of encrypted lateral movement, living off the land, and encrypted exploit attempts of CVEs such as PrintNightmare, ProxyLogon, Log4Shell, and Spring4Shell. –Detection of cloud attack techniques (eg, AWS IMDS proxying, AWS services enumeration) –Hygiene detections (eg, insecure protocols, passwords in plaintext) –IoT detections (abnormal behavior observed on an IoT device of a specific make and model) –Network-based detection of abuse of encrypted Microsoft protocols (Active Directory, Kerberos, SMBv3, MSRPC), as well as TLS 1.3 –User behavior (eg, abnormal login behavior) ExtraHop Reveal(x) works by extracting metadata from raw network traffic across more than 70 protocols, including the ability to decrypt Microsoft application and authentication protocols and Transport_Layer_Security#TLS_1.3. This data includes natively discovered information about endpoints/users such as MAC, Hostname, OS, software, application layer information, usernames, geolocation, passive DNS, and whois. Reveal(x) data can be enriched with threat intelligence and endpoint process data from partner products. ExtraHop detections include a timeline of related events, MITRE ATT&CK techniques, next steps for investigation and remediation, and 1-click access to forensic data such as transaction records and decrypted packets. These data can also be explored/filtered as a starting point for threat hunts. Customers can build, reuse, and share libraries of saved queries to speed recurring threat hunting tasks. The core of ExtraHop technology is a passive network appliance that uses a network tap or port mirroring to receive network traffic, and then performs full-stream reassembly to extract application-level protocol metrics and other custom-specified information contained in the transaction payload. A subset of these metrics is sent to the cloud where they are used as machine learning features to proactively detect anomalous behavior that could indicate data breaches, ransomware, and other threats as well as performance issues. The ExtraHop network sensors can be deployed with self-managed physical and virtual appliances, or as a zero-infrastructure SaaS product. Network sensors can be deployed on-premises in data centers, on campus, at remote sites, and in cloud environments including Amazon Web Services (AWS), Microsoft Azure ,and Google Cloud Platform (GCP). Integrations ExtraHop Reveal(x) natively integrates with a number of technology products, including endpoint security (CrowdStrike), threat intelligence, and Saas/IaaS/PaaS platforms such as Microsoft 365 and AWS native telemetry. A sample list of known integrations includes: CrowdStrike; Microsoft Defender Security Center; Windows Defender ATP; Microsoft 365; AWS quarantine; Azure Sentinel; Cisco ISE; Palo Alto NGFW, Panorama, Demisto; Splunk SIEM & Phantom; Exabeam; IBM Qradar; ServiceNow; and Check Point. Certifications ExtraHop