Home Orlando Now Platform Capabilities Now Platform capabilities Configuration Management Database Integrating third-party data into the CMDB Service Graph connector for ExtraHop (2.0.3)

Service Graph connector for ExtraHop (2.0.3)

Use the Service Graph connector for ExtraHop to pull data from the ExtraHop application into your ServiceNow instance.

The Service Graph connector for ExtraHop provides real-time network visibility across your enterprise by implementing stream processing, so that you can transform your network data into structured wire data.

The Service Graph connector for ExtraHop pulls network visibility data into the ServiceNow® Configuration Management Database (CMDB) application. The connector enriches discovered device data and establishes relationships between devices based on network traffic flow.

Request apps on the Store

Visit the ServiceNow Store website to view all the available apps and for information about submitting requests to the store. For cumulative release note information for all released apps, see the ServiceNow Store version history release notes.

System requirements and supported versions

Dependencies and requirements:

MID Server that is installed on Linux or Windows, unless the ExtraHop appliance is publicly accessible.
ExtraHop Discover appliance with firmware version 7.2 or later with a user account that has unlimited privileges.

Supported versions: ExtraHop v7.9

Supported ServiceNow versions:

Starting with Orlando Patch 7.
Starting with Paris Patch 1.

Use cases

The following are examples on how you can use the Service Graph connector:

Identification of network interactions between CIs.
Discovery of network traffic flow data between computers or other types of hardware.
Creation of relationships between devices. The relationships are based on network traffic flow.

Guided setup

The guided setup for the Service Graph connector for ExtraHop provides an organized sequence of tasks to configure the integration on your instance. To access the guided setup, see Configure Service Graph connector for ExtraHop.

CMDB Integrations Dashboard

The Integration Commons for the CMDB store app provides a dashboard with a central view of the status, processing results, and processing errors of all installed Service Graph connectors. You can see metrics for all integration runs. You can also filter the view to a specific CMDB integration, a specific time duration, or a specific integration run. For more details about monitoring ExtraHop integrations in the CMDB Integrations Dashboard, see CMDB Integrations Dashboard.

Data mappings

Data from data sources in the ExtraHop application is mapped and transformed into the ServiceNow CMDB Configuration Item (CI) class definitions using the Robust Transform Engine (RTE). Data is inserted into the ServiceNow CMDB using the Identification and Reconciliation Engine (IRE).

When you complete the guided setup, you can configure the integration to periodically pull data from the ExtraHop application. The data is loaded into the following staging tables:

ExtraHop Computer [sn_extrahop_integr_computer]
ExtraHop Network Activity [sn_extrahop_integr_activity]

The data is then inserted into the following target tables:

CI Relationship [cmdb_rel_ci]
Hardware [cmdb_ci_hardware]
IP Address [cmdb_ci_ip_address]
Network Adapter [cmdb_ci_network_adapter]

Configure Service Graph connector for ExtraHop

Set up a REST message and scheduled jobs to import ExtraHop data into your CMDB.

Before you begin

To use this Service Graph connector, you need a subscription to a Subscription Unit that is based in the ServiceNow® IT Operations Management (ITOM) Visibility application or in the ITOM Discovery application. As defined in the section titled "Managed IT Resource Types" in ServiceNow Subscription Unit Overview, for managed IT resources that are created or modified in the CMDB by this Service Graph connector, but that are not yet managed by ITOM Visibility or ITOM Discovery, these resources will increase Subscription Unit consumption from that application. Review your current Subscription Unit consumption within ITOM Visibility or ITOM Discovery to ensure available capacity.

Dependencies and requirements:

The Integration Commons for CMDB store app, which is automatically installed.
The CMDB CI Class Models store app, which is automatically installed.
ITOM Licensing plugin (com.snc.itom.license). For more information, see Request Discovery.
ITOM Discovery License plugin (com.snc.itom.discovery.license). You must activate this plugin.
MID Server that is installed on Linux or Windows, unless the ExtraHop appliance is publicly accessible.
ExtraHop Discover appliance with firmware version 7.2 or later, with a user account that has unlimited privileges.
To connect to the ExtraHop application, configure an API key. For more information, see ExtraHop REST API Guide, specifically, see the "ExtraHop API requirements" section.

Roles required: admin

Procedure

Navigate to Service Graph Connector ExtraHop > Setup.
On the Getting started page, click Get Started.
On the Service Graph connector for the ExtraHop page, in the Configure REST message section, select the task Configure ExtraHop REST message.

To configure a REST message to use when sending requests to the ExtraHop API, complete the following steps:

On the next page, in the Configure ExtraHop REST message task section, click Configure.

On the form, fill in the fields.

