HarfangLab EDR (v1.2.5)
This connector allows to fetch security events and/or threats from a HarfangLab EDR Manager and manage the incident response.
- Author
- HarfangLab
- Support
- partner
- URL
- https://support.harfanglab.fr
- Categories
- Endpoint
Incident fields (9)
- HarfangLab EDR Critical Security Event Count
- HarfangLab EDR High Security Event Count
- HarfangLab EDR Low Security Event Count
- HarfangLab EDR Medium Security Event Count
- HarfangLab EDR Threat ID
- HarfangLab EDR Top Agents
- HarfangLab EDR Top Impacted Users
- HarfangLab EDR Top Rules
- HarfangLab EDR Total Security Event Count
Integrations (1)
- HarfangLab EDR
Layouts (2)
- Hurukai alert layout
- Hurukai threat layout
Playbooks (24)
- Hurukai - Add indicators to HarfangLab EDR
- Hurukai - Alert management
- Hurukai - Get All Artifacts
- Hurukai - Get Artifact Evtx
- Hurukai - Get Artifact Filesystem
- Hurukai - Get Artifact Hives
- Hurukai - Get Artifact Logs
- Hurukai - Get Artifact MFT
- Hurukai - Get Artifact RAM Dump
- Hurukai - Get Driver List
- Hurukai - Get Network Connection List
- Hurukai - Get Network Share List
- Hurukai - Get Persistence List
- Hurukai - Get Pipe List
- Hurukai - Get Prefetch List
- Hurukai - Get Process List
- Hurukai - Get Runkey List
- Hurukai - Get Scheduled Task List
- Hurukai - Get Service List
- Hurukai - Get Session List
- Hurukai - Get Startup List
- Hurukai - Get WMI List
- Hurukai - Hunt IOCs
- Hurukai - Process Indicators - Manual Review
README
HarfangLab EDR
This connector allows to fetch security events from a HarfangLab EDR Manager and manage the incident response.
It is shipped with:
- an integration with 60+ commands/tasks,
- an alert management playbook including 20+ sub-playbooks,
- several Threat Intelligence Management playbooks that allows to hunt for IOCs in the EDR, manually review the IOC sightings and then put the IOCs into detection in the EDR,
- an alert type along with its associated incident mapper,
- a specific alert layout tailored to HarfangLab EDR alerts.
The alert management playbook illustrates several steps of a typical incident response with forensics activities:
- Endpoint isolation
- Forensics data collection
- Raw artifacts collection
- Agent reconnection
- Case closing