Integrating ExtraHop Enterprise with Zscaler MDR amplifies threat detection and response capabilities by combining real-time network visibility with advanced threat hunting. We leverage ExtraHop’s comprehensive network traffic analysis to identify suspicious activities, providing you with a robust defense against cyberattacks. To integrate ExtraHop Enterprise with Zscaler MDR, follow the procedure below from beginning to end.
Step 1: Zscaler MDR–Create your Zscaler MDR generated URL
Create a Zscaler MDR generated-URL to send ExtraHop RevealX alerts for ingestion.
In the Zscaler MDR portal, click Integrations, then click Add Integration.
Type and select ExtraHop Enterprise.
Click Configure.
Enter a Name for your external alert source.
Select a Display Category.
Under the Ingest Format/Method dropdown, select ExtraHop via HTTP.
Click Save Configuration.
Click Edit Configuration.
Click Activate.
Copy and save the URL and Port number.
Step 2: ExtraHop RevealX–Create an open data stream
Enable your Zscaler MDR alert source endpoint as a valid data export stream from your ExtraHop dashboard.
From your ExtraHop dashboard, click System Settings.
From the Administration section, click All Administration.
From the System Configuration section, click Open Data Streams.
Click Add Target.
From the Target Type dropdown, select HTTP.
For the Name field, enter RedCanary (all one word).
For the Host field, enter the host name from the URL provided in Step 1.11.
Example:
URL: https://testprod-use9-abcdefg.prod1.collectors.redcanary.io:123/random/
Host name: testprod-use9-abcdefg.prod1.collectors.redcanary.io
For the Port field, enter the Port number from Step 1.11.
From the Type dropdown, select HTTPS.
Scroll down, and then click Save.
Step 3: ExtraHop RevealX–Upload the Zscaler MDR bundle into ExtraHop
Upload the Zscaler MDR provided bundle into ExtraHop to start sending telemetry to Zscaler MDR.
Download this ExtraHop bundle.
To upload and install the bundle into your ExtraHop system, follow these instructions.
From your ExtraHop dashboard, click System Settings.
From the Administration section, click Triggers.
Click the Zscaler MDR Data Stream trigger.
Click Edit Trigger Script.
Copy and paste the URL from Step 1.11 into the integration URL line.
Example: https://testprod-use9-abcdefg.prod1.collectors.redcanary.io:123/random/
Copy and paste the Stream name from Step 2.6 into the remoteStreamName line.
Click Save.