Table 1. REST Message form
Field	Description
Name	Descriptive name for this REST Message. This field is automatically set.
Endpoint	URL to the web service API endpoint. Set the field to a base URL. For example, `https://myextrahop.com`. Note: Updating the Endpoint base URL also updates the base URLs for all HTTP methods that are associated with the ExtraHop REST message. In the HTTP Request tab, update the Authorization header to use your API key in the Value field.
Description	Description for this REST Message. This field is automatically set.
Application	Application that contains this message. The field is automatically set.
Authentication type	Type of authentication to apply to HTTP requests. The field is automatically set.
Use mutual authentication	Option to use multiple authentication by authenticating HTTP requests. Mutual authentication cannot be used with a MID Server.

Click Update if necessary.
In the Configure ExtraHop REST message task section, click Mark as Complete.

To test the connection to the ExtraHop Computer API, complete the following steps:

In the Test Computer connection task section, click Configure.

On the form, fill in the fields.

Table 2. HTTP Method form
Field	Description
Name	Unique identifier for this HTTP method. This field is automatically set.
Endpoint	URL to the web service API endpoint
Use MID Server	MID Server that sends this HTTP request. Using a MID Server is not compatible with mutual authentication.
REST Message	REST message record that this method is based on. This field is automatically set.
HTTP method	HTTP method that is implemented by this method. This field is automatically set.
Application	Application that contains this method. This field is automatically set.
Authentication type	Type of authentication to apply to HTTP requests.
Use mutual authentication	Option to use multiple authentication by authenticating HTTP requests. Mutual authentication cannot be used with a MID Server.

Select the HTTP Request tab and fill out the Use MID Server field.
Click the Authentication tab and then click the Test related link.
Testing the connection takes a few moments. When the test is complete, the page is refreshed and shows the test results.
Select Mark as Complete.

Note: The connection is successful if the HTTP Status field is set to 200. If there are any errors in the Error Message field, then the connection failed and further troubleshooting is required.
Click Update if necessary.
In the Test Computer connection task section, click Mark as Complete.

To test the connection to the ExtraHop Network Activity Create API, complete the following steps:

In the Test Network Activity Create connection task section, click Configure.

On the form, fill in the fields.

Table 3. HTTP Method form
Field	Description
Name	Unique identifier for this HTTP method.
Endpoint	URL to the web service API endpoint
Use MID Server	MID Server that sends this HTTP request. Using a MID Server is not compatible with mutual authentication.
REST Message	REST message that this method is based on. This field is automatically set.
HTTP method	HTTP method that is implemented by this method. This field is automatically set.
Application	Application that contains this record. This field is automatically set.
Authentication type	Type of authentication to apply to HTTP requests. This field is automatically set.
Use mutual authentication	Option to use multiple authentication by authenticating HTTP requests. Mutual authentication cannot be used with a MID Server.

Click the Authentication tab and then click the Test related link.
Testing the connection takes a few moments. When the test is complete, the page is refreshed and shows the test results.
Select Mark as Complete.

Note: The connection is successful if the HTTP Status field is set to 200. If there are any errors in the Error Message field, then the connection failed and further troubleshooting is required.
Click Update if necessary.
In the Test Network Activity Create connection task section, click Mark as Complete.

On the left sidebar, click the Set up scheduled import jobs button.

On the Service Graph Connector for ExtraHop page, in the Set up scheduled import jobs section, select the task Configure Computer scheduled job.

In the Configure Computer scheduled job task section, click Configure.

On the form, fill in the fields.

Table 4. Scheduled Data Import form
Field	Description
Name	Name of the scheduled job.
Data source	Data source record that defines the data to import.
Run as	Option to run the scheduled job with the credentials of the specified user.
Active	Option to activate the scheduled job. Select this option.
Concurrent Import	Function that loads the data from multiple import sets. The function then processes and transforms the data concurrently.
Partition Method	Partition method for the concurrent import set.
Partition Size	Import set size for early scheduling.
Execute pre-import script	Option to specify a script to run before the import is performed.
Execute post-import script	Option to specify a script to run after the import is performed.
Application	Application that contains this scheduled job.
Run	Frequency of running the import.
Conditional	Conditions under which this job is executed.

Click Update if necessary.
In the Configure Computer scheduled job task section, click Mark as Complete.

On the Service Graph Connector for ExtraHop page, in the Set up scheduled import jobs section, select the task Configure Network Activity scheduled job.

In the Configure Network Activity scheduled job task section, click Configure.

On the form, fill in the fields.

