>> Announcer: Live, from Las Vegas.
It's the Cube, covering AWS re: Invent 2017,
presented by AWS,
Intel,
and our ecosystem of partners.
>> Oh, well welcome to the Cube.
John Walsh, here, with Keith Townsend,
talking about re: Invent, the big AWS show going on here
at the Sands Expo Center
and talking about 40,000 plus people.
I don't know how many hundred thousand square feet
of booth space we're talking about here,
but this show has grown exponentially
from last year to this year,
and we're looking forward to being with you here
for the next three days.
Again, I'm John Walsh, with Keith Townsend.
Keith, always a pleasure to see you sir, how ya been?
>> I've been really well, I'm navigating the four
hotels this conference is spanning.
The last number I heard, almost 50,000 people.
>> Is that right?
>> Yeah, it's 48,000, 45,000, a huge conference.
>> Well and quite often, for those of you
who come out to Las Vegas a lot for shows,
you realize that there are certain anchor centers,
but as Keith pointed out,
we're talking about four hotels,
and even some spillover into a fifth as well.
The sessions are packed,
the exhibits are certainly dynamic,
already attracting a lot of attention behind us
and we're glad to be with you, here on the Cube.
It's a pleasure now to introduce Eric Thomas,
who's the Director of Cloud Products
at ExtraHop and good to see you sir.
Thanks for being with us.
>> Thanks very much.
>> Breaking your maiden on the Cube, is that correct?
>> Absolutely, first time, hopefully not the last.
>> We'll go easy on ya.
>> Oh, thank you so much, appreciate that.
>> ExtraHop, based out of Seattle.
Tell us a little bit, first off,
about core competencies, what you guys do,
and then we'll drill down a little bit
to just why you're here at AWS.
>> Absolutely, so we're a platform for what we call
wire data analytics.
Essentially what we do is, we use the network
as a data source for application intelligence,
performance, security, forensics,
you know whether that's sort of public or private Cloud,
on-prem, hybrid set ups.
We sort of sit on the network,
virtual or physical network, listen to all the traffic,
and then we analyze it, sort of at an application layer.
So we speak web, and database, and storage,
active directory, single signon,
all these sort of services and protocols.
Then we apply machine learning to that to
surface insights to IT professionals and app developers.
>> So I mean, are you looking for
whether it's code issues, or maybe infiltration,
or maybe performance, I mean, or everything?
>> All of the above, all of the above.
>> Oh, alright.
>> So we sort of started off talking about IT operations,
performance management, availability, downtime,
and our customers then said to us,
you know, once you have full visibility
across the entire app delivery chain,
there's real implications for security there,
you know, finding intrusions, anomalies
and things of that nature.
And so, over the last few years,
we've gotten more and more into that business.
You know, as far as AWS is concerned,
kind of the Cloud operations,
we've been supporting AWS since 2013.
That was our first product offering.
And we allow our customers to maintain their visibility
as they shift their workloads to AWS.
And sort of the value prop here is
kind of a shared responsibility model,
whether you're talking about security or infrastructure.
At the end of the day, the business and the customer
still responsible for the application.
>> So help us understand why are data in the Cloud?
I mean, I'm used to taking a network analyzer
and puttin' it on my wire in the data center
and I can get the really smart people to look at that data
and extrapolate and find really great patterns.
Do I really get wire data in the Cloud?
How do you guys work in AWS?
>> Yeah, so the virtual wire is still a virtual network,
still, you know, the same TCP connection,
the same packets going across the virtual wire.
So we capture that virtual network traffic,
marry it with physical network traffic
from the data center or on-prem,
put it all together in one package.
>> So across customers, you guys have to have
a lot of great insights.
Do you have a service where you anomolize that data
and then provide that insight back to your customer base?
>> Yeah, absolutely.
So we sort of turn that
you know, investigative workflow on its head,
where we do analysis and find the interesting stuff
up front so that you know,
the smart people don't have to
go digging through packets and network analyzers.
We surface our machine learning insights
by looking at behavioral anomalies.
We can kinda separate those into
operational versus security anomalies to kinda
improve the signal to noise ratio
for both IT Ops teams and security teams as well.
>> But to deal with the security stuff, then,
on that level then, interesting point, Keith,
that you bring up.
The fact that you can learn from the greater community,
and apply it to specific examples.
What are some of these high level findings?
I don't want, don't get into specifics,
or you know, too specific.
But what are you finding out in terms of security concerns,
and how people are best addressing
and best practices to addressing this?
>> So we just announced, yesterday,
a new rev of ExtraHop for AWS,
which enables a lot of new types of use cases
or outcomes from those types of security anomalies.
It's a great example.
You know, you're still responsible for securing
all of your storage, all of your web applications.
It's easy to configure your AWS setup
to let anybody in the front door of S3.
>> We've see that a lot, yep.
>> Right, pretty embarrassing when it happens.
But ExtraHop and ExtraHop for AWS,
that's an anomaly, it's a couple a clicks
to find out where it's goin' on and to fix it.
>> So is this more prescriptive or descriptive?
Are we doin' this pre an event,
or post discovery of some type of intrusion?
>> So we're doing it as it happens.
We talk about real time analytics
and when we say real time, we mean within one second
of it happening, we see it in ExtraHop.
Some vendors say real time to mean 15 or 10 minutes.
