ExtraHop Reveal(x) for IT Operations Reviews

The focus of the solution has been more on interpreting the interrelationships or interactions between different components within the IT infrastructure. We're talking about that application portfolio and those interdependencies between different components of the network landscape.

We're just trying to identify the application interdependencies, which normally reside on different servers, including web servers, database servers, enterprise service bus, et cetera, up to your presentation layer before we start moving stuff around. 

Normally, the reason why we use these tools is to understand what assets we have, where they're deployed, and how they enter and operate before we decide to go move something from point A to point B. The solution is going to allow me to establish a wave or migration plan where you have different waves of migration and then you actually have move groups to try and get your application moved from A to  B seamlessly. A to B could be on-premise to on-premise. It could be on-premise to cloud. Et cetera.

The solution can tell me what components can I deploy, for example, into a cloud space, without having to refactor my applications since that can be quite time-consuming and costly.

This solution is more applications reference architecture focused. Its benefit is that it specializes in that space. 

What they can improve would be building a broader reach in terms of capabilities. At the same time, there are other tools on the market that could augment their offering. They either have to go broad or decide what their bread and butter is and get really good at that. 

The solution could improve its visualizations. We want the tool to be accessible to various user types from application developers to network engineers to upper management. 

I've used the solution for five to seven years in different deployments.

The stability is good. I'd rate the reliability nine out of ten. 

I'd rate the scalability nine out of ten in the application space, at least. 

Normally, what I find is I need to get past the initial support people and I end up talking to engineers fairly quickly. Once you get deep into the application space, you have to escalate to the people who are developing the tool.

In general, support is good. It depends on what kind of team you have. If you're looking for deep answers, you're going to have to push to get into that tier two or tier three level support. 

I've also worked with AppNeta.

As time goes on, the organization has to decide what its main focus is going to be. AppNeta shows infrastructure as the main local, and then they offer APIs into other applications that do have other features that you may want to employ that complement it. 

When we're thinking of the stack, ExtraHop spends more time higher up the stack. So it'd be focusing on the middleware piece with the infrastructure and the interdependencies there, whereas AppNeta would sit at a lower level. ExtraHop would be one step up. It's trying to really focus on the application stack and those interrelationships. That's the benefit of that. 

We couldn't deploy to the cloud due to compliance requirements. Deploying on-premises was more expensive. It wasn't rocket science. It was pretty straightforward. 

The pricing is somewhere in the middle. I't not cheap or expensive. 

I'm not sure which version I'm using. 

It all comes down to understanding your reference architecture. A lot of people don't have the knowledge. That's why they pull in these tools.

I'd rate the solution seven out of ten. 

Our primary use case is network security.

The most valuable features are security detections, perimeter detection, dashboards, and alerts.

We've had some struggles getting it to see everything that we want to see. Network visibility is something that needs to be improved. It was going off and not finding things that we knew we had. For example, we're pointing at a data center and instructing it to find everything. Afterwhich, it was coming back not having found half of the devices. That was a big struggle in terms of integrating with our network.

In the future, I would like to see more direct security information available.

We have been working with ExtraHop for about six months.

The stability is really good.

It is difficult to comment on scalability because we bought it for our network. We haven't added any other networks to it.

The technical support is very good.

Getting the tools installed was quite straightforward, but getting the visibility we wanted of our network through the tool took a while. I think that it was probably two months before it was complete.

The price of this solution for our environment is about £650,000 ($855,000 USD) for three years. However, we were subsidized so we did not have to bear the full cost.

We did a market test for Vectra, Darktrace, and ExtraHop. ExtraHop came out with the best price, and I think that it gives us a broader view of our network.

Maybe the security information isn't quite as strong as Vectra or Darktrace, although we have to do more digging than the other tools would have required. However, we get a lot more information about other things on the network that the other tools couldn't give us.

My advice for anybody considering this type of solution is to certainly check ExtraHop against other competitors. It's different from the other security tools. It gives you more network performance and network information, rather than just security information, which is why we chose it. We seem to get two elements for one, whereas the other tools tended not to give you the network information, some of which are very relevant to security practices.

In some ways, it can be a bit richer than other products, but it can also provide slightly less than some of the other tools. It depends on which area you're wanting to focus on.

I would rate this solution a seven out of ten.

ExtraHop is basically an NDR solution - Network Detection and Response. It's a cloud-based offering.

If you want to look at real-time traffic to see what's happening in and out, in terms of malicious traffic throughout the network, you can reveal the suspicious activity using the ExtraHop NDR solution. 

