HarfangLab EDR
HarfangLab EDR Pack.#
This Integration is part of theSupported versions
Supported Cortex XSOAR versions: 6.2.0 and later.
HarfangLab EDR Connector, Compatible version 2.13.7+ This integration was integrated and tested with version 2.13.7+ of Hurukai
#
Configure HarfangLab EDR on Cortex XSOARNavigate to Settings > Integrations > Servers & Services.
Search for HarfangLab EDR.
Click Add instance to create and configure a new integration instance.
Parameter Description Required API URL URL of the EDR Manager True Fetch incidents Indicates whether to fetch incidents or not False Incident type Incident type that must be associated to the retrieved incidents False API Key API key provided by the EDR Manager False Long running instance False Incidents Fetch Interval Time interval for polling the EDR Manager to retrieve incidents False Fetch alerts with type Comma-separated list of types of alerts to fetch (sigma, yara, hlai, vt, ransom, ioc, glimps, orion...). False Minimum severity of alerts to fetch Minimum severity level associated to the incidents that are retrieved. True Fetch alerts with status (ACTIVE, CLOSED) ACTIVE means New, Investigating or Probable False Positive, CLOSED means Closed or False Positive. False First fetch time Start fetching alerts whose creation date is higher than now minus <first_fetch> days. True Trust any certificate (not secure) Do not check that the EDR Manager certificate is valid. False Use system proxy settings Use proxy settings configured for the whole XSOAR. False Click Test to validate the URLs, token, and connection.
#
CommandsYou can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.
#
test-moduleAllows to test that the HarfangLab EDR API is reachable
#
Base Commandtest-module
#
InputArgument Name | Description | Required |
---|
#
Context OutputThere is no context output for this command.
#
fetch-incidentsAllows to retrieve incidents from the HarfangLab EDR API
#
Base Commandfetch-incidents
#
InputArgument Name | Description | Required |
---|
#
Context OutputThere is no context output for this command.
#
harfanglab-get-endpoint-infoGet endpoint information from agent_id
#
Base Commandharfanglab-get-endpoint-info
#
InputArgument Name | Description | Required |
---|---|---|
agent_id | Agent unique identifier as provided by the HarfangLab EDR Manager. | Optional |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.Agent | unknown | Agent information |
#
harfanglab-endpoint-searchSearch for endpoint information from a hostname
#
Base Commandharfanglab-endpoint-search
#
InputArgument Name | Description | Required |
---|---|---|
hostname | Endpoint hostname. | Optional |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.Agent.id | string | agent id |
Harfanglab.status | string | Status |
#
harfanglab-telemetry-processesSearch processes on a specific hostname
#
Base Commandharfanglab-telemetry-processes
#
InputArgument Name | Description | Required |
---|---|---|
hash | filehash to search (md5, sha1, sha256). | Optional |
hostname | Endpoint hostname. | Required |
from_date | Start date (format: YYYY-MM-DDTHH:MM:SS). | Optional |
to_date | End date (format: YYYY-MM-DDTHH:MM:SS). | Optional |
#
Context OutputPath | Type | Description |
---|---|---|
agent.agentid | string | An agent's identifier |
current_directory | string | |
hashes.sha256 | string |
#
harfanglab-job-pipelistStart a job to get the list of pipes from a host (Windows)
#
Base Commandharfanglab-job-pipelist
#
InputArgument Name | Description | Required |
---|---|---|
agent_id | Agent unique identifier as provided by the HarfangLab EDR Manager. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.Job.ID | string | id |
action | unknown | HarfangLab job action |
#
harfanglab-job-artifact-downloadfileStart a job to download a file from a host (Windows / Linux)
#
Base Commandharfanglab-job-artifact-downloadfile
#
InputArgument Name | Description | Required |
---|---|---|
agent_id | Agent unique identifier as provided by the HarfangLab EDR Manager. | Required |
filename | Path of the file to download. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.Job.ID | string | id |
action | unknown | HarfangLab job action |
#
harfanglab-job-prefetchlistStart a job to get the list of prefetches from a host (Windows)
#
Base Commandharfanglab-job-prefetchlist
#
InputArgument Name | Description | Required |
---|---|---|
agent_id | Agent unique identifier as provided by the HarfangLab EDR Manager. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.Job.ID | string | id |
