back caretBlog

Replay of an IT Support Incident - ExtraHop In the Wild

picture-28A fun part of the ExtraHop customer engagement model is something we call the "Show-n-Tell". For any customer evaluation, we'll install the box (a 15-minute process), let the box "soak-in" for a few days, then come on-site for a presentation to all relevant stakeholders (network groups, app support groups, DBAs, storage teams, windows admins, you name it). With the help of the customer, we navigate their networks and systems live in the ExtraHop UI and show them exactly what's going on. This is always fun because we love seeing our product "doing its thing" in the real world, and the customers love getting all this visibility that they just never had before.

Here's kind of a typical "Show-n-Tell" from this week, and this is how it went down:

ExtraHop: So tell us about a recent incident.

Customer: Well, we had these screaming users call us Tue afternoon around 3pm, complaining about extreme slow response time with our accounting system, which they are accessing through Citrix.

ExtraHop: (navigating and zooming in to 3pm on Tuesday) You mean these users at these IP addresses (meanwhile showing the impacted end points on screen)?

Customer: Yes, that's exactly right.

ExtraHop: This is showing they're seeing 400+ms response times, with frequent stalls.

Customer: No wonder they're calling in.

ExtraHop: And look, here's another user with a different IP whose response time averaged 5 ms when interacting with the same server.

Customer: That's our help desk.

ExtraHop: Let me guess, the remote users call in to complain, Help desk logged into the same system and said "nope, no problem here". Well let's figure out why it was slow. (More click throughs and navigation) Well it looks like you're moving Gigs of data over the WAN at around the same time?

Customer: Full database back up in the middle of the day? No wonder!

End of Shown-n-Tell and another IT Support mystery solved!

  • Helen
ExtraHop Reveal(x) Live Activity Map

Stop Breaches 87% Faster

Investigate a live attack in the full product demo of ExtraHop Reveal(x), network detection and response, to see how it accelerates workflows.

Start Demo

Sign Up to Stay Informed