Table 5. Scheduled Data Import form
Field	Description
Name	Name of the scheduled job.
Data source	Data source record that defines the data to import.
Run as	Option to run the scheduled job with the credentials of the specified user.
Active	Option to activate the scheduled job. Select this option.
Concurrent Import	Function that loads the data from multiple import sets. The function then processes and transforms the data concurrently.
Partition Method	Partition method for the concurrent import set.
Partition Size	Import set size for early scheduling.
Execute pre-import script	Option to specify a script to run before the import is performed.
Execute post-import script	Option to specify a script to run after the import is performed.
Application	Application that contains this scheduled job.
Run	Frequency of running the import.
Conditional	Conditions under which this job is executed.

Click Update if necessary.
In the Configure Network Activity scheduled job task section, click Mark as Complete.

Previous topic

Next topic

Release version

Service Graph connector for ExtraHop (2.0.3)

Use the Service Graph connector for ExtraHop to pull data from the ExtraHop application into your ServiceNow instance.

Request apps on the Store

System requirements and supported versions

Dependencies and requirements:

MID Server that is installed on Linux or Windows, unless the ExtraHop appliance is publicly accessible.
ExtraHop Discover appliance with firmware version 7.2 or later with a user account that has unlimited privileges.

Supported versions: ExtraHop v7.9

Supported ServiceNow versions:

Starting with Orlando Patch 7.
Starting with Paris Patch 1.

Use cases

The following are examples on how you can use the Service Graph connector:

Identification of network interactions between CIs.
Discovery of network traffic flow data between computers or other types of hardware.
Creation of relationships between devices. The relationships are based on network traffic flow.

Guided setup

CMDB Integrations Dashboard

Data mappings

When you complete the guided setup, you can configure the integration to periodically pull data from the ExtraHop application. The data is loaded into the following staging tables:

ExtraHop Computer [sn_extrahop_integr_computer]
ExtraHop Network Activity [sn_extrahop_integr_activity]

The data is then inserted into the following target tables:

CI Relationship [cmdb_rel_ci]
Hardware [cmdb_ci_hardware]
IP Address [cmdb_ci_ip_address]
Network Adapter [cmdb_ci_network_adapter]

Configure Service Graph connector for ExtraHop

Set up a REST message and scheduled jobs to import ExtraHop data into your CMDB.

Before you begin

Dependencies and requirements:

The Integration Commons for CMDB store app, which is automatically installed.
The CMDB CI Class Models store app, which is automatically installed.
ITOM Licensing plugin (com.snc.itom.license). For more information, see Request Discovery.
ITOM Discovery License plugin (com.snc.itom.discovery.license). You must activate this plugin.
MID Server that is installed on Linux or Windows, unless the ExtraHop appliance is publicly accessible.
ExtraHop Discover appliance with firmware version 7.2 or later, with a user account that has unlimited privileges.
To connect to the ExtraHop application, configure an API key. For more information, see ExtraHop REST API Guide, specifically, see the "ExtraHop API requirements" section.

Roles required: admin

Procedure

Navigate to Service Graph Connector ExtraHop > Setup.
On the Getting started page, click Get Started.
On the Service Graph connector for the ExtraHop page, in the Configure REST message section, select the task Configure ExtraHop REST message.

To configure a REST message to use when sending requests to the ExtraHop API, complete the following steps:

On the next page, in the Configure ExtraHop REST message task section, click Configure.

On the form, fill in the fields.

Table 1. REST Message form
Field	Description
Name	Descriptive name for this REST Message. This field is automatically set.
Endpoint	URL to the web service API endpoint. Set the field to a base URL. For example, `https://myextrahop.com`. Note: Updating the Endpoint base URL also updates the base URLs for all HTTP methods that are associated with the ExtraHop REST message. In the HTTP Request tab, update the Authorization header to use your API key in the Value field.
Description	Description for this REST Message. This field is automatically set.
Application	Application that contains this message. The field is automatically set.
Authentication type	Type of authentication to apply to HTTP requests. The field is automatically set.
Use mutual authentication	Option to use multiple authentication by authenticating HTTP requests. Mutual authentication cannot be used with a MID Server.

Click Update if necessary.
In the Configure ExtraHop REST message task section, click Mark as Complete.

To test the connection to the ExtraHop Computer API, complete the following steps:

In the Test Computer connection task section, click Configure.

On the form, fill in the fields.

Table 2. HTTP Method form
Field	Description
Name	Unique identifier for this HTTP method. This field is automatically set.
Endpoint	URL to the web service API endpoint
Use MID Server	MID Server that sends this HTTP request. Using a MID Server is not compatible with mutual authentication.
REST Message	REST message record that this method is based on. This field is automatically set.
HTTP method	HTTP method that is implemented by this method. This field is automatically set.
Application	Application that contains this method. This field is automatically set.
Authentication type	Type of authentication to apply to HTTP requests.
Use mutual authentication	Option to use multiple authentication by authenticating HTTP requests. Mutual authentication cannot be used with a MID Server.

