ExtraHop alert integration

Send ExtraHop Reveal(x) security and performance detections to Flashduty On-call through the Custom Webhook target of a detection notification rule. Flashduty uses the detection id as the Alert Key, so repeated updates of one detection merge into one alert. ExtraHop’s documentation does not describe a notification when a detection is closed or resolved, so Flashduty does not recover these alerts automatically. Turn on the channel’s auto-resolve timeout (see Detections and recovery), or close alerts by hand once the detection is handled.

Configure ExtraHop

You need NDR or NPM module access with full write privileges or higher. Webhooks are sent over TCP 443 (HTTPS), so ExtraHop must be able to reach the Flashduty push URL.

Create a notification rule in ExtraHop

Where: ExtraHop (https://<extrahop-hostname-or-ip>) › System Settings › Notification Rules › Create

Field	Value
Rule type (Required)	Security Detection for NDR modules, Performance Detection for NPM modules
Rule name (Required)	A name of your choice
Criteria (Optional)	The conditions that trigger a notification, for example Minimum Risk Score, Category, or Site

Configure the Custom Webhook

Where: ExtraHop › System Settings › Notification Rules

Field	Value
Target (Required)	`Custom Webhook`
Payload URL (Required)	`{integration_url}`. That parameter is the authentication, so the custom headers and Basic or Bearer authentication under Show Advanced Connection Options can stay empty
Notification Behavior (Required)	`Send for every detection update`
Payload Options (Required)	`Default payload`. The default payload carries `id`, `title`, `type`, `description`, `url`, `risk_score`, `src`, and `dst`, which Flashduty reads directly

Click Save.If you select Send once per detection, ExtraHop requires a custom payload. Add the detection ID to the suggested JSON so Flashduty can identify it (requests without id are rejected). risk_score and site are optional and feed the severity and labels:

{
    "id": {{ id }},
    "title": "{{ title }}",
    "type": "{{ type }}",
    "url": "{{ url }}",
    "description": "{{ description }}",
    "risk_score": {{ risk_score }},
    "site": "{{ site }}",
    "categories_string": "{{ categories_string }}",
    "victim_primary": {{ victim_primary | safe }},
    "offender_primary": {{ offender_primary | safe }}
}

Test the connection and verify

Where: ExtraHop › System Settings › Notification RulesClick Test Connection. ExtraHop sends a message titled Test Notification to the Payload URL. ExtraHop does not document the message body and Flashduty does not special-case it, so a test message without a detection id returns a parameter error. That only shows the URL is reachable; it does not mean the setup is wrong, and it is not proof that the setup works.Wait for a detection that matches the criteria and confirm that Flashduty receives the alert. Detections have no recovery notification, so the alert does not recover automatically; see “Detections and recovery” below.After a few seconds, go back to Flashduty. If the integration shows a Latest event time, the setup works.

Alert key

Flashduty uses id (ExtraHop defines it as “The unique identifier for the detection”) as the Alert Key. Every update of one detection carries the same id and merges into one alert. Changes to the title, description, risk score, and time do not change the Alert Key. Requests without id are rejected.

Detections and recovery

ExtraHop detection notifications cover creation and updates only. The documentation does not describe a notification when a detection is closed or resolved. Every notification Flashduty receives is a trigger, and none recovers an alert automatically. Turn on the channel’s auto-resolve timeout, 24 hours recommended, or close the alert by hand once the detection is handled.

Status and severity

Severity comes from risk_score, using the same bands as the ExtraHop console colors:

risk_score	Flashduty severity
80 and above (red)	Critical
31-79 (orange)	Warning
1-30 (yellow)	Info
Missing, 0, or non-numeric (performance detections have no risk score)	Warning

Labels

Label	Source
`source`	Always `extrahop`
`detection_id`	`id`
`detection_type`	`type`
`detection_url`	`url`
`risk_score`	`risk_score`
`site`	`site`
`category`	`categories_string`
`src_host` / `src_ip`	`src.hostname` / `src.ipaddr`
`dst_host` / `dst_ip`	`dst.hostname` / `dst.ipaddr`
`offender` / `victim`	Name of `offender_primary` / `victim_primary`, or the IP when there is no name

The alert title is title, falling back to type and then ExtraHop detection <id>. The description is the detection description followed by the link to the detection.

Troubleshooting

Flashduty returns a parameter error: check that the URL is complete and includes integration_key, and that the payload contains id
Alerts never close: ExtraHop sends no recovery notification. Turn on the channel’s auto-resolve timeout or close alerts by hand
Several notifications for one detection: with Send for every detection update, ExtraHop sends a notification on each update and they merge into one Flashduty alert. Select Send once per detection if you do not want update notifications

For more on the fields, see the ExtraHop detection notification rule documentation.

Quick Start

Product Comparison

Channels

Incident Management

Post-Mortem

Status Page

Analytics

Integration Settings

Configuration

Advanced

Integrations

Best Practices