---
title: "Integrate ExtraHop Reveal X Enterprise with Red Canary"
slug: "integrate-extrahop-reveal-x-enterprise-with-red-canary"
updated: 2026-09-09T16:09:35Z
published: 2026-09-09T16:09:35Z
canonical: "docs.redcanary.com/integrate-extrahop-reveal-x-enterprise-with-red-canary"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrate ExtraHop Enterprise with Zscaler MDR

Integrating ExtraHop Enterprise with Zscaler MDR amplifies threat detection and response capabilities by combining real-time network visibility with advanced threat hunting. We leverage ExtraHop’s comprehensive network traffic analysis to identify suspicious activities, providing you with a robust defense against cyberattacks. To integrate ExtraHop Enterprise with Zscaler MDR, follow the procedure below from beginning to end.

## **Step 1: Zscaler MDR–Create your Zscaler MDR generated URL**

Create a Zscaler MDR generated-URL to send ExtraHop RevealX alerts for ingestion.

1. In the Zscaler MDR portal, click **Integrations**, then click **Add Integration.**

![Add a new Red Canary integration](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integrations-main.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A06%3A37Z&se=2026-11-04T16%3A06%3A37Z&sr=c&sp=r&sig=NPR%2BXI50pZeFsxM84lUZxrNWEC2TIqgxI1%2FGm7ziRIg%3D)
2. Type and select ExtraHop Enterprise.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/extra enter.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A06%3A37Z&se=2026-11-04T16%3A06%3A37Z&sr=c&sp=r&sig=NPR%2BXI50pZeFsxM84lUZxrNWEC2TIqgxI1%2FGm7ziRIg%3D)
3. Click **Configure**.
4. Enter a Name for your external alert source.
5. Select a Display Category.
6. Under the Ingest Format/Method dropdown, select **ExtraHop via HTTP**.
7. Click **Save Configuration**.
8. Click **Edit Configuration**.
9. Click **Activate**.
10. Copy and save the URL and Port number.

![2.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/9559467904919.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A06%3A37Z&se=2026-11-04T16%3A06%3A37Z&sr=c&sp=r&sig=NPR%2BXI50pZeFsxM84lUZxrNWEC2TIqgxI1%2FGm7ziRIg%3D)

## **Step 2: ExtraHop RevealX–Create an open data stream**

Enable your Zscaler MDR alert source endpoint as a valid data export stream from your ExtraHop dashboard.

1. From your ExtraHop dashboard, click **System Settings**.
2. From the Administration section, click **All Administration**.

![3.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/9559467906583.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A06%3A37Z&se=2026-11-04T16%3A06%3A37Z&sr=c&sp=r&sig=NPR%2BXI50pZeFsxM84lUZxrNWEC2TIqgxI1%2FGm7ziRIg%3D)
3. From the System Configuration section, click **Open Data Streams**.
4. Click **Add Target**.
5. From the Target Type dropdown, select **HTTP**.
6. For the Name field, enter **RedCanary** (all one word).
7. For the Host field, enter the **host name** from the URL provided in [Step 1.11](https://redcanary.document360.io/docs/integrate-extrahop-reveal-x-enterprise-with-red-canary#:~:text=Copy%20and%20save%20the%20URL%20and%20Port%20number.).

Example:

**URL**: https://testprod-use9-abcdefg.prod1.collectors.redcanary.io:123/random/

**Host name**: testprod-use9-abcdefg.prod1.collectors.redcanary.io
8. For the Port field, enter the Port number from [Step 1.11](https://redcanary.document360.io/docs/integrate-extrahop-reveal-x-enterprise-with-red-canary#:~:text=Copy%20and%20save%20the%20URL%20and%20Port%20number.).
9. From the Type dropdown, select **HTTPS**.
10. Scroll down, and then click **Save**.

![4.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/9559467827223.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A06%3A37Z&se=2026-11-04T16%3A06%3A37Z&sr=c&sp=r&sig=NPR%2BXI50pZeFsxM84lUZxrNWEC2TIqgxI1%2FGm7ziRIg%3D)

## **Step 3: ExtraHop RevealX–Upload the Zscaler MDR bundle into ExtraHop**

Upload the Zscaler MDR provided bundle into ExtraHop to start sending telemetry to Zscaler MDR.

1. Download this [ExtraHop bundle](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/Red%20Canary%20ExtraHop%20Enterprise%20Integration.json?sv=2026-02-06&spr=https&st=2026-11-04T15%3A06%3A37Z&se=2026-11-04T16%3A06%3A37Z&sr=c&sp=r&sig=NPR%2BXI50pZeFsxM84lUZxrNWEC2TIqgxI1%2FGm7ziRIg%3D).
2. To upload and install the bundle into your ExtraHop system, follow [these instructions](https://docs.extrahop.com/9.0/install-a-bundle/).
3. From your ExtraHop dashboard, click **System Settings**.
4. From the Administration section, click **Triggers**.

![5.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/9559499118487.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A06%3A37Z&se=2026-11-04T16%3A06%3A37Z&sr=c&sp=r&sig=NPR%2BXI50pZeFsxM84lUZxrNWEC2TIqgxI1%2FGm7ziRIg%3D)
5. Click the **Zscaler MDR Data Stream** trigger.
6. Click **Edit Trigger Script**.
7. Copy and paste the **URL** from [Step 1.11](https://redcanary.document360.io/docs/integrate-extrahop-reveal-x-enterprise-with-red-canary#:~:text=Copy%20and%20save%20the%20URL%20and%20Port%20number.) into the integration URL line.

**Example**: https://testprod-use9-abcdefg.prod1.collectors.redcanary.io:123/random/
8. Copy and paste the **Stream name** from [Step 2.6](https://redcanary.document360.io/docs/integrate-extrahop-reveal-x-enterprise-with-red-canary#:~:text=For%20the%20Name%20field%2C%20enter%20RedCanary%20(all%20one%20word).) into the remoteStreamName line.

![7.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/9559566890135.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A06%3A37Z&se=2026-11-04T16%3A06%3A37Z&sr=c&sp=r&sig=NPR%2BXI50pZeFsxM84lUZxrNWEC2TIqgxI1%2FGm7ziRIg%3D)
9. Click **Save**.

[Red_Canary_ExtraHop_Enterprise_Integration.json](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/red_canary_extrahop_enterprise_integration.json?sv=2026-02-06&spr=https&st=2026-11-04T15%3A06%3A37Z&se=2026-11-04T16%3A06%3A37Z&sr=c&sp=r&sig=NPR%2BXI50pZeFsxM84lUZxrNWEC2TIqgxI1%2FGm7ziRIg%3D)