f3nris/riposte-marketplace
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(harfanglab): add get_security_events + get_threats ingestion commands, OCSF mappers and ingest hints

Browse Source 
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Guillaume BOURGEOIS
2026-06-26 14:15:57 +02:00
parent be7d4a8b7c
commit 2c4d40103e
5 changed files with 202 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
integrations/harfanglab/manifest.yaml
+37 -3
View File
@@ -1,8 +1,8 @@
id: harfanglab
name: HarfangLab EDR
version: 1.1.1
description: "HarfangLab EDR — endpoint detection & response: endpoint enrichment, isolation, threat-intelligence (IOC/whitelist), telemetry hunting and forensic collection jobs."
changelog: "1.1.1 — Added test_connection for the instance Test button. 1.1.0 — Command names prefixed with 'harfanglab-' (e.g. harfanglab-isolate-endpoint) for easier toolbox search; command IDs unchanged. 1.0.0 — Initial release: endpoint/agent management, isolation, policy assignment, IOC & whitelist management, security-event triage, telemetry hunting (processes, network, DNS, authentications, binaries, event logs), threat hunting by hash, and forensic collection jobs (pipes, prefetch, run keys, scheduled tasks, drivers, services, processes, network, sessions, WMI, IOC scan, artifacts, RAM dump) with their result retrieval commands. Compatible with HarfangLab EDR 2.13.7+."
version: 1.2.0
description: "HarfangLab EDR — endpoint detection & response: alert/threat ingestion, endpoint enrichment, isolation, threat-intelligence (IOC/whitelist), telemetry hunting and forensic collection jobs."
changelog: "1.2.0 — Added ingestion commands get_security_events (alerts) and get_threats with bundled OCSF mappers and ingest hints (results_path/dedup/incremental). 1.1.1 — Added test_connection for the instance Test button. 1.1.0 — Command names prefixed with 'harfanglab-' (e.g. harfanglab-isolate-endpoint) for easier toolbox search; command IDs unchanged. 1.0.0 — Initial release: endpoint/agent management, isolation, policy assignment, IOC & whitelist management, security-event triage, telemetry hunting (processes, network, DNS, authentications, binaries, event logs), threat hunting by hash, and forensic collection jobs (pipes, prefetch, run keys, scheduled tasks, drivers, services, processes, network, sessions, WMI, IOC scan, artifacts, RAM dump) with their result retrieval commands. Compatible with HarfangLab EDR 2.13.7+."
category: endpoint
# Per-instance configuration. Scripts use <url> as the API base and call /api/... paths.
@@ -30,6 +30,40 @@ auth:
secret_field: api_token
commands:
# ── Alerts & threats (ingestion) ──────────────────────────────────────────
- id: get_security_events
name: harfanglab-get-security-events
description: "Fetch HarfangLab EDR security events (alerts) for ingestion. Returns {results: [...]} — use results as the alert rule results path."
risk: read
inputs_schema:
properties:
min_severity: { type: string, description: "Minimum severity to fetch: low, medium, high, critical" }
status: { type: string, description: "Comma-separated statuses (new, investigating, closed, false_positive)" }
alert_type: { type: string, description: "Comma-separated alert types (sigma, yara, hlai, vt, ransom, ioc, glimps, orion...)" }
created_after: { type: string, description: "ISO8601 lower bound on alert_time (incremental fetch watermark)" }
limit: { type: number, description: "Maximum number of events to fetch" }
required: []
outputs_schema: { properties: {} }
ingest:
results_path: results
dedup_key: id
incremental_field: created_after
- id: get_threats
name: harfanglab-get-threats
description: "Fetch HarfangLab EDR threats (aggregated security events) for ingestion. Returns {results: [...]} enriched with agents/impacted_users/rules."
risk: read
inputs_schema:
properties:
min_severity: { type: string, description: "Minimum severity to fetch: low, medium, high, critical" }
status: { type: string, description: "Comma-separated statuses (new, investigating, closed, false_positive)" }
created_after: { type: string, description: "ISO8601 lower bound on creation_date (incremental fetch watermark)" }
limit: { type: number, description: "Maximum number of threats to fetch" }
required: []
outputs_schema: { properties: {} }
ingest:
results_path: results
dedup_key: id
incremental_field: created_after
# ── Endpoints / agents ────────────────────────────────────────────────────
- id: get_endpoint_info
name: harfanglab-get-endpoint-info