There is a little training online, but it'd be cool if ExtraHop provided certifications. CrowdStrike does elective training that gives you a certification as a Falcon administrator. It'd be nice to see ExtraHop have something like that

They used to have the ability to decode Citrix sign-on, setup, and tear down. Unfortunately, Citrix has stopped sharing that knowledge. Citrix has continued to change its model of processing, making it harder and harder to troubleshoot. 

Agent management could certainly use some focus. It should also be a little bit easier to work with collections. We should be able to nest collections within collections. There should be better nesting.

The beautiful thing about the company that runs ExtraHop is that when we go to them with feature requests or with things that we would like to see, they're really good at getting them added. The most recent one that we're looking for is being able to limit the packets that users can download. So, if you're an administrator, you should be able to download a full packet capture with the full packet, but if you're just an engineer or an application person just looking at your application header traffic, you don't need to see any payload data. We want to be able to limit that traffic. We want to limit who can see the payload, and we can do that. The vendor is putting that into the tool for us. It's going to be done before the end of the year.

The solution’s pricing could be improved.

ExtraHop Reveal(x) could improve by allowing a longer look back in the feature.  Right now you have a limit of 30 days to look back on your activity. I've used Darktrace before, and they allow you the ability to play back events. This would be a good feature to have in ExtraHop Reveal(x).

The solution should include more support protocols. 

The solution should be less expensive. 

I think the tuning capabilities could be improved. We're working on minimizing false positives. Apart from that, everything seems fine to me. 

The solution's reporting part and GUI are areas with certain shortcomings where improvements are required.

Response time is an area where the product's technical support team must make improvements.

The product's price could be more flexible.

I can't think of anything right now. They meet all of my customers' requirements.

Additional integration partners would be beneficial.

I would like to see more cloud capability.

Netflow - Processing Netflow can be cumbersome as it requires triggers to truly gain value and insight. This in turn can add a bit of load to the hardware. The focus of ExtraHop Reveal (x) is live packet data.

Triggers - While the triggers are great for specific use cases, it can add load to the hardware and requires some development skill, which can be costly.

VoIP - While we can view SIP and RTP (quality, MOS, etc.) it is not the best solution for VoIP itself. There are better solutions for more detailed VoIP monitoring. It can solve some problems, but not all problems.

At this point, there aren't any features that are lacking, from our perspective. The solution is pretty complete.

The solution is expensive and gets more expensive if a company needs to scale it.

They should integrate the solution with more security vendors.