Thanks for this feedback; it’s great to hear that there are specific detection types you find valuable enough to want in your email inbox.
When we approach the subject of detection alerts, one of our early concerns was how alert configurations would withstand changes in how we lay out our detection taxonomy. In the early days of Reveal(x) detections didn’t even have a single
type field; they had titles, categories, and protocols.
Detection.type exists, it’s possible to imagine choosing one from a list and saying “email me when this one fires,” if we can answer the question, “what should we do if that detection type goes away?” This question is less academic than it sounds: We’ve subdivided a number of detection types into more specific types over the life of Reveal(x), e.g.
The question is, “what does the alert creator want the system to do now?” Never sending another email because
Detection.type === "foo" is never true again probably isn’t correct.
The best option is probably to - when a detection type is retired - somehow tell the alert recipients (or a system admin) so they can fix the problem. We could try to track the two successor types for
foo, but over multiple generations of edits that could lead to some weird end states which would probably surprise the alert creator.
That explains why it’s more labor-intensive to build than it sounds, but the larger reason we haven’t done this is that customer feedback on detection notification has pushed us in a different direction, towards the
DETECTION_UPDATE trigger event. Using this trigger event, it’s possible to feed detections into a SIEM, Slack, Microsoft Teams, a ticketing system, or anything else that ExtraHop can communicate with using Open Data Streams.
The trigger approach is less batteries-included than alerts, but many teams have found they prefer the control it affords them in choosing which detections to forward and how to format them. At the end of this year we’re going to be introducing new functionality for the trigger and the REST API which will make detections more expressive and easier to work with in both these APIs surfaces.
We’re going to continue investing in surfacing ExtraHop’s findings in the most useful ways we can. We’d love to know more about which detection types you’re looking to get via email and what information you look for in that message. Please feel free to reply here, or if you’d like to share screenshots or anything you can send a private message to me or @swagatdasgupta.