ExtraHop Reveal(x) Reviews

Name: ExtraHop Reveal(x)
Brand: ExtraHop Networks
Rating: 4.3 (13 reviews)

4.3 out of 5

13 reviews
100% willing to recommend

410 followers

What is ExtraHop Reveal(x)?

ExtraHop Reveal(x) is a highly effective network traffic analysis (NTA) solution that leverages a cloud-native architecture to empower organizations to overcome a world filled with increasingly sophisticated threats. It identifies 25% more threats than its competitors. Additionally, organizations that employ Reveal(x) say they resolve issues 77% percent faster than they would if they were using other similar solutions.

Get the ExtraHop Reveal(x) Buyer's Guide and find out what your peers are saying about ExtraHop Reveal(x), Darktrace, Cisco Secure Network Analytics and more!

ExtraHop Reveal(x) is the #4 ranked solution in Network Traffic Analysis tools and #8 ranked solution in top Network Detection and Response (NDR) solutions. PeerSpot users give ExtraHop Reveal(x) an average rating of 8.6 out of 10. Based on the analysis of the 13 most recent ExtraHop Reveal(x) reviews, the overall sentiment is positive, with a sentiment score of 7.4. ExtraHop Reveal(x) is most commonly compared to Darktrace: ExtraHop Reveal(x) vs Darktrace. ExtraHop Reveal(x) is popular among the large enterprise segment, accounting for 64% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a financial services firm, accounting for 16% of all views.

Helped 816,406 peers since 2012

Featured reviews

Jordan Swanson

Information Security Assurance Engineer at School District of Lee County

I rate ExtraHop Reveal(x) 10 out of 10. This is more of a nice-to-have rather than a must-have solution. Something like a CrowdStrike or a next-gen AV is an essential product, whereas NDR is more of a nice-to-have thing. If you only have a little bit of traffic, you're probably not going to get anything out of it. It's better for a medium-to-large enterprise. It's more appropriate for companies wh a massfootprints or industrial applications using use nonstandard devices. It's helpful for things that use SCADA, the Internet of Things, somethingings that don't fit neatly into other management categories. Itty common for industrial, construction, or maintenance devices to be a little lackluster in their security. Major breaches like the Colonial Pipeline hack and attempted hacks on nuclear power plants all went through Internet of Things vulnerabilities and other devices where security wasn't part of their plan. This helps you cover yourself by monitoring the traffic. With something like CrowdStrike, you need to put the CrowdStrike sensor on it, but Reveal(x) looks at everything on the network.

Read full review

John Boake

Senior monitoring engineer at Fiserv

Agent management could certainly use some focus. It should also be a little bit easier to work with collections. We should be able to nest collections within collections. There should be better nesting. The beautiful thing about the company that runs ExtraHop is that when we go to them with feature requests or with things that we would like to see, they're really good at getting them added. The most recent one that we're looking for is being able to limit the packets that users can download. So, if you're an administrator, you should be able to download a full packet capture with the full packet, but if you're just an engineer or an application person just looking at your application header traffic, you don't need to see any payload data. We want to be able to limit that traffic. We want to limit who can see the payload, and we can do that. The vendor is putting that into the tool for us. It's going to be done before the end of the year.

Read full review

Henry-Steinhauer

Systems Engineer at LifePoint Health

We've been able to leverage the information to show other vendors we use that there are issues with the SaaS solution they provide to our EMR physicians. At the top of every hour, they were doing a data recovery operation in the event of an outage of some sort. That was preventing our physicians from using the application. It only lasted about five minutes, but the physicians had to stop working. Of course, when they called the support desk and finally reached a support person, the vendor insisted it was our problem, not theirs. This data helped to prove it was their problem. They eventually brought in some other consultants from the hardware vendor and corrected the issue.

Read full review

ExtraHop Reveal(x) mindshare

Product category:

As of November 2024, the mindshare of ExtraHop Reveal(x) in the Network Traffic Analysis (NTA) category stands at 21.0%, up from 14.5% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Network Traffic Analysis (NTA)

Key learnings from peers

Last updated Nov 12, 2024

Valuable Features

ExtraHop Reveal(x) provides deep information and easy deployment. Users value its security capabilities, network visibility, and integration with solutions like CrowdStrike. The platform excels with automatic threat detection, decryption of SSL traffic, and customizable dashboards. It supports historical and behavioral analysis, tracks attacks, and offers dynamic triggers. Its machine learning, analytics, and user-friendly interface enhance performance. Reveal(x) works out of the box, minimizing setup time and delivering features other tools lack.