action | unknown | HarfangLab job action |
#
harfanglab-job-runkeylistStart a job to get the list of run keys from a host (Windows)
#
Base Commandharfanglab-job-runkeylist
#
InputArgument Name | Description | Required |
---|---|---|
agent_id | Agent unique identifier as provided by the HarfangLab EDR Manager. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.Job.ID | string | id |
action | unknown | HarfangLab job action |
#
harfanglab-job-scheduledtasklistStart a job to get the list of scheduled tasks from a host (Windows)
#
Base Commandharfanglab-job-scheduledtasklist
#
InputArgument Name | Description | Required |
---|---|---|
agent_id | Agent unique identifier as provided by the HarfangLab EDR Manager. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.Job.ID | string | id |
action | unknown | HarfangLab job action |
#
harfanglab-job-driverlistStart a job to get the list of drivers from a host (Windows)
#
Base Commandharfanglab-job-driverlist
#
InputArgument Name | Description | Required |
---|---|---|
agent_id | Agent unique identifier as provided by the HarfangLab EDR Manager. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.Job.ID | string | id |
action | unknown | HarfangLab job action |
#
harfanglab-job-servicelistStart a job to get the list of services from a host (Windows)
#
Base Commandharfanglab-job-servicelist
#
InputArgument Name | Description | Required |
---|---|---|
agent_id | Agent unique identifier as provided by the HarfangLab EDR Manager. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.Job.ID | string | id |
action | unknown | HarfangLab job action |
#
harfanglab-job-processlistStart a job to get the list of processes from a host (Windows / Linux)
#
Base Commandharfanglab-job-processlist
#
InputArgument Name | Description | Required |
---|---|---|
agent_id | Agent unique identifier as provided by the HarfangLab EDR Manager. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.Job.ID | string | id |
action | unknown | HarfangLab job action |
#
harfanglab-job-networkconnectionlistStart a job to get the list of network connections from a host (Windows / Linux)
#
Base Commandharfanglab-job-networkconnectionlist
#
InputArgument Name | Description | Required |
---|---|---|
agent_id | Agent unique identifier as provided by the HarfangLab EDR Manager. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.Job.ID | string | id |
action | unknown | HarfangLab job action |
#
harfanglab-job-networksharelistStart a job to get the list of network shares from a host (Windows)
#
Base Commandharfanglab-job-networksharelist
#
InputArgument Name | Description | Required |
---|---|---|
agent_id | Agent unique identifier as provided by the HarfangLab EDR Manager. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.Job.ID | string | id |
action | unknown | HarfangLab job action |
#
harfanglab-job-sessionlistStart a job to get the list of sessions from a host (Windows)
#
Base Commandharfanglab-job-sessionlist
#
InputArgument Name | Description | Required |
---|---|---|
agent_id | Agent unique identifier as provided by the HarfangLab EDR Manager. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.Job.ID | string | id |
action | unknown | HarfangLab job action |
#
harfanglab-job-persistencelistStart a job to get the list of persistence items from a host (Linux)
#
Base Commandharfanglab-job-persistencelist
#
InputArgument Name | Description | Required |
---|---|---|
agent_id | Agent unique identifier as provided by the HarfangLab EDR Manager. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.Job.ID | string | id |
action | unknown | HarfangLab job action |
#
harfanglab-job-iocStart a job to search for IOCs on a host (Windows / Linux)
#
Base Commandharfanglab-job-ioc
#
InputArgument Name | Description | Required |
---|---|---|
agent_id | Agent unique identifier as provided by the HarfangLab EDR Manager. | Required |
filename | exact filename to search. | Optional |
filepath | exact filepath to search. | Optional |
hash | filehash to search (md5, sha1, sha256). | Optional |
search_in_path | restrict searchs for filename or filepath or filepath_regex to a given path. | Optional |
hash_filesize | size of the file associated to the 'hash' parameters. If known, it will speed up the search process. | Optional |
registry | regex to search in registry (key or value). | Optional |
filepath_regex | search a regex on a filepath . | Optional |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.Job.ID | string | id |
