back caretBlog

Small Appliance, Big Vision: ExtraHop 5.2

ExtraHop 5.2 launches with amazing new features, new protocols, and a powerful new appliance in a small, plug-and-play package.

What you can't see, you can't understand, interpret, or control. Chances are lack of visibility into your business is a bad thing. What's worse, it's likely you're already experiencing it to some degree, even if you can't currently quantify it. We don't know what we don't know, after all.

Our quest is to drive towards visibility everywhere, with the ExtraHop platform leading the charge. Our newly released version 5.2 brings with it even more of the goodness you love, in a smaller package than ever, which gets us one step closer to this data driven future. Sure, there are improvements aplenty to be had. From UI enhancements, added application support, and expanding the trigger API and many things in between, v5.2 is action packed. Don't worry, I'll cover some of that, hold your horses! The real star of this hits parade though? A revolution in size, scaling, and flexibility: the new small form factor appliance from ExtraHop, the EDA 1100.

We got so excited we made an unboxing video of the EDA 1100. Check it out.

Smaller Than Ever

ExtraHop appliance vs popular game console size comparison

ExtraHop gives you a different kind of control.

How small, you ask? Small enough to masquerade as a "highly popular gaming console" to the untrained eye. We're still interested in an altogether different kind of fragging, though. While it wouldn't get confused for a twin unless you've been on a 36 hour gaming marathon, you can't deny that the size is pretty spot on.

Perhaps more realistically, and definitely more relevant, the new EDA 1100 hits the sweet spot for non-datacenter deployments. Whether sitting on a shelf in a branch office, in the back in a retail store, or just about anywhere else, it's easier than ever to get ExtraHop where you want and need it these days. Not only are you able to collect data anywhere up to and including your cousin's house, should you so choose, you can get meaningful data. Data you can base decisions on. Not just low level flows or basic usage stats. Sure, that's there too, but part of the beauty of the EDA 1100 is that you're still getting the entire ExtraHop platform's power and feature set. Diving deep into your data is just as easy as always. Custom dashboard per region? Go for it. Store specific app groupings? You got it. Site specific trigger? No problem. Oh, and the business intelligence use cases? Don't even get me started. Bottom line, the only thing that's smaller here is the size, not the horsepower.

EDA 1100 with banana for scale

Banana for scale.

I may be biased, but that's a seriously powerful thing. No longer are we limited to grooming through DMZ data with a fine tooth comb. Now we can grab info just about anywhere. No rack of servers ready to spin up a virtual instance? No problem. Jam this baby into a closet, under a desk, or anywhere else that you can feed it an ethernet cable, and you're good to go. This thing is plug-and-play. Ship it some data and sit back and reap the tasty, tasty rewards of data-driven decision making for your business. Not only that, but packing 1Gbps of raw throughput, 570Mbps of bulk SSL encrypted throughput, and supporting over 250 devices, this tiny tiger has teeth.

Solving the Last Mile Problem

It's not always obvious at first how important this kind of thing is, but it really is game changing. There's a severe last mile problem in many businesses that are distributed in some way. What you want is rich data to drive your business decisions. What you don't have is a way to easily gather that. You want to see everything that's happening within your business. At least, I do, I assume you do too. From DICOM messages being sent to an imaging specialist, to app usage behavior out of the office, there's a lot that doesn't happen in a data center. Being able to get your metric-loving hands on that, and get it folded seamlessly into the larger picture, is an evolutionary leap forward in visibility and data driven insight. This allows you to continue driving towards the holy grail of visibility everywhere. That's a good thing, right? Right.

As if that weren't enough about which to be excited (ProTip: It is), 5.2 doesn't stop there, not by a long shot. There's a cavalcade of other goodness to be had. For the sake of time we'll touch on some new features in a speed round of ExtraHop-y goodness.

Easier to Use

Http responses by status code in ExtraHop

The first place that most folks encounter, and continue to make use of the platform, is the web interface. Our UI continues to be refined, tweaked, and improved. This version brings with it a newly redesigned look, refined search functionality, and a new list widget that offers up a huge amount of information while maximizing screen real-estate. Combined these things should allow for a more intuitive and efficient workflow.

Another much requested (note: understatement of the year) feature has been rolled into version 5.2 in the form of user-definable thresholds. What this boils down to is the ability to add a visual marker to your charts to signify an important rate or count in that data. Looking to ensure errors aren't running rampant, load times are under SLA, or connections aren't about to time out? Thresholds make it easy at a glance, without the need for the engineer interpreting the chart to have intimate knowledge of the traffic or application being monitored. It's as simple as "If it's over the red line, call this extension" if you want it to be. That's a huge value add, and is critical as IT support expands its reach outside of the datacenter. No it's cool, I'll wait for the applause to stop. Check out the screenshot below in the meantime.

user-defined thresholds in ExtraHop

User-defined thresholds in ExtraHop.

I know, right? I'm excited too. What's more, it's not just the look and feel of the platform that's gotten a tune-up. There's a host of new and improved features under the hood that are worth digging into.

Smarter, Too

We've added support for new protocols including DICOM, NFSv4, POP3, and Kerberos as well as a host of Network Virtualization protocols - (VXLAN, NVGRE, and Cisco FabricPath). Say that five times fast. This allows us to continue offering deeper insight, particularly in the healthcare and Active Directory arenas. Combine that with new trigger tweaks and additions, expanded support for 1-second metric roll-ups, and the ability to run it all in Azure, and you're starting to get the picture. We've been busy. And by "we" I mean "the wicked smart engineers that build this stuff that I somehow manage to get to play with on a daily basis." Because, I didn't build it. But you knew that. Right, moving on.

EDA isn't the only one getting attention. Version 5.0's poster child for wicked cool data-fu was the ExtraHop Explore Appliance (EXA). We don't have the time or page space here for me to launch into my "Oh my gosh, EXA is HAWESOME!!" rant, but you guys - it totally is. Check it out.

To make it even better, there have been some pretty major improvements to the EXA platform this time around, including an upgraded version of the underlying ElasticSearch platform which makes things faster than ever. Our REST API has been garnering "oohs" and "ahhs" from appreciative crowds of automation geeks (my people…) around the country at our User Groups for a while, and now you can programmatically access all the wickedly powerful transactions and records living in your Explore Appliance as well. Digging into the new scenarios this opens up would be a post in and of itself, but take my word for it, this is some new hotness. If you need me for the next 3 months or so, I'll be playing with this.

So Much Goodness

The long and the short of it is, there's a lot going on here, in a good way. New features, improvements, bug fixes, UI tuning, tasty new trigger features, API access to the EXA, and of course the huge-in-power, tiny-in-size EDA 1100. That thing punches way above its weight class, and I'm excited to see what people do with it. For the whole story as well as upgrade guidance, it's always good to dig through the release notes.

So download, install, dig in, and check it out. If you've got any questions, the community is always out there.

Also check out our new whitepaper: "IT Visibility Everywhere: ExtraHop Across Datacenters, Remote Locations, and the Cloud"

Want to see ExtraHop in action? Start your ExtraHop demo

ExtraHop Reveal(x) Live Activity Map

Stop Breaches 87% Faster

Investigate a live attack in the full product demo of ExtraHop Reveal(x), network detection and response, to see how it accelerates workflows.

Start Demo

Sign Up to Stay Informed