Hurukai - Alert management

Manager security events from HarfangLab EDR

HarfangLab EDR · 40 tasks · 0 inputs · 0 outputs

Commands used

closeInvestigation harfanglab-change-security-event-status harfanglab-deisolate-endpoint harfanglab-get-endpoint-info harfanglab-isolate-endpoint setIncident

Flowchart

false true Critical severity and yara / sigma / ransomware / hlai type false true false true false true Start Start Set incident isolated flag - setIncident Set incident isolated flag setIncident Done Done Can the agent be isolated ? Can the agent be isolated ? Manually isolate endpoint Manually isolate endpoint Agent isolation Agent isolation Forensics data collection Forensics data collection Agent reconnection Agent reconnection Get endpoint information (OS, policy...) - harfanglab-get-endpoint-info Get endpoint information ... harfanglab-get-endpoint-info harfanglab-isolate-endpoint - harfanglab-isolate-endpoint harfanglab-isolate-endpoint harfanglab-isolate-endpoint harfanglab-deisolate-endpoint - harfanglab-deisolate-endpoint harfanglab-deisolate-endp... harfanglab-deisolate-endpoint Should the alert be investigated (type, severity) ? Should the alert be inves... Hurukai - Get Driver List - Hurukai - Get Driver List Hurukai - Get Driver List Hurukai - Get Driver List Hurukai - Get Process List - Hurukai - Get Process List Hurukai - Get Process List Hurukai - Get Process List Advanced Forensics Advanced Forensics Should we perform advanced forensics ? Should we perform advance... Investigate the incident Investigate the incident Hurukai - Get Pipe List - Hurukai - Get Pipe List Hurukai - Get Pipe List Hurukai - Get Pipe List Hurukai - Get Prefetch List - Hurukai - Get Prefetch List Hurukai - Get Prefetch List Hurukai - Get Prefetch List Hurukai - Get Runkey List - Hurukai - Get Runkey List Hurukai - Get Runkey List Hurukai - Get Runkey List Hurukai - Get Scheduled Task List - Hurukai - Get Scheduled Task List Hurukai - Get Scheduled T... Hurukai - Get Scheduled Task ... Hurukai - Get Service List - Hurukai - Get Service List Hurukai - Get Service List Hurukai - Get Service List Hurukai - Get Artifact RAM Dump - Hurukai - Get Artifact RAM Dump Hurukai - Get Artifact RA... Hurukai - Get Artifact RAM Dump Hurukai - Get Startup List - Hurukai - Get Startup List Hurukai - Get Startup List Hurukai - Get Startup List Hurukai - Get WMI List - Hurukai - Get WMI List Hurukai - Get WMI List Hurukai - Get WMI List Hurukai - Get Persistence List - Hurukai - Get Persistence List Hurukai - Get Persistence... Hurukai - Get Persistence List Hurukai - Get All Artifacts - Hurukai - Get All Artifacts Hurukai - Get All Artifacts Hurukai - Get All Artifacts Hurukai - Get Network Share List - Hurukai - Get Network Share List Hurukai - Get Network Sha... Hurukai - Get Network Share List Hurukai - Get Session List - Hurukai - Get Session List Hurukai - Get Session List Hurukai - Get Session List Hurukai - Get Network Connection List - Hurukai - Get Network Connection List Hurukai - Get Network Con... Hurukai - Get Network Connect... Done Done Set incident isolated flag - setIncident Set incident isolated flag setIncident Set incident status to 'Investigating' in Harfanglab Manager - harfanglab-change-security-event-status Set incident status to 'I... harfanglab-change-security-ev... Set incident status to 'Closed' in Harfanglab Manager - harfanglab-change-security-event-status Set incident status to 'C... harfanglab-change-security-ev... Was it a false positive ? Was it a false positive ? Set incident status to 'False Positive' in Harfanglab Manager - harfanglab-change-security-event-status Set incident status to 'F... harfanglab-change-security-ev... Should I isolate the endpoint before starting investigation ? Should I isolate the endp... Close XSOAR incident - closeInvestigation Close XSOAR incident closeInvestigation Close XSOAR incident - closeInvestigation Close XSOAR incident closeInvestigation Set incident status to 'Closed' in Harfanglab Manager - harfanglab-change-security-event-status Set incident status to 'C... harfanglab-change-security-ev...