ExtraHop Deployment Series (Part 1): Installation of ECA, EXA, and EDA

What is ExtraHop?#

ExtraHop is a Network Detection and Response (NDR) platform that provides complete visibility, real-time detection, and investigation capabilities by analyzing wire data. Unlike traditional log-based monitoring, ExtraHop analyzes network traffic (packets) to uncover blind spots, detect encrypted threats, and map application dependencies.

The architecture consists of three main components:

• EDA (ExtraHop Discovery Appliance): The "eyes" of the system. It receives raw packet data (via SPAN/Mirror port), processes it, and extracts metrics.
• EXA (ExtraHop Explore Appliance): The "brain" and storage. It stores records and transactions for long-term retention and enables advanced querying.
• ECA (ExtraHop Console Administration): The "face" of the system. It provides a centralized management plane to view dashboards and manage multiple connected appliances.

Objective#

This article is Part 1 of the ExtraHop Deployment series. Our goal is to establish the foundational infrastructure required for an ExtraHop environment.

In this guide, we will focus strictly on the initial deployment and base configuration of the appliances. Specifically, we will deploy:

1. 1x ECA (Central Management)
2. 1x EDA (Packet Capture/Discovery)
3. 3x EXA (Data Storage/Explore)

Note: We are deploying three EXA nodes to prepare for a Clustered Architecture. While we will perform the standalone installation for all three nodes in this guide, the actual federation and clustering integration will be covered in Part 2 of this series.

Specification#

To replicate this deployment, ensure your environment meets the specific software and hardware requirements used in this lab.

Software Versions

Platform & Resource Allocation

The following resources were allocated for a Lab Environment hosted on a virtualization platform (e.g., VMware ESXi/KVM).

Warning: These specifications are minimized for laboratory simulation purposes. For production deployments, strictly adhere to ExtraHop's official sizing guide, which typically requires significantly higher RAM and CPU reservations.

---

Installation Phase#

Step 1: Management Configuration

The initial setup for all ExtraHop appliances (ECA, EDA, and EXA) follows the same procedure: booting the appliance, accessing the console, and configuring the management interface via the CLI.

The following steps demonstrate this process using the ECA as an example. Repeat these steps for your EDA and EXA nodes, substituting the appropriate IP addresses for each appliance.

Power on the virtual machine and open the VMware/Hyper-V console. Once the operating system has initialized, you will be presented with the ExtraHop login prompt.

Log in using the default service account credentials (shell) and enter privileged mode using the enable command.

Step 2: License Registration & GUI Access

Once the Management IP addresses are configured via the CLI, the appliances are reachable over the network. However, the main dashboards will remain inaccessible until a valid license is applied.

To apply the license, you must access the Administration Interface directly. Open your web browser and navigate to:

https://<appliance-ip-address>/admin

Note: Ensure you append /admin to the URL. Trying to access the root IP address without a license may result in a connection error or a restricted view.

1. Log in with the default admin credentials (default: setup / default or the password you configured).
2. Navigate to Appliance Settings > License.
3. You will see the license status as Unregistered or Error. Click Register.
4. Paste your valid Product Key into the field provided.

Repeat this process for all three appliances (ECA, EXA, and EDA). Once successfully registered, the status should change to Valid as shown below:

ECA License Status:

EXA License Status:

EDA License Status:

Step 3: Verifying Dashboard Access

With the licenses applied, the full web interface is now unlocked. You can now access the main dashboard by removing /admin from the URL:

https://<appliance-ip-address>/

ECA Dashboard: The ECA will display the central command dashboard (currently empty as no sensors are connected).

EDA Dashboard: The EDA will display the discovery dashboard. Since we have not yet fed any traffic (SPAN/Mirror) to the appliance, the charts will show "No Data."

Note regarding EXA: The EXA serves as a Record Store (Storage & Explore Node). Unlike the ECA or EDA, it does not host a standalone visual dashboard for traffic monitoring. Its primary interface is the Administration UI we accessed earlier; its data is visualized primarily through the ECA once integrated.

Conclusion#

We have successfully established the foundational infrastructure for the ExtraHop ecosystem. At this stage, you should have:

1. The Management Plane (ECA): Deployed, IP configured, and licensed.
2. The Discovery Plane (EDA): Ready to receive mirrored traffic.
3. The Data Plane (EXA): Provisioned for storage.

However, these three components currently operate in silos. The EDA may capture traffic, but it cannot yet send records to the EXA for storage, nor can the ECA manage them centrally.

In Part 2: Connecting the Ecosystem, we will perform the integration steps to pair the EDA and EXA with the ECA console, effectively turning these standalone appliances into a unified Network Detection and Response (NDR) platform.

Stay tuned.