2024 Global Cyber Confidence Index

Arrow pointing right
ExtraHop Logo
  • Productschevron right
  • Solutionschevron right
  • Why ExtraHopchevron right
  • Blogchevron right
  • Resourceschevron right

Arrow pointing leftBlog

ExtraHop Reveal(x) + Microsoft Azure Sentinel

Enhance Your SIEM with Cloud-Native NDR

Stephen DeSanto

November 5, 2019

The ExtraHop integration with Microsoft Azure Sentinel combines what Reveal(x) 360 does best—providing packet-level visibility, real-time threat detection, and fast investigation with Azure Sentinel's cloud-native security information and event management capabilities.

Watch the video below to learn more, and continue reading for a deeper description of how the integration works, why it's valuable, and how to integrate SaaS-based Reveal(x) 360 network detection and response (NDR) to your Azure Sentinel SIEM.

How It Works + Why It's Valuable + How to Integrate

How It Works

Reveal(x) 360 monitors and analyzes network traffic in the east-west corridor, filling in visibility gaps left by data sources your Azure Sentinel SIEM already uses. With cloud-scale machine learning-powered behavioral detections, Reveal(x) 360 is able to send high-fidelity alerts to Azure Sentinel for further investigation and/or response.

Azure Sentinel Integration

Why It's Valuable

Network data and behavioral detections from Reveal(x) 360 supplement the log data your Azure Sentinel SIEM already uses to increase visibility and detect threats across Azure workloads in real time. With automated asset discovery, classification, and dependency mapping, Reveal(x) 360 provides an always up-to-date inventory of assets in Azure and hybrid environments.

The Reveal(x) 360 integration with Azure Sentinel also enables security teams to orchestrate and automate responses through playbooks based on their unique security policies for faster remediation:

Azure Sentinel Playbook

The Reveal(x) data connector allows Azure Sentinel to automatically import wire and detection data to a dedicated workbook conveniently located in the Sentinel user interface:

Azure Sentinel Workbook

By clicking into the ExtraHop workbook, you gain a complete picture of suspicious or anomalous behavior occurring anywhere in your Azure or hybrid environment. You can view detections in a timeline, as well as by category, IP address, and more:

ExtraHop Detections

Reveal(x) 360 detection data also integrates with custom Jupyter notebooks that SecOps can use to conduct more in-depth investigations and hunt for threats:

Azure Sentinel Notebook

How to Integrate SaaS-based NDR to Your Azure Sentinel SIEM

To get started using the Reveal(x) integration with Azure Sentinel:

  • Visit the ExtraHop Bundles Gallery to download the ExtraHop Detection SIEM Connector bundle.
  • Go to your Azure Sentinel workspace, select data connectors from the menu, and then select the ExtraHop Reveal(x) connector to begin setting up the connection.

If you would like more information about the ExtraHop Reveal(x) integration with Azure Sentinel, please visit our Microsoft integration page.

To try Reveal(x) 360 for yourself, head to our online demo—a full, unthrottled version of our NDR solution running on example data.

Explore related articles

Experience RevealX NDR for Yourself

Schedule a demo