It maps the complete network topology so it looks for devices and it builds a complete network, builds a path. It looks for the misconfiguration of the devices and so on. It gives you full 360-degree visibility into your entire infrastructure. For example, it can show you what components are residing, what vulnerabilities it has, and so forth.

When it comes to ExtraHop, it has a very useful feature. Not only can you look at the protocol import level. It also has a live PCAP analysis. Therefore, even if you have PCAP files, Packet Capture files, you can run and have a live recording of the PCAP. That's something this is unique. Otherwise, it's very similar to NetBrain. I wouldn't call it an NDR, however, ExtraHop is mainly comparable to an NDR provider.

The solution is stable.

The setup is simple. 

The solution could get more aggressive in the discounting of the overall cost.

Support could be better. We'd like to see a local presence within the region in order to have seamless service whether it's the support, the implementation, or professional services.

As resellers, we've proposed this product on a number of projects.

The solution is stable and reliable. There are no bugs or glitches and it doesn't crash or freeze. 

The solution is scalable in the sense the appliance is size-based on the throughput - how much traffic pipe you want to ingest. It's a license-based product and the way it is set up makes it scalable.

For example, if you got an appliance of GB, and, after one year, if you wanted to increase the throughput of that appliance, you could simply buy the original license. It's a software upgrade.

In terms of support, it's always being backed from HQ. A lot of these vendors nowadays, such as ExtraHop or Fidelis, don't have a local support center here based in like UAE. I'm based in UAE. However, they enable using the support through HQ (which is not in UAE). 

With the first level of support, you will receive help from the sales engineer and through your partners or distributors who are based within the specific region. They will guide you. However, in case of a disaster, a software upgrade, or malfunctioning of the software, then you will have the proper technical support that's based somewhere in the US.

Support doesn't have to be faster as this solution is not a very critical solution. It will not impact or bring down your production. It's an out-of-the-box solution. Even if it is down for eight hours, there is no downtime or impact on the production networks. Therefore a lot of vendors are providing the standard support that's basically the next business day or the same day.

I'm also familiar with NetBrain, which is more of an NDR solution.

The product offers a simple, straightforward setup. It's not overly complex or difficult. 

Price-wise, it's head to head in cost compared to the other competitors. They're not selling their product at a premium. It's comparable to the market competitors. It's in the same range. It's also subscription-based licensing. The terms can last up to three years. 

We are a reseller. The solution can be used both on the cloud and on-premises. 

I'd recommend the solution in general.

I'd rate it eight out of ten.

Our primary use case is to seek out the root cause of problems that have been difficult to find. We use it for security anomaly monitoring, as well as performance monitoring.

We have been able to improve the mean time to resolution by several hours in some cases. We have also used it to make architectural decisions based on traffic patterns. It has been instrumental in finding problems that have been difficult to solve. 

There are many valuable features in this product, but probably the biggest is the customization capability it has.

This solution would be improved if it had the ability to retain data longer. Also, there should be more training on the best way to use the product. 

We are using it for IT operations monitoring and it's great. From our point of view, it's a very good product.

The biggest benefit is that our customers can assess what happens in their networks. For example, they can see why an application is slow.

The most valuable feature is the way it handles data, from Layer 2 up to Layer 7. We can see everything that happens in the network. It's a great feature.

There is room for improvement in the security part. They have a new solution, ExtraHop Reveal(x), and I think it needs improvement.

The stability is very good. We have had no problems when we do PoCs.

The scalability is also great. We can expand the solution if we want to and integration is also quite easy.

We usually do the technical parts ourselves because the deployment and the integration are quite easy. We haven't used technical support yet.

We think this solution is better than whatever current solution our customer has.

I was involved in the initial setup and it's very straightforward, it's easy to deploy.

The pricing is higher than other solutions, but with such good features, I think it's worth it. Licensing is based on the throughput and they provide several options.

This is a must-try product. Try it to see the benefits and features. It has many features that other solutions don't have.

Our most important criteria when selecting vendor are the product itself - the stability, the scalability - as well as the support. We need to have good support that is easy to reach.

I would rate ExtraHop at nine out of ten. It's a good product, easy to deploy and easy to expand.

Enterprise applications and heavy network performance analysis. Specific focus on n tier applications with heavy reliance on L7 protocols

Must-have tool for advanced network/enterprise operation centers to fill in the performance gaps that host based and network performance management solutions leave. Provides the ability to execute systems and application management without being dependent on application language or APM agent qualifications.