Not really enough, if you know,
trying to find a ransomware infection
and stop it, for example.
With machine learning, we'll provide suggested root causes.
We'll say, this looks like a security anomaly.
It looks like you've opened your S3 bucket.
Here's how you go fix it.
>> Let's talk a little bit about ecosystem.
Security, especially in the Cloud,
is a really big topic.
There's challenges with SSL, encryption, decryption.
ExtraHop can't do it all by themselves.
Are you guys partnering with other security firms
to bring insights?
>> Yeah, we partner with a lot of different firms.
Splunk comes to mind as sort of you know,
a log, analytics and aggregation vendor.
A lot of sort of byte code instrumentation
on the sort of performance analytics side.
And if you think about it architecturally,
you've got the inside out view
from logs and byte code, which is great.
Find out what's going on in the brains of the computer
as it's self-reporting
as a virtual machine or an application.
We take the outside-in view.
We're sort of looking at it from the outside to get
more definitive about literally every single transaction
and the impact of everything, from
active, all the things you can't measure or instrument
using classical agents and that sort of thing.
So we've had those firms come to us and say,
we'd like to partner with you on this ecosystem approach.
>> So AWS, big conference.
One of the things I've talked to a lot of folks
in the community for the past coupla days.
For me, this is a very different community.
We have anywhere from infrastructure architects
from the Big Fortune 500s, to
people who've been more traditional AWS customers and
are not used to going through IT
and consuming these services.
How does a,
that ladder customer surface up at ExtraHop.
>> So having been at this show since 2013,
I've seen more and more enterprise customers at these shows
as these, you know, sort of Cloud strategies have finally
come to pass.
Been talking about public Cloud since 2008 or so
from a strategic perspective in the enterprise.
Now, it's becoming real.
Those are our customers, full-stop.
The CIOs, the CSOs,
the VPs of App Dev, Product Management et cetera.
It's great to see them moving their workloads to the Cloud.
It's also great to see that they're, you know,
modernizing some of the services,
while choosing to leave some of their
other legacy services for later.
We can monitor all of that, sort of maintain visibility,
performance assurance and security,
as they're moving those workloads.
>> So can you talk about how you ease the pain
between those two worlds,
the public Cloud which is a very different operating model
than what we can do in a data center.
We have complete control of the infrastructure
in a data center.
The Cloud is abstracted away.
How do you get guys help even that out
and make operations simple?
>> So one thing that we're seeing,
sort of from a megatrend perspective with CIOs.
They really want to make as many options available
to their app teams, their infrastructure teams,
their dev teams as possible, because the CIO's saying,
I don't know what's gonna stick
from a technology perspective.
I'm not the one to make those decisions,
I'm the one to support them.
And so, I'm gonna open the floodgates.
You know, you're allowed to do whatever you want with
public Cloud, virtual private Cloud,
I'm gonna give you all these options.
Meanwhile the CSO is saying,
I really wish you'd standardize.
It's gettin' hard to track all these assets,
all these different, you know, middleware components
that you're putting out there.
They need a way to audit and assess
what's really going on, you know,
in both the public virtual private Cloud and on-prem
and that's sort of where we come in.
>> So just in general, Cloud migration,
you were just saying how, '08, '09,
this has been eight, nine years in the making.
Is it finally been kinda demystified, do ya think,
to a certain degree?
Or people, there's been enough trial and error that
there's more confidence for those who haven't made that
leap yet that okay, there's a more defined path
that I'm more comfortable with it now.
>> I think it's gotten more realistic
in terms of the assumptions around cost savings.
When people started talking about this originally,
it was like, oh, great, we're gonna completely map
our consumption of resources to what we really need.
We're gonna save all this money,
and yeah, that's true, to a degree.
I think those expectations have been tempered a little bit,
as you figure out, you know, where you can track that
sort of performance in your capacity,
or you just wanna let people run wild.
So that's a tempering of expectations.
There have also been these unexpected benefits
around next gen application architectures,
microservices, continuous integration,
even continuous delivery.
The Cloud enables all of that, you know,
it sort inspires a level of agility
in historically less agile businesses.
>> And then, you mentioned the,
kind of these microservices.
How do you guys support microservices?
We're used to the VM centric view of the Cloud,
when you're talking about services that are
abstracted away from the VM.
How does ExtraHop play in those realms?
>> So, you know, this is sort of the next iteration
of the services oriented architecture,
as people have realized, you know, that
the sort of the best practices and
sort of code patterns for developing these services.
For us, you know, we auto discover
systems and services running across
virtual or physical networks,
which means you don't have to configure things ahead of time
and we can scale to elasticity very easily.
We see services spin up, spin down,
move from one place to another,
move across availability zones,
and we just track all that as it happens.
>> Well Eric, we certainly appreciate the time.
And we wanna know, how was the first Cube experience?
You alright with it?
>> So far, so good, what do you think,
you tell me, you're the experts.
>> We didn't beat him up enough.
>> We didn't, I gotta come with tougher questions next time.
>> Next time.
>> There you go.
>> Eric Thomas, ExtraHop,
glad to have you with us here on the Cube.
>> Thank you so much, 'preciate it.
>> Back with more here from re: Invent.
We're in Las Vegas, be here all week,
back with more on the Cube, right after this.
(electronic music)