Skip to main content

HarfangLab EDR

This Integration is part of the HarfangLab EDR Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.2.0 and later.

HarfangLab EDR Connector, Compatible version 2.13.7+ This integration was integrated and tested with version 2.13.7+ of Hurukai

Configure HarfangLab EDR on Cortex XSOAR#

  1. Navigate to Settings > Integrations > Servers & Services.

  2. Search for HarfangLab EDR.

  3. Click Add instance to create and configure a new integration instance.

    ParameterDescriptionRequired
    API URLURL of the EDR ManagerTrue
    Fetch incidentsIndicates whether to fetch incidents or notFalse
    Incident typeIncident type that must be associated to the retrieved incidentsFalse
    API KeyAPI key provided by the EDR ManagerFalse
    Long running instanceFalse
    Incidents Fetch IntervalTime interval for polling the EDR Manager to retrieve incidentsFalse
    Fetch alerts with typeComma-separated list of types of alerts to fetch (sigma, yara, hlai, vt, ransom, ioc, glimps, orion...).False
    Minimum severity of alerts to fetchMinimum severity level associated to the incidents that are retrieved.True
    Fetch alerts with status (ACTIVE, CLOSED)ACTIVE means New, Investigating or Probable False Positive, CLOSED means Closed or False Positive.False
    First fetch timeStart fetching alerts whose creation date is higher than now minus <first_fetch> days.True
    Trust any certificate (not secure)Do not check that the EDR Manager certificate is valid.False
    Use system proxy settingsUse proxy settings configured for the whole XSOAR.False
  4. Click Test to validate the URLs, token, and connection.

Commands#

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

test-module#


Allows to test that the HarfangLab EDR API is reachable

Base Command#

test-module

Input#

Argument NameDescriptionRequired

Context Output#

There is no context output for this command.

fetch-incidents#


Allows to retrieve incidents from the HarfangLab EDR API

Base Command#

fetch-incidents

Input#

Argument NameDescriptionRequired

Context Output#

There is no context output for this command.

harfanglab-get-endpoint-info#


Get endpoint information from agent_id

Base Command#

harfanglab-get-endpoint-info

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Optional

Context Output#

PathTypeDescription
Harfanglab.AgentunknownAgent information

harfanglab-endpoint-search#


Search for endpoint information from a hostname

Base Command#

harfanglab-endpoint-search

Input#

Argument NameDescriptionRequired
hostnameEndpoint hostname.Optional

Context Output#

PathTypeDescription
Harfanglab.Agent.idstringagent id
Harfanglab.statusstringStatus

harfanglab-telemetry-processes#


Search processes on a specific hostname

Base Command#

harfanglab-telemetry-processes

Input#

Argument NameDescriptionRequired
hashfilehash to search (md5, sha1, sha256).Optional
hostnameEndpoint hostname.Required
from_dateStart date (format: YYYY-MM-DDTHH:MM:SS).Optional
to_dateEnd date (format: YYYY-MM-DDTHH:MM:SS).Optional

Context Output#

PathTypeDescription
agent.agentidstringAn agent's identifier
current_directorystring
hashes.sha256string

harfanglab-job-pipelist#


Start a job to get the list of pipes from a host (Windows)

Base Command#

harfanglab-job-pipelist

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.Job.IDstringid
actionunknownHarfangLab job action

harfanglab-job-artifact-downloadfile#


Start a job to download a file from a host (Windows / Linux)

Base Command#

harfanglab-job-artifact-downloadfile

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required
filenamePath of the file to download.Required

Context Output#

PathTypeDescription
Harfanglab.Job.IDstringid
actionunknownHarfangLab job action

harfanglab-job-prefetchlist#


Start a job to get the list of prefetches from a host (Windows)

Base Command#

harfanglab-job-prefetchlist

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.Job.IDstringid
actionunknownHarfangLab job action

harfanglab-job-runkeylist#


Start a job to get the list of run keys from a host (Windows)

Base Command#

harfanglab-job-runkeylist

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.Job.IDstringid
actionunknownHarfangLab job action

harfanglab-job-scheduledtasklist#


Start a job to get the list of scheduled tasks from a host (Windows)

Base Command#

harfanglab-job-scheduledtasklist

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.Job.IDstringid
actionunknownHarfangLab job action

harfanglab-job-driverlist#


Start a job to get the list of drivers from a host (Windows)

Base Command#

harfanglab-job-driverlist

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.Job.IDstringid
actionunknownHarfangLab job action

harfanglab-job-servicelist#


Start a job to get the list of services from a host (Windows)

Base Command#

harfanglab-job-servicelist

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.Job.IDstringid
actionunknownHarfangLab job action

harfanglab-job-processlist#


Start a job to get the list of processes from a host (Windows / Linux)