Extensive use cases on joint workflow using ExtraHope ITOA and 3rd party APM toolsets- including real-time visualizations of business services performance mashed up and merged against L7 dependent protocols- this allows us to understand the correlation of business services degradation with performance issues with L7 protocols including HTTP, FTP and additional network services.

It has a straightforward deployment and implementation model, even for extremely dynamic and complex network environments.

There's unbelievable capability around wired data analysis; analyzing unstructured data at a sizzling rate, rationalizing it and delivering it as consumable, structured data. It's a big data solution in a plug-and-play implementation mode.

It's a must-have solution for large IT Operations, providing the ability to analyze infrastructure and application-related performance and data from the wire perspective. Very strong use cases around L7 application level analysis; at least 15 different security related use cases (including SSL and CIFS usage); significant capability for network focused groups specifically around analysis of L2 - L7 metrics; powerful tool for enterprise server management groups as well (analyze database, application, ICA, storage related metrics to name a few).

Additional out-of-the-box solutions and use cases would be nice. This is less a product improvement as opposed to aligning this powerful solution to common and uncommon industry use cases in order to become more vertically aligned.

The solution is so powerful, and because it analyzes wired data, the potential applications and use cases are limitless. ExtraHop will be better served by creating industry specific views and deployments to accelerate deployments and mindshare with users. As an example, they should have a retail package ready which provides the key views for a retail use case scenario. Same for casino/gaming; finance; ISV usage; NoC operations. So basically, creating the correct views for the market as opposed to saying we can do everything.

Very powerful capabilities related to business parameter and analysis business level reporting if inclined to leveraged the ITOA for analytics

• Wire data analytics
• Programmability of the platform

You cannot hide from the wire. All truth lives in the packets, and ExtraHop gets them to talk!

It has greatly reduced our MTTR and root cause.

I would improve the Rule-Based Access Control (RBAC) by providing granular access control to the data.

We have been using the solution for four years.

We did not encounter any issues with stability.

We did not encounter any issues with scalability.

I would rate the technical support as very good.

We did not use a previous solution.

The initial setup was straightforward. You just need to feed it a copy of network traffic and there are no agents or other nonsense.

The pricing is fair considering the value provided.

We evaluated Riverbed Technology and NetScout Systems.

Do it now and you’ll be glad you did.

Auto discovery and auto classification of the entire data-center application environment allows ExtraHop to be functional within hours of providing the EDA with a data feed. There is no product I have seen that even comes close to the speed at which it becomes operational.

The administrative overhead to install and manage the tool is ridiculously low. It is completely agentless, passive, and requires zero configuration on any end device for it to work. The only engineering required is providing the data feed. The time administrators normally spend on system administration can be funnelled into customization instead.

The degree to which the tool can be customized is near limitless. Just about anything on the wire can be a metric or a transaction record. It is most broadly used for operational analytics, but has many use cases for security, clinical, and business analytics as well.

The big data back end is a game changer. Every single network flow and application transaction can produce records. The EXA is still in its initial version having only been released a few months ago, and is already very useful. There are numerous improvements already in the pipeline for the next releases that will make it an even better analytics tool.

Like most organizations, the one where I worked had no functional tier 2. This is because systems are so complex the vast majority of support required engineering resources. This also means that any performance ticket could wind up with just about any engineering group and often multiple groups would have to be engaged for troubleshooting. ExtraHop provides metrics and dashboards that allow IT staff to quickly triage issues and get them to the right group for remediation without having to play hot potato with multiple tickets. It makes the idea of building an effective tier 2 operations team a feasible one.

The improvement that would make the most impact would be expanding on the new EXA big data back end. Currently the queries are limited to simple ones and visualization of the query results does not exist. That being said, it is still incredibly useful and unlike anything else out there. As one would expect, developers have been working on features since before the initial release and there will be many improvements in the near future.

The second criticism I have is the Activity Map. This tool allows one to see all device and protocol connectivity with a selected device or group of devices. It is a fantastic tool for defining client types and tiers in an application. My criticism is that the maps cannot currently be added to a dashboard. Logical application connectivity maps are very nice to have and I would always want one on an application dashboard, given the option.

I was a customer or prospective customer for nearly two years. I was so impressed that, when offered the opportunity to work with the platform as a major part of my job description, I left my stable, well-paying job to go to work for a VAR who is an ExtraHop partner. We've used both the EDA and EXA versions.

