This solution is more applications reference architecture focused. Its benefit is that it specializes in that space. 

The most valuable features are security detections, perimeter detection, dashboards, and alerts.

Auto discovery and auto classification of the entire data-center application environment allows ExtraHop to be functional within hours of providing the EDA with a data feed. There is no product I have seen that even comes close to the speed at which it becomes operational.

The administrative overhead to install and manage the tool is ridiculously low. It is completely agentless, passive, and requires zero configuration on any end device for it to work. The only engineering required is providing the data feed. The time administrators normally spend on system administration can be funnelled into customization instead.

The degree to which the tool can be customized is near limitless. Just about anything on the wire can be a metric or a transaction record. It is most broadly used for operational analytics, but has many use cases for security, clinical, and business analytics as well.

The big data back end is a game changer. Every single network flow and application transaction can produce records. The EXA is still in its initial version having only been released a few months ago, and is already very useful. There are numerous improvements already in the pipeline for the next releases that will make it an even better analytics tool.

It has a straightforward deployment and implementation model, even for extremely dynamic and complex network environments.

There's unbelievable capability around wired data analysis; analyzing unstructured data at a sizzling rate, rationalizing it and delivering it as consumable, structured data. It's a big data solution in a plug-and-play implementation mode.

It's a must-have solution for large IT Operations, providing the ability to analyze infrastructure and application-related performance and data from the wire perspective. Very strong use cases around L7 application level analysis; at least 15 different security related use cases (including SSL and CIFS usage); significant capability for network focused groups specifically around analysis of L2 - L7 metrics; powerful tool for enterprise server management groups as well (analyze database, application, ICA, storage related metrics to name a few).

When it comes to ExtraHop, it has a very useful feature. Not only can you look at the protocol import level. It also has a live PCAP analysis. Therefore, even if you have PCAP files, Packet Capture files, you can run and have a live recording of the PCAP. That's something this is unique. Otherwise, it's very similar to NetBrain. I wouldn't call it an NDR, however, ExtraHop is mainly comparable to an NDR provider.

The solution is stable.

The setup is simple. 

The most valuable feature is the way it handles data, from Layer 2 up to Layer 7. We can see everything that happens in the network. It's a great feature.

There are many valuable features in this product, but probably the biggest is the customization capability it has.

• Wire data analytics
• Programmability of the platform

You cannot hide from the wire. All truth lives in the packets, and ExtraHop gets them to talk!