Base Command#

harfanglab-job-processlist

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.Job.IDstringid
actionunknownHarfangLab job action

harfanglab-job-networkconnectionlist#


Start a job to get the list of network connections from a host (Windows / Linux)

Base Command#

harfanglab-job-networkconnectionlist

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.Job.IDstringid
actionunknownHarfangLab job action

harfanglab-job-networksharelist#


Start a job to get the list of network shares from a host (Windows)

Base Command#

harfanglab-job-networksharelist

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.Job.IDstringid
actionunknownHarfangLab job action

harfanglab-job-sessionlist#


Start a job to get the list of sessions from a host (Windows)

Base Command#

harfanglab-job-sessionlist

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.Job.IDstringid
actionunknownHarfangLab job action

harfanglab-job-persistencelist#


Start a job to get the list of persistence items from a host (Linux)

Base Command#

harfanglab-job-persistencelist

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.Job.IDstringid
actionunknownHarfangLab job action

harfanglab-job-ioc#


Start a job to search for IOCs on a host (Windows / Linux)

Base Command#

harfanglab-job-ioc

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required
filenameexact filename to search.Optional
filepathexact filepath to search.Optional
hashfilehash to search (md5, sha1, sha256).Optional
search_in_pathrestrict searchs for filename or filepath or filepath_regex to a given path.Optional
hash_filesizesize of the file associated to the 'hash' parameters. If known, it will speed up the search process.Optional
registryregex to search in registry (key or value).Optional
filepath_regexsearch a regex on a filepath .Optional

Context Output#

PathTypeDescription
Harfanglab.Job.IDstringid
actionunknownHarfangLab job action

harfanglab-job-startuplist#


Start a job to get the list of startup items from a host (Windows)

Base Command#

harfanglab-job-startuplist

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.Job.IDstringid
actionunknownHarfangLab job action

harfanglab-job-wmilist#


Start a job to get the list of WMI items from a host (Windows)

Base Command#

harfanglab-job-wmilist

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.Job.IDstringid
actionunknownHarfangLab job action

harfanglab-job-artifact-mft#


Start a job to download the MFT from a host (Windows)

Base Command#

harfanglab-job-artifact-mft

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.artifact.download_linkstringURL to download the artifact
Harfanglab.Job.IDstringid

harfanglab-job-artifact-hives#


Start a job to download the hives from a host (Windows)

Base Command#

harfanglab-job-artifact-hives

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.artifact.download_linkstringURL to download the artifact
Harfanglab.Job.IDstringid

harfanglab-job-artifact-evtx#


Start a job to download the event logs from a host (Windows)

Base Command#

harfanglab-job-artifact-evtx

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.artifact.download_linkstringURL to download the artifact
Harfanglab.Job.IDstringid

harfanglab-job-artifact-logs#


Start a job to download Linux log files from a host (Linux)

Base Command#

harfanglab-job-artifact-logs

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.artifact.download_linkstringURL to download the artifact
Harfanglab.Job.IDstringid

harfanglab-job-artifact-filesystem#


Start a job to download Linux filesystem entries from a host (Linux)

Base Command#

harfanglab-job-artifact-filesystem

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.artifact.download_linkstringURL to download the artifact
Harfanglab.Job.IDstringid

harfanglab-job-artifact-all#


Start a job to download all artifacts from a host (Windows MFT, Hives, evt/evtx, Prefetch, USN, Linux logs and file list)

Base Command#

harfanglab-job-artifact-all

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.artifact.download_linkstringURL to download the artifact
Harfanglab.Job.IDstringid

harfanglab-job-artifact-ramdump#


Start a job to get the entine RAM from a host (Windows / Linux)

Base Command#

harfanglab-job-artifact-ramdump

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

PathTypeDescription
Harfanglab.artifact.download_linkstringURL to download the artifact
Harfanglab.Job.IDstringid

harfanglab-telemetry-network#


Search network connections from a specific hostname

Base Command#

harfanglab-telemetry-network

Input#

Argument NameDescriptionRequired
hostnameEndpoint hostname.Required
from_dateStart date (format: YYYY-MM-DDTHH:MM:SS).Optional
to_dateEnd date (format: YYYY-MM-DDTHH:MM:SS).Optional
source_addressSource IP address.Optional
source_portSource port.Optional
destination_addressDestination IP address.Optional
destination_portDestination port.Optional

Context Output#

There is no context output for this command.

harfanglab-telemetry-eventlog#


Search event logs from a specific hostname

Base Command#

harfanglab-telemetry-eventlog

Input#

Argument NameDescriptionRequired
hostnameEndpoint hostname.Required
from_dateStart date (format: YYYY-MM-DDTHH:MM:SS).Optional
to_dateEnd date (format: YYYY-MM-DDTHH:MM:SS).Optional

