fix(harfanglab): correct get_threats mapper to native threat fields; add agent.osversion

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

integrations/harfanglab/manifest.yaml

@@ -1,8 +1,8 @@
 id: harfanglab
 name: HarfangLab EDR
-version: 1.2.0
+version: 1.2.1
 description: "HarfangLab EDR — endpoint detection & response: alert/threat ingestion, endpoint enrichment, isolation, threat-intelligence (IOC/whitelist), telemetry hunting and forensic collection jobs."
-changelog: "1.2.0 — Added ingestion commands get_security_events (alerts) and get_threats with bundled OCSF mappers and ingest hints (results_path/dedup/incremental). 1.1.1 — Added test_connection for the instance Test button. 1.1.0 — Command names prefixed with 'harfanglab-' (e.g. harfanglab-isolate-endpoint) for easier toolbox search; command IDs unchanged. 1.0.0 — Initial release: endpoint/agent management, isolation, policy assignment, IOC & whitelist management, security-event triage, telemetry hunting (processes, network, DNS, authentications, binaries, event logs), threat hunting by hash, and forensic collection jobs (pipes, prefetch, run keys, scheduled tasks, drivers, services, processes, network, sessions, WMI, IOC scan, artifacts, RAM dump) with their result retrieval commands. Compatible with HarfangLab EDR 2.13.7+."
+changelog: "1.2.1 — Corrected the get_threats OCSF mapper to native threat fields (top_agents/top_impacted_users/top_rules/mitre_tactics) instead of XSOAR-enriched arrays; added agent.osversion to get_security_events. 1.2.0 — Added ingestion commands get_security_events (alerts) and get_threats with bundled OCSF mappers and ingest hints (results_path/dedup/incremental). 1.1.1 — Added test_connection for the instance Test button. 1.1.0 — Command names prefixed with 'harfanglab-' (e.g. harfanglab-isolate-endpoint) for easier toolbox search; command IDs unchanged. 1.0.0 — Initial release: endpoint/agent management, isolation, policy assignment, IOC & whitelist management, security-event triage, telemetry hunting (processes, network, DNS, authentications, binaries, event logs), threat hunting by hash, and forensic collection jobs (pipes, prefetch, run keys, scheduled tasks, drivers, services, processes, network, sessions, WMI, IOC scan, artifacts, RAM dump) with their result retrieval commands. Compatible with HarfangLab EDR 2.13.7+."
 category: endpoint
 
 # Per-instance configuration. Scripts use <url> as the API base and call /api/... paths.

integrations/harfanglab/mappers/get_security_events.yaml

@@ -12,6 +12,7 @@ ocsf:
   - { source_path: "agent.domainname",     ocsf_field: "src_endpoint.domain" }
   - { source_path: "agent.osproducttype",  ocsf_field: "src_endpoint.os.name" }
   - { source_path: "agent.ostype",         ocsf_field: "src_endpoint.os.type" }
+  - { source_path: "agent.osversion",      ocsf_field: "device.os.version" }
   - { source_path: "agent.agentid",        ocsf_field: "device.uid" }
   # ── Finding ───────────────────────────────────────────────────────
   - { source_path: "id",          ocsf_field: "finding_info.uid" }

integrations/harfanglab/mappers/get_threats.yaml

@@ -1,5 +1,5 @@
 name: "HarfangLab Threats → OCSF"
-description: "Maps a HarfangLab EDR threat (/api/data/alert/alert/Threat/, results_path = results, enriched with agents/impacted_users/rules) to OCSF."
+description: "Maps a raw HarfangLab EDR threat (/api/data/alert/alert/Threat/, results_path = results) to OCSF. Uses native threat fields (top_agents/top_impacted_users/top_rules/mitre_tactics); the agents/impacted_users/rules arrays only exist after XSOAR-side enrichment, which this connector does not perform."
 field_mappings:
   title: "slug"
   severity: "level = 'critical' ? 5 : (level = 'high' ? 4 : (level = 'medium' ? 3 : 2))"
@@ -15,11 +15,9 @@ ocsf:
   - { source_path: "last_seen",     ocsf_field: "finding_info.last_seen_time" }
   - { source_path: "last_update",   ocsf_field: "finding_info.modified_time" }
   - { source_path: "status",        ocsf_field: "status" }
-  # ── Impacted endpoint (first enriched agent) ──────────────────────
+  # ── MITRE ATT&CK (native mitre_tactics list) ──────────────────────
-  - { source_path: "agents[0].hostname",      ocsf_field: "src_endpoint.hostname" }
+  - { source_path: "mitre_tactics[0]", ocsf_field: "attacks.tactic.name" }
-  - { source_path: "agents[0].domainname",    ocsf_field: "src_endpoint.domain" }
+  # ── Top impacted endpoint / user / rule (native aggregates) ───────
-  - { source_path: "agents[0].osproducttype", ocsf_field: "src_endpoint.os.name" }
+  - { source_path: "top_agents[0].agent_hostname",   ocsf_field: "src_endpoint.hostname" }
-  - { source_path: "agents[0].ostype",        ocsf_field: "src_endpoint.os.type" }
+  - { source_path: "top_impacted_users[0].user_name", ocsf_field: "user.name" }
-  # ── Impacted user / rule ──────────────────────────────────────────
+  - { source_path: "top_rules[0].rule_name",         ocsf_field: "rule.name" }
-  - { source_path: "impacted_users[0].full_name", ocsf_field: "user.name" }
-  - { source_path: "rules[0].rule_name",          ocsf_field: "rule.name" }