"ExtraHop Reveal(x) is highly recommended and very good."
"The solution offers a friendly GUI for security features."
"With ExtraHop Reveal(x), it gives me more visibility into the packets. It doesn't provide the entire packet capture, but it offers more information on how connections are made at the network layer. This can be helpful for detecting network attacks. Additionally, I really like the customizable dashboards and reports. The incident dashboard and alerts provide a good summary initially, and diving deeper into them gives more detailed information. It's also great for analyzing specific attacks and victim logs. The feature that tracks the full attack chain makes it easier to monitor the progress of attacks. Plus, it's connected to the Netria.com app, which I find useful for certain tasks."

Room for Improvement

ExtraHop Reveal(x) could enhance certain areas, such as optimizing NetFlow processing and trigger functionality, improving agent management, and offering expanded protocol support. The pricing could be more competitive, integration with additional security vendors is desired, and a longer historical data analysis beyond 30 days would be beneficial. Improved reporting, a more user-friendly GUI, and training certifications could be added. Users suggest better firmware update notifications and increased tuning capabilities to reduce false positives.

"Currently, we have to check manually as we do not receive any notifications about new patches, maintenance, or firmware releases."
"Currently, we have to check manually as we do not receive any notifications about new patches, maintenance, or firmware releases."
"I think the tuning capabilities could be improved. We're working on minimizing false positives. Apart from that, everything seems fine to me."

ROI

ExtraHop Reveal(x) provides an immediate ROI when paired with a dedicated resource, significantly reducing MTTR by swiftly pinpointing if issues are network, server, or application-related. This efficiency is critical for finance companies processing financial data, ensuring optimal operation. It swiftly identifies and alerts real issues, enabling quick resolution and substantial cost savings. Organizations often see ROI in the first year, with enhanced service and reduced downtime marking its impact.

Pricing

ExtraHop Reveal(x) is considered costly, with expenses increasing as additional devices, scaling needs, and integration with services like CrowdStrike are required. Users note a subscription model with varying pricing ratings from three to seven out of ten for affordability. Costs can be significant, especially for necessary visibility layers and hardware. Discounts may be available for certain institutions, and additional features, such as HL7 traffic decoding, incur extra charges.

"I rate the price of ExtraHop Reveal(x) a seven on a scale of one to ten, where one is a high price, and ten is a low price."
"The solution is based on an annual subscription model and is expensive."
"I rate ExtraHop Reveal(x) six out of 10 for affordability. We pay for an annual license. It's always one of those trade-offs. You get a lot of value, but ExtraHop isn't exorbitantly priced. You can pay extra for additional features like the ability to decode HL7 traffic, which is crucial for EMR environments."

Popular Use Cases

ExtraHop Reveal(x) is primarily utilized for security, visibility, and application performance. Users range from government, retail, and financial sectors to healthcare organizations. It offers real-time analysis and behavioral analytics, aiding in security teams' tasks and identifying network issues. It handles north-south and east-west traffic, providing insights into data movement and potential threats. Users find it effective for troubleshooting application and network performance issues while monitoring extensive device networks.

Service and Support

ExtraHop Reveal(x) customer support receives high praise, with frequent commendations for its excellence and fast response times. Most users rate it between eight and ten, noting effective troubleshooting and problem-solving capabilities. Some mention minor delays, often attributed to time zone differences. Occasional mentions of sporadic performance indicate room for improvement. Those who interacted with ExtraHop found the experience generally positive, reflecting a strong track record in handling technical issues efficiently.

Deployment

ExtraHop Reveal(x)'s initial setup is generally considered simple and straightforward. Some describe the deployment process as easy, requiring minimal personnel for maintenance. However, challenges can arise due to the need for external components, network taps, and data flow complexities. Setting up network taps and packet brokers can add complexity. Timeframes for deployment vary, with some completing in weeks while others face longer implementations due to coordination with multiple teams.