Select the HTTP Request tab and fill out the Use MID Server field.
Click the Authentication tab and then click the Test related link.
Testing the connection takes a few moments. When the test is complete, the page is refreshed and shows the test results.
Select Mark as Complete.

Note: The connection is successful if the HTTP Status field is set to 200. If there are any errors in the Error Message field, then the connection failed and further troubleshooting is required.
Click Update if necessary.
In the Test Computer connection task section, click Mark as Complete.

To test the connection to the ExtraHop Network Activity Create API, complete the following steps:

In the Test Network Activity Create connection task section, click Configure.

On the form, fill in the fields.

Table 3. HTTP Method form
Field	Description
Name	Unique identifier for this HTTP method.
Endpoint	URL to the web service API endpoint
Use MID Server	MID Server that sends this HTTP request. Using a MID Server is not compatible with mutual authentication.
REST Message	REST message that this method is based on. This field is automatically set.
HTTP method	HTTP method that is implemented by this method. This field is automatically set.
Application	Application that contains this record. This field is automatically set.
Authentication type	Type of authentication to apply to HTTP requests. This field is automatically set.
Use mutual authentication	Option to use multiple authentication by authenticating HTTP requests. Mutual authentication cannot be used with a MID Server.

Click the Authentication tab and then click the Test related link.
Testing the connection takes a few moments. When the test is complete, the page is refreshed and shows the test results.
Select Mark as Complete.

Note: The connection is successful if the HTTP Status field is set to 200. If there are any errors in the Error Message field, then the connection failed and further troubleshooting is required.
Click Update if necessary.
In the Test Network Activity Create connection task section, click Mark as Complete.

On the left sidebar, click the Set up scheduled import jobs button.

On the Service Graph Connector for ExtraHop page, in the Set up scheduled import jobs section, select the task Configure Computer scheduled job.

In the Configure Computer scheduled job task section, click Configure.

On the form, fill in the fields.

Table 4. Scheduled Data Import form
Field	Description
Name	Name of the scheduled job.
Data source	Data source record that defines the data to import.
Run as	Option to run the scheduled job with the credentials of the specified user.
Active	Option to activate the scheduled job. Select this option.
Concurrent Import	Function that loads the data from multiple import sets. The function then processes and transforms the data concurrently.
Partition Method	Partition method for the concurrent import set.
Partition Size	Import set size for early scheduling.
Execute pre-import script	Option to specify a script to run before the import is performed.
Execute post-import script	Option to specify a script to run after the import is performed.
Application	Application that contains this scheduled job.
Run	Frequency of running the import.
Conditional	Conditions under which this job is executed.

Click Update if necessary.
In the Configure Computer scheduled job task section, click Mark as Complete.

On the Service Graph Connector for ExtraHop page, in the Set up scheduled import jobs section, select the task Configure Network Activity scheduled job.

In the Configure Network Activity scheduled job task section, click Configure.

On the form, fill in the fields.

Table 5. Scheduled Data Import form
Field	Description
Name	Name of the scheduled job.
Data source	Data source record that defines the data to import.
Run as	Option to run the scheduled job with the credentials of the specified user.
Active	Option to activate the scheduled job. Select this option.
Concurrent Import	Function that loads the data from multiple import sets. The function then processes and transforms the data concurrently.
Partition Method	Partition method for the concurrent import set.
Partition Size	Import set size for early scheduling.
Execute pre-import script	Option to specify a script to run before the import is performed.
Execute post-import script	Option to specify a script to run after the import is performed.
Application	Application that contains this scheduled job.
Run	Frequency of running the import.
Conditional	Conditions under which this job is executed.

Click Update if necessary.
In the Configure Network Activity scheduled job task section, click Mark as Complete.

How search works:

Topics are ranked in search results by how closely they match your search terms

Service Graph connector for ExtraHop (2.0.3)

Service Graph connector for ExtraHop (2.0.3)

Request apps on the Store

System requirements and supported versions

Use cases

Guided setup

CMDB Integrations Dashboard

Data mappings

Configure Service Graph connector for ExtraHop

On this page

Service Graph connector for ExtraHop (2.0.3)

Service Graph connector for ExtraHop (2.0.3)

Request apps on the Store

System requirements and supported versions

Use cases

Guided setup

CMDB Integrations Dashboard

Data mappings

Configure Service Graph connector for ExtraHop

Log in to personalize your search results and subscribe to topics