specific attacks and victim logs. The feature that tracks the full attack chain makes it easier to monitor the progress of attacks. Plus, it's connected to the Netria.com app, which I find useful for certain tasks."
"The solution's ability to decrypt SSL traffic is its most valuable feature."
"ExtraHop Reveal(x) is one of the tools that works out of the box when it comes to threat hunting."

Room for Improvement

ExtraHop Reveal(x) can improve by reducing costs, adding more integration partners, and extending the look-back period. It could provide more training opportunities and certification options. Enhancements in agent management, trigger processes, and VoIP monitoring are needed. Users want better support protocols, improved pricing flexibility, and more comprehensive reporting features. Better GUI and faster technical support response are also desired. The tool should minimize false positives and accommodate detailed permissions for data access.

"I think the tuning capabilities could be improved. We're working on minimizing false positives. Apart from that, everything seems fine to me."
"The solution's reporting part and GUI are areas with certain shortcomings where improvements are required."
"The solution’s pricing could be improved."

ROI

ExtraHop Reveal(x) provides an immediate return on investment when a service or dedicated resource is attached. MTTR is dramatically reduced by isolating problems quickly, whether network, server, or application-related, especially for finance companies processing extensive transactional information. It alerts users to real issues promptly, allowing for swift resolution and significant service improvements. Users report seeing returns within the first year and appreciate the ability to identify issues quickly, leading to substantial cost savings.

Pricing

Enterprise users of ExtraHop Reveal(x) indicate the solution is costly, with significant expenses for scaling and additional devices. Annual subscriptions and hardware integration, particularly with solutions like CrowdStrike, add to the costs. Pricing rankings vary, with affordability ratings between three to seven out of ten. Educational institutions may benefit from discounts, but overall expenditure can grow depending on added features and visibility needs.

"I rate the price of ExtraHop Reveal(x) a seven on a scale of one to ten, where one is a high price, and ten is a low price."
"The solution is based on an annual subscription model and is expensive."
"I rate ExtraHop Reveal(x) six out of 10 for affordability. We pay for an annual license. It's always one of those trade-offs. You get a lot of value, but ExtraHop isn't exorbitantly priced. You can pay extra for additional features like the ability to decode HL7 traffic, which is crucial for EMR environments."

Popular Use Cases

Users employ ExtraHop Reveal(x) for security, visibility, and application performance. It's utilized across sectors such as government, retail, and financial, capturing traffic for analysis. It assists in troubleshooting, behavioral analytics, threat detection, and monitoring network traffic, aiding cybersecurity and incident response. Reveal(x) is implemented both on-premises and in the cloud, supporting data-center visibility and helping identify malware, traffic issues, and security incidents in real-time.

Service and Support

ExtraHop Reveal(x) customer service is generally praised. Several users report a reliable and efficient experience, with ratings often between 8 to 10 out of 10. A few users have occasional issues, such as slow response times or inconsistent support, but these instances are rare. Some have never contacted support due to the absence of significant problems.

Deployment

The initial setup of ExtraHop Reveal(x) is generally straightforward and simple. Deployment can take as little as a week to three weeks. Some organizations report that the visibility layer's design can be intricate. Complexity arises when integrating with other systems, especially regarding network taps and packet brokers. Maintenance is minimal, often handled by a small team, sometimes even just one person per 100 users.

Scalability

ExtraHop Reveal(x) demonstrates good scalability, though some face limitations due to costs. Users, including network engineers, DBAs, application and security teams benefit from its capabilities. Handling up to 100GB is seamless for many. While it's generally rated highly, some encounter issues requiring device upgrades. Expansion plans are common as more users integrate it into their workflows. Ratings range from eight to ten, reflecting the varied experiences in scalability.

Stability

ExtraHop Reveal(x) is highly stable, with users reporting no issues with bugs or glitches, and no crashes or freezes. Some hardware series had issues, but the operating system and firmware are praised. Monthly firmware updates improve decoding and traffic analysis abilities. Stability ratings are generally eight or nine out of ten.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our ExtraHop Reveal(x) Buyer's Guide for additional reliable information.

Review data by company size

By reviewers

By visitors reading reviews

Top industries

By visitors reading reviews

Financial Services Firm

16%

Computer Software Company

15%

Healthcare Company

Government

Manufacturing Company

Retailer

Educational Organization

Construction Company

Energy/Utilities Company

University

Comms Service Provider

Insurance Company

Performing Arts

Media Company

Outsourcing Company

Non Profit

Recreational Facilities/Services Company

Real Estate/Law Firm

Transportation Company

Hospitality Company

Legal Firm

Wholesaler/Distributor

Logistics Company

Pharma/Biotech Company

Compare ExtraHop Reveal(x) with alternative products

Learn more about ExtraHop Reveal(x)

ExtraHop Reveal(x) Benefits

Some of the ways that organizations can benefit by choosing to deploy ExtraHop Reveal(x) include:

Total network visibility. Reveal(x) gives users the ability to view every component of their network and devices connected to it in real time. It can automatically recognize and classify the devices that are communicating across an organization’s network. These devices are scanned by powerful decryption software that reveals hidden threats and the details of critical transactions without compromising privacy or compliance rules. Organizations are given full East-West visibility across both physical data centers and cloud environments. Threats that are on the periphery are brought to the attention of the administrators tasked with watching out for them.

Identify threats in real time. Reveal(x) extracts more than 5,000 features from the L2-L7 security layers at any given time, feeds them into its machine learning engine, and presents them to its rule-based detection feature. These features make it possible for the solution to identify the most severe threats. Users can conduct a threat triage and address the threats that their system detects in the order of severity that these threats represent.

Ease of use. Users of Reveal(x) can easily make full use of its event remediation features without expending long periods of time learning them. Its workflows are designed so that administrators can go from a security event to the cause of the event in only a couple of clicks. What would normally take hours can be completed in moments.

ExtraHop Reveal(x) Features

Integration suite. Reveal(x) enables users to utilize a robust suite of integrations. If users feel they are missing important capabilities, they can bolster their security feature toolbox with those offered by third-party solutions. Phantom, Splunk, and Palo Alto are three examples of solutions that Reveal(x) enables users to connect to in order to fill in a gap in their security capabilities.

Automated inventory. Reveal(x) automatically creates a detailed inventory of all of the devices that it discovers and classifies. This keeps an always up-to-date record of all of the devices that are communicating in a given network.
Machine learning. Reveal(x)’s real-time application analytics is driven by a machine learning engine. It detects anomalies in an organization’s network traffic, thus enabling users to keep ahead of any and all threats while reducing the number of false positives that administrators have to sort through.

Reviews from Real Users

ExtraHop Reveal(x) is a solution that stands out when compared to many other similar solutions. Two major advantages that it offers are its versatility and its ability to quickly identify the root cause of an application’s issues.

John B., the senior monitoring engineer at a financial services firm, says, “It's useful for different teams in our organization. The cybersecurity team uses it because it has got great analytics for anomaly detection, malware detection, and ransomware. It's used by the networking people because it's great to be able to get the three-way handshake between systems to see how your network is doing. The microservices for DNS use it because they like to be able to see how their DNS services are operating and how many DNS requests are being rejected, denied, or dropped. Application people love it because it fully decrypts their traffic.

Henry S., a systems engineer at LifePoint Health, writes, "When there are performance issues with an HTTP app, ExtraHop enables us to identify the causes within a few minutes. We can see what transactions are being impacted by something that may be happening within the server environment."

ExtraHop Reveal(x) was previously known as Reveal(x), Revealx.