Pros y Contras de ExtraHop

Me gusta que ExtraHop identifique la alerta de una manera que es fácil de seguir. Proporciona el nivel de riesgo de la alerta, muestra las métricas, desglosa los registros del incidente, muestra los paquetes involucrados e incluso incluye un pcap de los paquetes que se puede usar en WireShark para analizar más a fondo. También proporciona las técnicas de Mitre, así como opciones de mitigación para mitigar el ataque. Reseña recopilada por y alojada en G2.com.

No he encontrado muchas cosas que no me gusten de ExtraHop. No es un sistema automatizado que bloqueará un ataque mientras está ocurriendo, pero envía alertas por correo electrónico para que tenga la capacidad de comenzar a investigar el incidente lo antes posible, lo que lleva a un escenario de mitigación más rápido. Reseña recopilada por y alojada en G2.com.

Overall, RevealX is easy to use and provides great visibility into the network. ExtraHop has very thorough documentation and if you can't find what you're looking for the support and training teams are always willing to help. I've experienced a quick turnaround for questions around the product. The training team is excellent at maintain user engagement in a virtual setting. The product is also super customizable which is great for unique use and abuse cases.

I use RevealX almost daily, my top three pros from a technical perspective are the increased visibility of the network, customizing doesn't mean learning a new language, and low barrier to entry for analysts who are new to networking and security. Reseña recopilada por y alojada en G2.com.

My top three cons for the product are that when adjusting baseline metrics, the baseline completely resets and there is a 3-4 week period before the baseline is calculated. Going off the above, it does not perform "lookback" searches for detections, meaning I can't craft a detection today and then see if the logic matches any stored data in the tool. Some of the customization areas need a bit of work so that they tie into the other features of the product. Reseña recopilada por y alojada en G2.com.

ExtraHOP provides great visibility for performance and security issues in our environment. Many of the detections, dashboards, and device groups provide easy starting points for learning to use extraHOP. Then, building custom dashboards and detections is very simple. We use extraHOP every day to assist us resolving problemes. The customer support and partnership we have with extraHOP has been key to our success. Reseña recopilada por y alojada en G2.com.

You need to really understand your environment from the network layer to the application layers. extraHOP provides many options, but you need to determine what works best for your environment. It does take some time for planning the implementation properly but the planning and design time is worth it. Reseña recopilada por y alojada en G2.com.

We've tested the product using reputable 3rd party pentesters manual and automated. And we've compared it with other products. The difference between seeing that you are being compromised and not seeing it is huge. How do you choose a competitive product that is cheaper if it doesn't see that you are being compromised? Or how do you rest at night knowing that you've done everything you can to safeguard your network? Extrahop's visibility is far above the rest. Reseña recopilada por y alojada en G2.com.

It is pricey. So if you are Misinformed and think that backups, firewalls, and anti-virus solutions are going to save you then you aren't going to understand the price of this product. Reseña recopilada por y alojada en G2.com.

With ExtraHop deployed in our network we now have real-time visibiltity and insights into network traffice and performance. Helps us troubleshoot, optimize and secure the network. ExtraHop platform is very easy to use, and has an intuitive easy to follow layout helping us review detections quickly. ExtraHop delivered on promises and provided excelent customer service. This is a tool that I use everyday to keep on eye on the network security. Deploying the devices in the infrastructure can be as simple as connecting to the network and mirroing all traffic to the device. This allows quick visability on the overall network performance and health. Reseña recopilada por y alojada en G2.com.

It can be expensive to deploy, can generate many false positives and has limited integrations into other tools and platforms. Reseña recopilada por y alojada en G2.com.

1. Monitoreo sin interrupciones.

2. Ajuste de reglas simple y directo.

3. Capacidades del panel de control. Reseña recopilada por y alojada en G2.com.

1. Muchos falsos positivos.

2. El modelo de aprendizaje automático no es flexible a los requisitos.

3. A veces problemas de rendimiento. Reseña recopilada por y alojada en G2.com.

ExtraHop provides valuable insight into network activities and alerts on anomalies that you can't get from just monitoring logs. Reseña recopilada por y alojada en G2.com.

Number one issue with ExtraHop is SIEM integration if there is no native connector available. building it through a java script trigger is not user friendly.

Number two issue is threat feeds. We have a high-fidelity threat feed we'd like to add, but we have to make a cludgey system where we download the feed, gzip it, then upload it back to ExtraHop. Please build in native STIX/TAXII feeds to the product.

I'd say trigger complexity is also a downside to ExtraHop. Not many security analysts will be able to understand and write the java code necessary for triggers. It would be nice to have a building block method for triggers where novices could build out most of it with pre-defined blocks fo code, something like a visual workflow. Reseña recopilada por y alojada en G2.com.

Extrahop observa tanto el tráfico local como el de la nube. Analiza paquetes en busca de anomalías de seguridad a una escala que no he visto antes. También realiza un rendimiento de aplicaciones a un nivel que ofrece una visibilidad muy detallada. Reseña recopilada por y alojada en G2.com.

Espero que desarrollen sus propios agentes para los nodos en la nube en lugar de usar rpcapd, que encuentro que puede ser un poco inestable, especialmente en escenarios de alto tráfico. Reseña recopilada por y alojada en G2.com.

Extrahop proporciona visibilidad de red Este-Oeste y puede personalizar reglas, proporcionando capacidad de inspección profunda de paquetes a nuestro equipo de seguridad. La función de captura de paquetes de Extrahop desempeña un papel vital en la informática forense de redes. Reseña recopilada por y alojada en G2.com.

Extrahop debería ampliar su asociación con investigadores de amenazas y proveedores para enriquecer sus fuentes de inteligencia y base de datos para obtener inteligencia procesable sobre detecciones. Además, ampliar su asociación para la integración de API con herramientas como Tanium/SCCM, cortafuegos PAN, etc. Reseña recopilada por y alojada en G2.com.

Me gusta poder profundizar en las opciones y obtener los datos que quiero. Puedo cambiar de opinión fácilmente y volver a lo que estoy buscando. Reseña recopilada por y alojada en G2.com.

Después de recibir capacitación técnica sobre el producto, descubrí que necesitas invertir tiempo para crear un buen panel que se adapte a tus necesidades. Tener todo al alcance de la mano es valioso y facilita la identificación de problemas. Reseña recopilada por y alojada en G2.com.