CrowdStrike and ExtraHop Integrated Lab

WWT's ATC ExtraHop & Crowdstrike Integration Proving Ground Lab exists to provide a unified solution built around relevant use cases. It will showcase ExtraHop and CrowdStrike's excellent integration to stop breaches before they can cause damage.

ExtraHop Reveal(x) 360 is a dynamic cyber defense platform that uses cloud-scale AI to help enterprises detect and respond to advanced threats—before they compromise your business. With complete visibility from ExtraHop, enterprises can detect intrusions, hunt threats and investigate incidents with confidence. When you don't have to choose between protecting your business and moving it forward, that's security, uncompromised.

The CrowdStrike Falcon enterprise protection platform is powered by cloud-scale AI running on the proprietary Threat Graph database and patented smart-filtering technology. Defend enterprise organization without compromising speed and performance with cloud-based architecture to secure workloads and workforce anywhere and at any given time.

The purpose of this lab is to show ExtraHop's network detection capabilities and how it integrates with CrowdStrike. By showing this, you can see how having both tools give a more unified coverage of your network, and both work better together.

This lab allows you to:

• Log in to the ExtraHop Reveal(x)360 cloud-based platform.
• Navigate the ExtraHop detections, dashboards and assets.
• See how ExtraHop can Leverage CrowdStrike Threat Intelligence.
• See how ExtraHop can leverage their Push Button Response to contain hosts in CrowdStrike on demand.

Software

• CrowdStrike Falcon
• Okta (Single Sign On)
• Palo Alto VM-Series firewall
• Active Directory (w/DNS)
• RPCAPD

Servers

• 1x ExtraHop Packet Sensor
• 1x Windows Jumphost (Windows Server 2016)
• 1x Microsoft SQL Server 2016 (Windows Server 2016)
• 1x Spare Server (Windows Server 2016)
• 1x Syslog Server (CentOS 7)

Clients

• 4x Windows 10 Clients (Windows 10 Enterprise)
• 3x Windows 7 Clients (Windows 7 Enterprise)
• 3x Red Hat Clients (Red Hat Enterprise Linux 7)
• 1x Attack Client (Kali Linux)