action | unknown | HarfangLab job action |
#
harfanglab-job-startuplistStart a job to get the list of startup items from a host (Windows)
#
Base Commandharfanglab-job-startuplist
#
InputArgument Name | Description | Required |
---|---|---|
agent_id | Agent unique identifier as provided by the HarfangLab EDR Manager. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.Job.ID | string | id |
action | unknown | HarfangLab job action |
#
harfanglab-job-wmilistStart a job to get the list of WMI items from a host (Windows)
#
Base Commandharfanglab-job-wmilist
#
InputArgument Name | Description | Required |
---|---|---|
agent_id | Agent unique identifier as provided by the HarfangLab EDR Manager. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.Job.ID | string | id |
action | unknown | HarfangLab job action |
#
harfanglab-job-artifact-mftStart a job to download the MFT from a host (Windows)
#
Base Commandharfanglab-job-artifact-mft
#
InputArgument Name | Description | Required |
---|---|---|
agent_id | Agent unique identifier as provided by the HarfangLab EDR Manager. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.artifact.download_link | string | URL to download the artifact |
Harfanglab.Job.ID | string | id |
#
harfanglab-job-artifact-hivesStart a job to download the hives from a host (Windows)
#
Base Commandharfanglab-job-artifact-hives
#
InputArgument Name | Description | Required |
---|---|---|
agent_id | Agent unique identifier as provided by the HarfangLab EDR Manager. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.artifact.download_link | string | URL to download the artifact |
Harfanglab.Job.ID | string | id |
#
harfanglab-job-artifact-evtxStart a job to download the event logs from a host (Windows)
#
Base Commandharfanglab-job-artifact-evtx
#
InputArgument Name | Description | Required |
---|---|---|
agent_id | Agent unique identifier as provided by the HarfangLab EDR Manager. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.artifact.download_link | string | URL to download the artifact |
Harfanglab.Job.ID | string | id |
#
harfanglab-job-artifact-logsStart a job to download Linux log files from a host (Linux)
#
Base Commandharfanglab-job-artifact-logs
#
InputArgument Name | Description | Required |
---|---|---|
agent_id | Agent unique identifier as provided by the HarfangLab EDR Manager. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.artifact.download_link | string | URL to download the artifact |
Harfanglab.Job.ID | string | id |
#
harfanglab-job-artifact-filesystemStart a job to download Linux filesystem entries from a host (Linux)
#
Base Commandharfanglab-job-artifact-filesystem
#
InputArgument Name | Description | Required |
---|---|---|
agent_id | Agent unique identifier as provided by the HarfangLab EDR Manager. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.artifact.download_link | string | URL to download the artifact |
Harfanglab.Job.ID | string | id |
#
harfanglab-job-artifact-allStart a job to download all artifacts from a host (Windows MFT, Hives, evt/evtx, Prefetch, USN, Linux logs and file list)
#
Base Commandharfanglab-job-artifact-all
#
InputArgument Name | Description | Required |
---|---|---|
agent_id | Agent unique identifier as provided by the HarfangLab EDR Manager. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.artifact.download_link | string | URL to download the artifact |
Harfanglab.Job.ID | string | id |
#
harfanglab-job-artifact-ramdumpStart a job to get the entine RAM from a host (Windows / Linux)
#
Base Commandharfanglab-job-artifact-ramdump
#
InputArgument Name | Description | Required |
---|---|---|
agent_id | Agent unique identifier as provided by the HarfangLab EDR Manager. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.artifact.download_link | string | URL to download the artifact |
Harfanglab.Job.ID | string | id |
#
harfanglab-telemetry-networkSearch network connections from a specific hostname
#
Base Commandharfanglab-telemetry-network
#
InputArgument Name | Description | Required |
---|---|---|
hostname | Endpoint hostname. | Required |
from_date | Start date (format: YYYY-MM-DDTHH:MM:SS). | Optional |
to_date | End date (format: YYYY-MM-DDTHH:MM:SS). | Optional |
source_address | Source IP address. | Optional |
source_port | Source port. | Optional |
destination_address | Destination IP address. | Optional |
destination_port | Destination port. | Optional |
#
Context OutputThere is no context output for this command.
