
Extrahop does exactly what it says it will do - analyze traffic live on the wire and present that traffic in easily digested formats, broken down by various metrics. The addition of Reveal(X) to capture potentially risky traffic helps our security incident teams correlate and track down quicker. Review collected by and hosted on G2.com.
Extrahop has an avenue it needs to deep dive into immediately, and that's inspecting, categorizing, risk scoring, and using external database data for a deep dive into IIoT/IoT devices. Currently, it can see the traffic on the wire, but the behaviors and risks behind IoT devices will overtake the standard known IT hardware in a few years. Given that these devices are already presenting significant risks to enterprises, they could become indispensable by becoming the masters of IoT devices.
Not necessarily Extrahop's fault as it is a problem with any of these solutions, but aggregating traffic in a large enterprise is not only challenging but an expensive endeavor. There are plenty of networks we want to see but cannot afford to increase the number of EDAs. As a work-around, we use packet brokers to decrease the traffic flows to those we care about to ensure we don't massively oversubscribe the devices. Review collected by and hosted on G2.com.