First, configure account in ExtraHop
Ensure your user account has the appropriate privileges set for the type of task you need to perform (See ExtraHop privilege levels)
Next, create resource and credentials in Tines
One resource and two credentials will need to be created:
Resource: "extrahop_username"
Text type credential: "extrahop_secret"
HTTP request type credential: "ExtraHop"
Resource
Navigate to the team that will be using the API and click "Resource"
Click "+ New Resource"
Input the values for the ExtraHop resource
Name: extrahop_username
Description: Optional
Builder: your extrahop username
Optional
Access: What other teams can also use the resource
Click "Save resource"
Text type
Login to your Tines tenant
Navigate to the team that will be using the API and click "Credential"
Click "+ New Credential" and select "Text"
Input the values for the ExtraHop credential
Name: extrahop_secret
Description: Optional
Value: your secret
Optional
Domains: Ensure this credential can only be used when making HTTP requests to specific domains
Access: What other teams can also use the API
Click "Save"
HTTP request type
Click "+ New Credential" and select "HTTP Request"
Input the values for the ExtraHop credential
Name: ExtraHop
Description: Optional
URL:
https://<your_ExtraHop_domain>.api.cloud.extrahop.com/oauth2/token
Content Type: Form
Method: post
Payload: Copy the below object and paste into the "Plain code" section:
{
"grant_type": "client_credentials"
}Headers:
Header: Authorization
Value: Basic <<BASE64_ENCODE(LOCAL.creds)>>
Local values: Click the "+ Option" button, select "Local values" and paste the below into the "Plain code" section:
{
"creds": "<<RESOURCE.extrahop_username>>:<<CREDENTIAL.extrahop_secret>>"
}Click "Run options" and make sure you get a successful response.
Location of token from response:
<<extrahop.body.access_token>>
Optional
Domains: Ensure this credential can only be used when making HTTP requests to specific domains
Access: What other teams can also use the API
Click "Save"
Your credential should look like the following:
For more on creating credentials in Tines, click here.
You can find a selection of ExtraHop stories in the story library.
Using the credential and resources in an action
The Header configuration for your ExtraHop credential should be:
"Authorization": "Bearer <<CREDENTIAL.extrahop>>"
Here is an example ExtraHop action you can copy and paste onto your storyboard in Tines:
{"standardLibVersion":"35","actionRuntimeVersion":"4","agents":[{"disabled":false,"name":"List All Detections in Extrahop","description":"List All Detections in Extrahop","options":"{\"url\":\"https://<<RESOURCE.extrahop_domain>>/api/v1/detections\",\"content_type\":\"application_json\",\"method\":\"get\",\"headers\":{\"Authorization\":\"Bearer <<CREDENTIAL.extrahop>>\"}}","position":{"x":690,"y":510},"type":"httpRequest","timeSavedUnit":"minutes","timeSavedValue":0,"monitorAllEvents":false,"monitorFailures":false,"monitorNoEventsEmitted":null,"recordType":null,"recordWriters":[],"form":null,"cardIconName":"httpRequest","createdFromTemplateGuid":"c8388b626850667f74b5b65c1146a8fe288572c5ffe5fdc11db00ebfff2a1866","createdFromTemplateVersion":1,"originStoryIdentifier":"cloud:aa47f8215c6f30a0dcdb2a36a9f4168e:d4c15df0f02ba4789095426607003199"}],"links":[],"diagramNotes":[]}