Configuration parameters
url— API URL (required)isFetch— Fetch incidentsincidentType— Incident typecredentials—apikey— API KeylongRunning— Long running instanceincidentFetchInterval— Incidents Fetch Intervalalert_type— Fetch alerts with typemin_severity— Minimum severity of alerts to fetch (required)alert_status— Fetch alerts with status (ACTIVE, CLOSED)max_fetch— Maximum number of incidents to fetch per callfirst_fetch— First fetch time (required)mirror_direction— Mirroring Directionfetch_types— Fetch typesclose_incident— Close Mirrored security event or threat in the XSOARclose_in_hfl— Close Mirrored security event or threat in HarfangLab EDRinsecure— Trust any certificate (not secure)proxy— Use system proxy settings
Commands (77)
-
fetch-incidentsAllows to retrieve incidents from the HarfangLab EDR API.
-
get-mapping-fieldsReturns the list of fields to map in outgoing mirroring. This command is only used for debugging purposes.
-
get-modified-remote-dataGets the list of security events and threats that were modified since the last update time. This method is used for debugging purposes. The get-modified-remote-data command is used as part of the Mirroring feature that was introduced in Cortex XSOAR version 6.1.
-
get-remote-dataGets remote data from a remote security event or threat. This method does not update the current security event or threat, and should be used for debugging purposes only.
-
harfanglab-add-ioc-to-sourceAdd an IOC to a Threat Intelligence source.
-
harfanglab-api-callPerform a generic API call.
-
harfanglab-assign-policy-to-agentAssign a policy to an agent.
-
harfanglab-change-security-event-statusCommand used to change the status of a security event.
-
harfanglab-deisolate-endpointCommand used to deisolate an endpoint and reconnect it to the network.
-
harfanglab-delete-ioc-from-sourceDelete an IOC from a Threat Intelligence source.
-
harfanglab-endpoint-searchSearch for endpoint information from a hostname.
-
harfanglab-get-endpoint-infoGet endpoint information from agent_id.
-
harfanglab-hunt-search-hashCommand used to search a hash IOC in database.
-
harfanglab-hunt-search-runned-process-hashCommand used to search runned process associated with Hash.
-
harfanglab-hunt-search-running-process-hashCommand used to search running process associated with Hash.
-
harfanglab-isolate-endpointCommand used to isolate an endpoint from the network while remaining connected to the EDR manager.
-
harfanglab-job-artifact-allStart a job to download all artifacts from a host (Windows MFT, Hives, evt/evtx, Prefetch, USN, Linux logs and file list).
-
harfanglab-job-artifact-downloadfileStart a job to download a file from a host (Windows / Linux).
-
harfanglab-job-artifact-evtxStart a job to download the event logs from a host (Windows).
-
harfanglab-job-artifact-filesystemStart a job to download Linux filesystem entries from a host (Linux).
-
harfanglab-job-artifact-hivesStart a job to download the hives from a host (Windows).
-
harfanglab-job-artifact-logsStart a job to download Linux log files from a host (Linux).
-
harfanglab-job-artifact-mftStart a job to download the MFT from a host (Windows).
-
harfanglab-job-artifact-ramdumpStart a job to get the entire RAM from a host (Windows / Linux).
-
harfanglab-job-driverlistStart a job to get the list of drivers from a host (Windows).
-
harfanglab-job-infoGet job status information.
-
harfanglab-job-iocStart a job to search for IOCs on a host (Windows / Linux).
-
harfanglab-job-networkconnectionlistStart a job to get the list of network connections from a host (Windows / Linux).
-
harfanglab-job-networksharelistStart a job to get the list of network shares from a host (Windows).
-
harfanglab-job-persistencelistStart a job to get the list of persistence items from a host (Linux).
-
harfanglab-job-pipelistStart a job to get the list of pipes from a host (Windows).
-
harfanglab-job-prefetchlistStart a job to get the list of prefetches from a host (Windows).
-
harfanglab-job-processlistStart a job to get the list of processes from a host (Windows / Linux).
-
harfanglab-job-runkeylistStart a job to get the list of run keys from a host (Windows).
-
harfanglab-job-scheduledtasklistStart a job to get the list of scheduled tasks from a host (Windows).
-
harfanglab-job-servicelistStart a job to get the list of services from a host (Windows).
-
harfanglab-job-sessionlistStart a job to get the list of sessions from a host (Windows).
-
harfanglab-job-startuplistStart a job to get the list of startup items from a host (Windows).
-
harfanglab-job-wmilistStart a job to get the list of WMI items from a host (Windows).
-
harfanglab-result-artifact-allGet all artifacts from a hostname from job results.
-
harfanglab-result-artifact-downloadfileGet a hostname's file from job results.
-
harfanglab-result-artifact-evtxGet a hostname's log files from job results.
-
harfanglab-result-artifact-filesystemGet a hostname's filesystem entries from job results.
-
harfanglab-result-artifact-hivesGet a hostname's hives from job results.
-
harfanglab-result-artifact-logsGet a hostname's log files from job results.
-
harfanglab-result-artifact-mftGet a hostname's MFT from job results.
-
harfanglab-result-artifact-ramdumpGet a hostname's RAM dump from job results.
-
harfanglab-result-driverlistGet a hostname's loaded drivers from job results.
-
harfanglab-result-iocGet the list of items matching IOCs searched in an IOC job.
-
harfanglab-result-networkconnectionlistGet a hostname's network connections from job results.
-
harfanglab-result-networksharelistGet a hostname's network shares from job results.
-
harfanglab-result-persistencelistGet a hostname's persistence items from job results.
-
harfanglab-result-pipelistGet a hostname's list of pipes from job results.
-
harfanglab-result-prefetchlistGet a hostname's list of prefetches from job results.
-
harfanglab-result-processlistGet a hostname's list of processes from job results.
-
harfanglab-result-runkeylistGet a hostname's list of run keys from job results.
-
harfanglab-result-scheduledtasklistGet a hostname's list of scheduled tasks from job results.
-
harfanglab-result-servicelistGet a hostname's list of services from job results.
-
harfanglab-result-sessionlistGet a hostname's sessions from job results.
-
harfanglab-result-startuplistGet a hostname's startup items from job results.
-
harfanglab-result-wmilistGet a hostname's WMI items from job results.
-
harfanglab-telemetry-authentication-linuxSearch Linux authentication telemetry.
-
harfanglab-telemetry-authentication-macosSearch Macos authentication telemetry.
-
harfanglab-telemetry-authentication-usersGet the top n users who successfully authenticated on the host.
-
harfanglab-telemetry-authentication-windowsSearch Windows authentication telemetry.
-
harfanglab-telemetry-binarySearch for binaries.
-
harfanglab-telemetry-dnsSearch DNS resolutions.
-
harfanglab-telemetry-eventlogSearch event logs.
-
harfanglab-telemetry-networkSearch network connections.
-
harfanglab-telemetry-process-graphGet a process graph.
-
harfanglab-telemetry-processesSearch processes.
-
harfanglab-whitelist-addAdd a whitelist.
-
harfanglab-whitelist-add-criterionAdd a criterion to an existing whitelist.
-
harfanglab-whitelist-deleteDelete a whitelist.
-
harfanglab-whitelist-searchSearch whitelists from a keyword.
-
test-moduleAllows to test that the HarfangLab EDR API is reachable.
-
update-remote-systemUpdates the remote security event or threat with local security event or threat changes. This method is only used for debugging purposes and will not update the current security event or threat.