#
harfanglab-telemetry-eventlogSearch event logs from a specific hostname
#
Base Commandharfanglab-telemetry-eventlog
#
InputArgument Name | Description | Required |
---|---|---|
hostname | Endpoint hostname. | Required |
from_date | Start date (format: YYYY-MM-DDTHH:MM:SS). | Optional |
to_date | End date (format: YYYY-MM-DDTHH:MM:SS). | Optional |
#
Context OutputThere is no context output for this command.
#
harfanglab-telemetry-binarySearch for binaries
#
Base Commandharfanglab-telemetry-binary
#
InputArgument Name | Description | Required |
---|---|---|
from_date | Start date (format: YYYY-MM-DDTHH:MM:SS). | Optional |
to_date | End date (format: YYYY-MM-DDTHH:MM:SS). | Optional |
hash | filehash to search (md5, sha1, sha256). | Optional |
#
Context OutputThere is no context output for this command.
#
harfanglab-job-infoGet job status information
#
Base Commandharfanglab-job-info
#
InputArgument Name | Description | Required |
---|---|---|
ids | Coma-separated list of job ids. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.Job.Status | string | Job Status |
#
harfanglab-result-pipelistGet a hostname's list of pipes from job results
#
Base Commandharfanglab-result-pipelist
#
InputArgument Name | Description | Required |
---|---|---|
job_id | Job id as returned by the job submission commands. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.Pipe.data | unknown | Provides a list of named pipes |
#
harfanglab-result-prefetchlistGet a hostname's list of prefetches from job results
#
Base Commandharfanglab-result-prefetchlist
#
InputArgument Name | Description | Required |
---|---|---|
job_id | Job id as returned by the job submission commands. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.Prefetch.data | unknown | Provides a list of prefetch files |
#
harfanglab-result-runkeylistGet a hostname's list of run keys from job results
#
Base Commandharfanglab-result-runkeylist
#
InputArgument Name | Description | Required |
---|---|---|
job_id | Job id as returned by the job submission commands. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.RunKey.data | unknown | Provides a list of Run Keys |
#
harfanglab-result-scheduledtasklistGet a hostname's list of scheduled tasks from job results
#
Base Commandharfanglab-result-scheduledtasklist
#
InputArgument Name | Description | Required |
---|---|---|
job_id | Job id as returned by the job submission commands. | Optional |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.ScheduledTask.data | unknown | Provides a list of scheduled tasks |
#
harfanglab-result-driverlistGet a hostname's loaded drivers from job results
#
Base Commandharfanglab-result-driverlist
#
InputArgument Name | Description | Required |
---|---|---|
job_id | Job id as returned by the job submission commands. | Optional |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.Driver.data | unknown | Provides a list of loaded drivers |
#
harfanglab-result-servicelistGet a hostname's list of services from job results
#
Base Commandharfanglab-result-servicelist
#
InputArgument Name | Description | Required |
---|---|---|
job_id | Job id as returned by the job submission commands. | Optional |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.Service.data | unknown | Provides a list of services |
#
harfanglab-result-processlistGet a hostname's list of processes from job results
#
Base Commandharfanglab-result-processlist
#
InputArgument Name | Description | Required |
---|---|---|
job_id | Job id as returned by the job submission commands. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.Process.data | unknown | Provides a list of processes |
#
harfanglab-result-networkconnectionlistGet a hostname's network connections from job results
#
Base Commandharfanglab-result-networkconnectionlist
#
InputArgument Name | Description | Required |
---|---|---|
job_id | Job id as returned by the job submission commands. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.NetworkConnection.data | unknown | Provides a list of active network connections |
#
harfanglab-result-networksharelistGet a hostname's network shares from job results
#
Base Commandharfanglab-result-networksharelist
#
InputArgument Name | Description | Required |
---|---|---|