Deployment is entirely dependent upon the data feeds. The difficulty in engineering those feeds varies widely depending upon the network architecture. My organization already had a Gigamon visibility fabric in place so, in our case, engineering the feeds properly was fairly simple – ‘done before lunch’ simple. The mid-sized appliance had a 10GBPS limit, which was fine since traffic was generally under six GBPS. When data domain replication or large NetBackup jobs ran, we could just filter that out on the Gigamon to prevent saturating the single link.

I have had no problems with stability.

The appliances are scalable up to 40GBPS and can scale horizontally as well through the use of a command appliance, so no issues there.

Both customer service and support were outstanding when I was a customer. During our POC, they actually developed a new built-in metric based on our input which was in the wild before we had even completed the purchase. Support has always been responsive and knowledgeable.

I was looking to reduce the large amount of time I was spending in deep capture analysis sessions to diagnose application issues. I had some Omni Engines in place to make that job easier – which is a great analyser, by the way – but capture analysis was still a long process of finding the needle in the stack of needles. I was looking for a tool that not only made the analysis easier, but empowered the application owners to do their own analysis. I did an extensive bake-off between ExtraHop and NetScout. The conclusion was that they were two very different products. It took a week of banging on NetScout to get it functional in the first place and, once it was up, I realised that it would be a useful tool for me, but would ensure that every issue would continue to come to me because I would be the only one who could leverage it. ExtraHop, on the other hand, was useable the afternoon I plugged it in and solving problems immediately. Not only that, but it was useable by all the IT silos. While engaged in troubleshooting activities I would provide reports generated from ExtraHop, which would usually result in someone asking where that amazing data was coming from. The conversation often resulted in my creating accounts for new users. It was clearly a tool that empowered others.

The logical setup is extremely simple. There is also a large body of customization that is simple to deploy thanks to the community bundles that can be downloaded and installed. ExtraHop also has a process called a quick start, which is a week-long engagement where an ExtraHop engineer executes or validates the install and builds a few dashboards to operationalize the most important applications. The process of defining and dashboarding applications can be a bit time consuming to get it just right, but that is normal for deep customization. The more dashboards there are to provide templates, the easier future ones become. Customization can be as complex as one wants to get – even to the point of bubbling up business analytics from the wire data.

The only engineering challenge is the data feed. As I mentioned, the organization where I worked had a Gigamon, which simplified things. A couple of SPAN ports on core data center switches usually gets the majority of the visibility. If there are challenges in getting east-west traffic to the data feed (server to server traffic on the same subnet and hypervisor, for instance) there are numerous approaches to getting those packets; it’s doable but sometimes a bit challenging depending on the architecture of the data center. That isn’t an issue with the platform, though, just a challenge in accessing wire data in general.

I implemented myself, although the ExtraHop SE was extremely helpful and responsive throughout the POC process. I have since learned that I was an outlier and a grabby customer. I have witnessed several engagements since then and the SEs are always actively engaged in the process and build customization in before a purchase is even made. After purchase, they have a quick-start process which involves a solutions architect spending a week or two getting the appliance operationalized and building the first few pieces of application customization for the customer.

ROI is tricky, because it depends on how well the tool is worked into the support workflow. In most cases, when used properly, it can reduce root cause from weeks to hours. Sometimes minutes. It can eliminate the majority of the “all-hands” trouble shooting sessions and war rooms by quickly isolating the real issues. It can also proactively identify issues and help prevent outages. In the organization where I worked (and in most others I have seen), there was not a central operations team that handled triaging so adoption was by individual silos. My day job was on the networking team, so I don’t know first-hand the extent to which it was adopted by each group. I do know that requests for packet capture analysis almost entirely dried up and I could spend much more of my time on that day job which, I am afraid, was the primary metric I was concerned with at the time.

ExtraHop is far ahead of anything comparable in the industry. As a matter of fact, there isn’t anything that really compares. It is a wire-data driven operational analytics platform that provides network flow and application transaction performance monitoring out of the box. That description really doesn’t do it justice, though.

The ExtraHop website has a demo environment that will walk someone through numerous scenarios. It is well put together, but can be a bit overwhelming without some context or experience. I recommend having a look, but then scheduling a demo with ExtraHop, or with a VAR like the one for which I work. All that being said, these are demo environments and what it the platform can do seems a bit unbelievable at times. As a customer, I know I wouldn’t have believed it without seeing it. The real proof is in the POC. If you can set up SPAN sessions on the core data center switches, ExtraHop would be delighted to send you an appliance and help to get it deployed so you can see for yourself. Don’t take my word for it in any case. Do a POC.