ExtraHop Reveal(x) + Microsoft Azure Sentinel

The ExtraHop integration with Microsoft Azure Sentinel combines what Reveal(x) 360 does best—providing packet-level visibility, real-time threat detection, and fast investigation with Azure Sentinel's cloud-native security information and event management capabilities.

Watch the video below to learn more, and continue reading for a deeper description of how the integration works, why it's valuable, and how to integrate SaaS-based Reveal(x) 360 network detection and response (NDR) to your Azure Sentinel SIEM.

How It Works + Why It's Valuable + How to Integrate

How It Works

Reveal(x) 360 monitors and analyzes network traffic in the east-west corridor, filling in visibility gaps left by data sources your Azure Sentinel SIEM already uses. With cloud-scale machine learning-powered behavioral detections, Reveal(x) 360 is able to send high-fidelity alerts to Azure Sentinel for further investigation and/or response.

Why It's Valuable

Network data and behavioral detections from Reveal(x) 360 supplement the log data your Azure Sentinel SIEM already uses to increase visibility and detect threats across Azure workloads in real time. With automated asset discovery, classification, and dependency mapping, Reveal(x) 360 provides an always up-to-date inventory of assets in Azure and hybrid environments.

The Reveal(x) 360 integration with Azure Sentinel also enables security teams to orchestrate and automate responses through playbooks based on their unique security policies for faster remediation:

The Reveal(x) data connector allows Azure Sentinel to automatically import wire and detection data to a dedicated workbook conveniently located in the Sentinel user interface:

By clicking into the ExtraHop workbook, you gain a complete picture of suspicious or anomalous behavior occurring anywhere in your Azure or hybrid environment. You can view detections in a timeline, as well as by category, IP address, and more:

Reveal(x) 360 detection data also integrates with custom Jupyter notebooks that SecOps can use to conduct more in-depth investigations and hunt for threats:

How to Integrate SaaS-based NDR to Your Azure Sentinel SIEM

To get started using the Reveal(x) integration with Azure Sentinel:

• Go to your Azure Sentinel workspace, select data connectors from the menu, and then select the ExtraHop Reveal(x) connector to begin setting up the connection.

If you would like more information about the ExtraHop Reveal(x) integration with Azure Sentinel, please visit our Microsoft integration page.

To try Reveal(x) 360 for yourself, head to our online demo—a full, unthrottled version of our NDR solution running on example data.