Scalability

ExtraHop Reveal(x) demonstrates scalability with diverse user experiences. Many organizations find it scalable, supporting up to 100GB, with varied users globally. Users appreciate its ability to handle network traffic effectively. Some mention cost as a potential limitation for scaling, while others note technical challenges. Opinions on scalability ratings vary, with some giving high scores, while others are moderate. Increased use often requires device upgrades, influenced by aggressive pricing strategies.

Stability

ExtraHop Reveal(x) demonstrates excellent stability with few reports of bugs or crashes. Most hardware performs well, despite some early issues with certain new appliances. Many rate its stability between eight and nine out of ten. Frequent firmware updates contribute to its ability to effectively decode and analyze traffic.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our ExtraHop Reveal(x) Buyer's Guide for additional reliable information.

Review data by company size

By reviewers

By visitors reading reviews

Top industries

By visitors reading reviews

Financial Services Firm

16%

Computer Software Company

15%

Healthcare Company

Government

Manufacturing Company

Retailer

Energy/Utilities Company

Educational Organization

Construction Company

University

Comms Service Provider

Insurance Company

Performing Arts

Media Company

Outsourcing Company

Non Profit

Recreational Facilities/Services Company

Transportation Company

Hospitality Company

Legal Firm

Real Estate/Law Firm

Wholesaler/Distributor

Logistics Company

Security Firm

Pharma/Biotech Company

Compare ExtraHop Reveal(x) with alternative products

Learn more about ExtraHop Reveal(x)

ExtraHop Reveal(x) Benefits

Some of the ways that organizations can benefit by choosing to deploy ExtraHop Reveal(x) include:

Total network visibility. Reveal(x) gives users the ability to view every component of their network and devices connected to it in real time. It can automatically recognize and classify the devices that are communicating across an organization’s network. These devices are scanned by powerful decryption software that reveals hidden threats and the details of critical transactions without compromising privacy or compliance rules. Organizations are given full East-West visibility across both physical data centers and cloud environments. Threats that are on the periphery are brought to the attention of the administrators tasked with watching out for them.

Identify threats in real time. Reveal(x) extracts more than 5,000 features from the L2-L7 security layers at any given time, feeds them into its machine learning engine, and presents them to its rule-based detection feature. These features make it possible for the solution to identify the most severe threats. Users can conduct a threat triage and address the threats that their system detects in the order of severity that these threats represent.

Ease of use. Users of Reveal(x) can easily make full use of its event remediation features without expending long periods of time learning them. Its workflows are designed so that administrators can go from a security event to the cause of the event in only a couple of clicks. What would normally take hours can be completed in moments.

ExtraHop Reveal(x) Features

Integration suite. Reveal(x) enables users to utilize a robust suite of integrations. If users feel they are missing important capabilities, they can bolster their security feature toolbox with those offered by third-party solutions. Phantom, Splunk, and Palo Alto are three examples of solutions that Reveal(x) enables users to connect to in order to fill in a gap in their security capabilities.

Automated inventory. Reveal(x) automatically creates a detailed inventory of all of the devices that it discovers and classifies. This keeps an always up-to-date record of all of the devices that are communicating in a given network.
Machine learning. Reveal(x)’s real-time application analytics is driven by a machine learning engine. It detects anomalies in an organization’s network traffic, thus enabling users to keep ahead of any and all threats while reducing the number of false positives that administrators have to sort through.

Reviews from Real Users

ExtraHop Reveal(x) is a solution that stands out when compared to many other similar solutions. Two major advantages that it offers are its versatility and its ability to quickly identify the root cause of an application’s issues.

John B., the senior monitoring engineer at a financial services firm, says, “It's useful for different teams in our organization. The cybersecurity team uses it because it has got great analytics for anomaly detection, malware detection, and ransomware. It's used by the networking people because it's great to be able to get the three-way handshake between systems to see how your network is doing. The microservices for DNS use it because they like to be able to see how their DNS services are operating and how many DNS requests are being rejected, denied, or dropped. Application people love it because it fully decrypts their traffic.

Henry S., a systems engineer at LifePoint Health, writes, "When there are performance issues with an HTTP app, ExtraHop enables us to identify the causes within a few minutes. We can see what transactions are being impacted by something that may be happening within the server environment."

ExtraHop Reveal(x) was previously known as Reveal(x), Revealx.