job_id | Job id as returned by the job submission commands. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.NetworkShare.data | unknown | Provides a list of network shares |
#
harfanglab-result-sessionlistGet a hostname's sessions from job results
#
Base Commandharfanglab-result-sessionlist
#
InputArgument Name | Description | Required |
---|---|---|
job_id | Job id as returned by the job submission commands. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.Session.data | unknown | Provides a list of active sessions |
#
harfanglab-result-persistencelistGet a hostname's persistence items from job results
#
Base Commandharfanglab-result-persistencelist
#
InputArgument Name | Description | Required |
---|---|---|
job_id | Job id as returned by the job submission commands. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.PersistenceList.data | unknown | Provides a list of persistence means |
#
harfanglab-result-iocGet the list of items matching IOCs searched in an IOC job
#
Base Commandharfanglab-result-ioc
#
InputArgument Name | Description | Required |
---|---|---|
job_id | Job id as returned by the job submission commands. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.IOC.data | unknown | Provides a list of matching elements |
#
harfanglab-result-startuplistGet a hostname's startup items from job results
#
Base Commandharfanglab-result-startuplist
#
InputArgument Name | Description | Required |
---|---|---|
job_id | Job id as returned by the job submission commands. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.Startup.data | unknown | Provides a list of startup files |
#
harfanglab-result-wmilistGet a hostname's WMI items from job results
#
Base Commandharfanglab-result-wmilist
#
InputArgument Name | Description | Required |
---|---|---|
job_id | Job id as returned by the job submission commands. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.Wmi.data | unknown | Provides a list of WMI items |
#
harfanglab-result-artifact-mftGet a hostname's MFT from job results
#
Base Commandharfanglab-result-artifact-mft
#
InputArgument Name | Description | Required |
---|---|---|
job_id | Job id as returned by the job submission commands. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.Artifact.data | unknown | Provides a link to download the raw MFT |
#
harfanglab-result-artifact-hivesGet a hostname's hives from job results
#
Base Commandharfanglab-result-artifact-hives
#
InputArgument Name | Description | Required |
---|---|---|
job_id | Job id as returned by the job submission commands. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.Artifact.data | unknown | Provides a link to download the raw hives |
#
harfanglab-result-artifact-evtxGet a hostname's log files from job results
#
Base Commandharfanglab-result-artifact-evtx
#
InputArgument Name | Description | Required |
---|---|---|
job_id | Job id as returned by the job submission commands. | Optional |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.Artifact.data | unknown | Provides a link to download the evt/evtx files |
#
harfanglab-result-artifact-logsGet a hostname's log files from job results
#
Base Commandharfanglab-result-artifact-logs
#
InputArgument Name | Description | Required |
---|---|---|
job_id | Job id as returned by the job submission commands. | Optional |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.Artifact.data | unknown | Provides a link to download the log files |
#
harfanglab-result-artifact-filesystemGet a hostname's filesystem entries from job results
#
Base Commandharfanglab-result-artifact-filesystem
#
InputArgument Name | Description | Required |
---|---|---|
job_id | Job id as returned by the job submission commands. | Optional |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.Artifact.data | unknown | Provides a link to download the CSV file with filesystem entries |
#
harfanglab-result-artifact-allGet all artifacts from a hostname from job results
#
Base Commandharfanglab-result-artifact-all
#
InputArgument Name | Description | Required |
---|---|---|
job_id | Job id as returned by the job submission commands. | Optional |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.Artifact.data | unknown | Provides a link to download an archive with all raw artifacts |
#
harfanglab-result-artifact-downloadfileGet a hostname's file from job results