Context Output#

There is no context output for this command.

harfanglab-telemetry-binary#


Search for binaries

Base Command#

harfanglab-telemetry-binary

Input#

Argument NameDescriptionRequired
from_dateStart date (format: YYYY-MM-DDTHH:MM:SS).Optional
to_dateEnd date (format: YYYY-MM-DDTHH:MM:SS).Optional
hashfilehash to search (md5, sha1, sha256).Optional

Context Output#

There is no context output for this command.

harfanglab-job-info#


Get job status information

Base Command#

harfanglab-job-info

Input#

Argument NameDescriptionRequired
idsComa-separated list of job ids.Required

Context Output#

PathTypeDescription
Harfanglab.Job.StatusstringJob Status

harfanglab-result-pipelist#


Get a hostname's list of pipes from job results

Base Command#

harfanglab-result-pipelist

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Required

Context Output#

PathTypeDescription
Harfanglab.Pipe.dataunknownProvides a list of named pipes

harfanglab-result-prefetchlist#


Get a hostname's list of prefetches from job results

Base Command#

harfanglab-result-prefetchlist

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Required

Context Output#

PathTypeDescription
Harfanglab.Prefetch.dataunknownProvides a list of prefetch files

harfanglab-result-runkeylist#


Get a hostname's list of run keys from job results

Base Command#

harfanglab-result-runkeylist

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Required

Context Output#

PathTypeDescription
Harfanglab.RunKey.dataunknownProvides a list of Run Keys

harfanglab-result-scheduledtasklist#


Get a hostname's list of scheduled tasks from job results

Base Command#

harfanglab-result-scheduledtasklist

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Optional

Context Output#

PathTypeDescription
Harfanglab.ScheduledTask.dataunknownProvides a list of scheduled tasks

harfanglab-result-driverlist#


Get a hostname's loaded drivers from job results

Base Command#

harfanglab-result-driverlist

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Optional

Context Output#

PathTypeDescription
Harfanglab.Driver.dataunknownProvides a list of loaded drivers

harfanglab-result-servicelist#


Get a hostname's list of services from job results

Base Command#

harfanglab-result-servicelist

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Optional

Context Output#

PathTypeDescription
Harfanglab.Service.dataunknownProvides a list of services

harfanglab-result-processlist#


Get a hostname's list of processes from job results

Base Command#

harfanglab-result-processlist

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Required

Context Output#

PathTypeDescription
Harfanglab.Process.dataunknownProvides a list of processes

harfanglab-result-networkconnectionlist#


Get a hostname's network connections from job results

Base Command#

harfanglab-result-networkconnectionlist

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Required

Context Output#

PathTypeDescription
Harfanglab.NetworkConnection.dataunknownProvides a list of active network connections

harfanglab-result-networksharelist#


Get a hostname's network shares from job results

Base Command#

harfanglab-result-networksharelist

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Required

Context Output#

PathTypeDescription
Harfanglab.NetworkShare.dataunknownProvides a list of network shares

harfanglab-result-sessionlist#


Get a hostname's sessions from job results

Base Command#

harfanglab-result-sessionlist

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Required

Context Output#

PathTypeDescription
Harfanglab.Session.dataunknownProvides a list of active sessions

harfanglab-result-persistencelist#


Get a hostname's persistence items from job results

Base Command#

harfanglab-result-persistencelist

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Required

Context Output#

PathTypeDescription
Harfanglab.PersistenceList.dataunknownProvides a list of persistence means

harfanglab-result-ioc#


Get the list of items matching IOCs searched in an IOC job

Base Command#

harfanglab-result-ioc

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Required

Context Output#

PathTypeDescription
Harfanglab.IOC.dataunknownProvides a list of matching elements

harfanglab-result-startuplist#


Get a hostname's startup items from job results

Base Command#

harfanglab-result-startuplist

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Required

Context Output#

PathTypeDescription
Harfanglab.Startup.dataunknownProvides a list of startup files

harfanglab-result-wmilist#


Get a hostname's WMI items from job results

Base Command#

harfanglab-result-wmilist

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Required

Context Output#

PathTypeDescription
Harfanglab.Wmi.dataunknownProvides a list of WMI items

harfanglab-result-artifact-mft#


Get a hostname's MFT from job results

Base Command#

harfanglab-result-artifact-mft

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Required

Context Output#

PathTypeDescription
Harfanglab.Artifact.dataunknownProvides a link to download the raw MFT

harfanglab-result-artifact-hives#


Get a hostname's hives from job results

Base Command#

harfanglab-result-artifact-hives

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Required

Context Output#

PathTypeDescription
Harfanglab.Artifact.dataunknownProvides a link to download the raw hives

