Integrate ExtraHop Enterprise with Red Canary
- 24 Jul 2024
- 1 Minute to read
- PDF
Integrate ExtraHop Enterprise with Red Canary
- Updated on 24 Jul 2024
- 1 Minute to read
- PDF
Article summary
Did you find this summary helpful?
Thank you for your feedback
Integrating ExtraHop Enterprise with Red Canary amplifies threat detection and response capabilities by combining real-time network visibility with advanced threat hunting. We leverage ExtraHop’s comprehensive network traffic analysis to identify suspicious activities, providing you with a robust defense against cyberattacks. To integrate ExtraHop Reveal X with Red Canary, follow the procedure below from beginning to end.
Step 1: Red Canary–Create your Red Canary generated URL
Create a Red Canary generated-URL to send ExtraHop Reveal X alerts for ingestion.
From your Red Canary homepage, click Integrations, and See all integrations.
.png?sv=2022-11-02&spr=https&st=2024-09-20T14%3A29%3A03Z&se=2024-09-20T14%3A39%3A03Z&sr=c&sp=r&sig=UKVKO7Ep5GHdMpj1dDZIFH%2BLh0CRM8KJFxiSstSDAkk%3D)
Type and select ExtraHop Enterprise.
Click Configure.
Enter a Name for your external alert source.
Select a Display Category.
Under the Ingest Format/Method dropdown, select ExtraHop via HTTP.
Click Save Configuration.
Click Edit Configuration.
Click Activate.
Copy and save the URL and Port number.
.png?sv=2022-11-02&spr=https&st=2024-09-20T14%3A29%3A03Z&se=2024-09-20T14%3A39%3A03Z&sr=c&sp=r&sig=UKVKO7Ep5GHdMpj1dDZIFH%2BLh0CRM8KJFxiSstSDAkk%3D)
Step 2: ExtraHop Reveal X–Create an open data stream
Enable your Red Canary alert source endpoint as a valid data export stream from your ExtraHop dashboard.
From your ExtraHop dashboard, click System Settings.
From the Administration section, click All Administration.
From the System Configuration section, click Open Data Streams.
Click Add Target.
From the Target Type dropdown, select HTTP.
For the Name field, enter RedCanary (all one word).
For the Host field, enter the host name from the URL provided in Step 1.11.
Example:
URL: https://testprod-use9-abcdefg.prod1.collectors.redcanary.io:123/random/
Host name: testprod-use9-abcdefg.prod1.collectors.redcanary.io
For the Port field, enter the Port number from Step 1.11.
From the Type dropdown, select HTTPS.
Scroll down, and then click Save.
Step 3: ExtraHop Reveal X–Upload the Red Canary bundle into ExtraHop
Upload the Red Canary provided bundle into ExtraHop to start sending telemetry to Red Canary.
Download this ExtraHop bundle.
To upload and install the bundle into your ExtraHop system, follow these instructions.
From your ExtraHop dashboard, click System Settings.
From the Administration section, click Triggers.
Click the Red Canary Data Stream trigger.
Click Edit Trigger Script.
Copy and paste the URL from Step 1.11 into the integration URL line.
Example: https://testprod-use9-abcdefg.prod1.collectors.redcanary.io:123/random/
Copy and paste the Stream name from Step 2.6 into the remoteStreamName line.
Click Save.
Was this article helpful?
