ExtraHop - Get Peers by Host

Retrieves the peer network devices that communicated with that host in a given time range, when given a host. In addition to a list of peers and protocols (sorted by bytes) the playbook returns a link to the ExtraHop Live Activity Map to visualize the peer relationships.

Dependencies#

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks#

This playbook does not use any sub-playbooks.

Integrations#

This playbook does not use any integrations.

Scripts#

  • Exists

Commands#

  • extrahop-get-peers
  • extrahop-device-search
  • extrahop-get-activity-map

Playbook Inputs#


NameDescriptionRequired
nameThe name of the device. This searches for matches on all ExtraHop name fields (DHCP, DNS, NetBIOS, Cisco Discovery Protocol, etc.).Optional
ipThe IP address of the device.Optional
macThe MAC address of the device.Optional
from_timeThe beginning timestamp of the time range the playbook will use to search, expressed in seconds since the epoch.Optional
until_timeThe ending timestamp of the time range the playbook will use to search, expressed in seconds since the epoch.Optional

Playbook Outputs#


PathDescriptionType
ExtraHop.DeviceThe details on the host and any peer devices found.unknown
ExtraHop.ActivityMapThe link to a visual activity map in ExtraHop.string

Playbook Image#


ExtraHop_Get_Peers_by_Host