harfanglab-result-artifact-evtx#


Get a hostname's log files from job results

Base Command#

harfanglab-result-artifact-evtx

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Optional

Context Output#

PathTypeDescription
Harfanglab.Artifact.dataunknownProvides a link to download the evt/evtx files

harfanglab-result-artifact-logs#


Get a hostname's log files from job results

Base Command#

harfanglab-result-artifact-logs

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Optional

Context Output#

PathTypeDescription
Harfanglab.Artifact.dataunknownProvides a link to download the log files

harfanglab-result-artifact-filesystem#


Get a hostname's filesystem entries from job results

Base Command#

harfanglab-result-artifact-filesystem

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Optional

Context Output#

PathTypeDescription
Harfanglab.Artifact.dataunknownProvides a link to download the CSV file with filesystem entries

harfanglab-result-artifact-all#


Get all artifacts from a hostname from job results

Base Command#

harfanglab-result-artifact-all

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Optional

Context Output#

PathTypeDescription
Harfanglab.Artifact.dataunknownProvides a link to download an archive with all raw artifacts

harfanglab-result-artifact-downloadfile#


Get a hostname's file from job results

Base Command#

harfanglab-result-artifact-downloadfile

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Required

Context Output#

PathTypeDescription
Harfanglab.DownloadFile.dataunknownProvides a link to download the file

harfanglab-result-artifact-ramdump#


Get a hostname's RAM dump from job results

Base Command#

harfanglab-result-artifact-ramdump

Input#

Argument NameDescriptionRequired
job_idJob id as returned by the job submission commands.Required

Context Output#

PathTypeDescription
Harfanglab.Ramdump.dataunknownProvides a link to download the raw RAM dump

harfanglab-hunt-search-hash#


Command used to search a hash IOC in database

Base Command#

harfanglab-hunt-search-hash

Input#

Argument NameDescriptionRequired
hashfilehash to search (md5, sha1, sha256).Required

Context Output#

PathTypeDescription
Harfanglab.HashunknownProvides statistics associated to currently running processes and previously executed processes associated to hash

harfanglab-hunt-search-running-process-hash#


Command used to search running process associated with Hash

Base Command#

harfanglab-hunt-search-running-process-hash

Input#

Argument NameDescriptionRequired
hashfilehash to search (sha256).Required

Context Output#

PathTypeDescription
Harfanglab.HuntRunningProcessSearch.dataunknownList of all systems where processes associated to hash are running

harfanglab-hunt-search-runned-process-hash#


Command used to search runned process associated with Hash

Base Command#

harfanglab-hunt-search-runned-process-hash

Input#

Argument NameDescriptionRequired
hashfilehash to search (sha256).Required

Context Output#

PathTypeDescription
Harfanglab.HuntRunnedProcessSearch.dataunknownList of all systems where processes associated to hash have been previously running

harfanglab-isolate-endpoint#


Command used to isolate an endpoint from the network while remaining connected to the EDR manager

Base Command#

harfanglab-isolate-endpoint

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

There is no context output for this command.

harfanglab-deisolate-endpoint#


Command used to deisolate an endpoint and reconnect it to the network

Base Command#

harfanglab-deisolate-endpoint

Input#

Argument NameDescriptionRequired
agent_idAgent unique identifier as provided by the HarfangLab EDR Manager.Required

Context Output#

There is no context output for this command.

harfanglab-change-security-event-status#


Command used to change the status of a security event

Base Command#

harfanglab-change-security-event-status

Input#

Argument NameDescriptionRequired
security_event_idSecurity event id.Required
statusNew status of the security event id (New, Investigating, False Positive, Closed).Required

Context Output#

There is no context output for this command.

harfanglab-assign-policy-to-agent#


Assign a policy to an agent

Base Command#

harfanglab-assign-policy-to-agent

Input#

Argument NameDescriptionRequired
agentidAgent identifier.Required
policyPolicy name.Required

Context Output#

There is no context output for this command.

harfanglab-add-ioc-to-source#


Add an IOC to a Threat Intelligence source

Base Command#

harfanglab-add-ioc-to-source

Input#

Argument NameDescriptionRequired
ioc_valueIOC value.Required
ioc_typeIOC type (hash, filename, filepath).Required
ioc_commentComment associated to IOC.Optional
ioc_statusIOC status (stable, testing).Required
source_nameIOC Source Name.Required

Context Output#

There is no context output for this command.

harfanglab-delete-ioc-from-source#


Delete an IOC from a Threat Intelligence source

Base Command#

harfanglab-delete-ioc-from-source

Input#

Argument NameDescriptionRequired
ioc_valueIOC value.Required
source_nameIOC Source Name.Required

Context Output#

There is no context output for this command.