#
Base Commandharfanglab-result-artifact-downloadfile
#
InputArgument Name | Description | Required |
---|---|---|
job_id | Job id as returned by the job submission commands. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.DownloadFile.data | unknown | Provides a link to download the file |
#
harfanglab-result-artifact-ramdumpGet a hostname's RAM dump from job results
#
Base Commandharfanglab-result-artifact-ramdump
#
InputArgument Name | Description | Required |
---|---|---|
job_id | Job id as returned by the job submission commands. | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.Ramdump.data | unknown | Provides a link to download the raw RAM dump |
#
harfanglab-hunt-search-hashCommand used to search a hash IOC in database
#
Base Commandharfanglab-hunt-search-hash
#
InputArgument Name | Description | Required |
---|---|---|
hash | filehash to search (md5, sha1, sha256). | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.Hash | unknown | Provides statistics associated to currently running processes and previously executed processes associated to hash |
#
harfanglab-hunt-search-running-process-hashCommand used to search running process associated with Hash
#
Base Commandharfanglab-hunt-search-running-process-hash
#
InputArgument Name | Description | Required |
---|---|---|
hash | filehash to search (sha256). | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.HuntRunningProcessSearch.data | unknown | List of all systems where processes associated to hash are running |
#
harfanglab-hunt-search-runned-process-hashCommand used to search runned process associated with Hash
#
Base Commandharfanglab-hunt-search-runned-process-hash
#
InputArgument Name | Description | Required |
---|---|---|
hash | filehash to search (sha256). | Required |
#
Context OutputPath | Type | Description |
---|---|---|
Harfanglab.HuntRunnedProcessSearch.data | unknown | List of all systems where processes associated to hash have been previously running |
#
harfanglab-isolate-endpointCommand used to isolate an endpoint from the network while remaining connected to the EDR manager
#
Base Commandharfanglab-isolate-endpoint
#
InputArgument Name | Description | Required |
---|---|---|
agent_id | Agent unique identifier as provided by the HarfangLab EDR Manager. | Required |
#
Context OutputThere is no context output for this command.
#
harfanglab-deisolate-endpointCommand used to deisolate an endpoint and reconnect it to the network
#
Base Commandharfanglab-deisolate-endpoint
#
InputArgument Name | Description | Required |
---|---|---|
agent_id | Agent unique identifier as provided by the HarfangLab EDR Manager. | Required |
#
Context OutputThere is no context output for this command.
#
harfanglab-change-security-event-statusCommand used to change the status of a security event
#
Base Commandharfanglab-change-security-event-status
#
InputArgument Name | Description | Required |
---|---|---|
security_event_id | Security event id. | Required |
status | New status of the security event id (New, Investigating, False Positive, Closed). | Required |
#
Context OutputThere is no context output for this command.
#
harfanglab-assign-policy-to-agentAssign a policy to an agent
#
Base Commandharfanglab-assign-policy-to-agent
#
InputArgument Name | Description | Required |
---|---|---|
agentid | Agent identifier. | Required |
policy | Policy name. | Required |
#
Context OutputThere is no context output for this command.
#
harfanglab-add-ioc-to-sourceAdd an IOC to a Threat Intelligence source
#
Base Commandharfanglab-add-ioc-to-source
#
InputArgument Name | Description | Required |
---|---|---|
ioc_value | IOC value. | Required |
ioc_type | IOC type (hash, filename, filepath). | Required |
ioc_comment | Comment associated to IOC. | Optional |
ioc_status | IOC status (stable, testing). | Required |
source_name | IOC Source Name. | Required |
#
Context OutputThere is no context output for this command.
#
harfanglab-delete-ioc-from-sourceDelete an IOC from a Threat Intelligence source
#
Base Commandharfanglab-delete-ioc-from-source
#
InputArgument Name | Description | Required |
---|---|---|
ioc_value | IOC value. | Required |
source_name | IOC Source Name. | Required |
#
Context OutputThere is no context output for this command.