f3nris/riposte-marketplace
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: declare a risk tier on every command in the catalog

Browse Source 
467 of the 1592 commands carried no `risk:`. An unset risk is read as
destructive by the agent approval gate, so half the catalog's write side sat
behind the same prompt — and, in HarfangLab's case, 39 pure lookups did too.
A gate that stops everything stops being read as a signal, which is the
argument already made for the toolkit and for sentinelone (df27876).

The catalog is now 1027 read, 261 safe_write, 304 destructive, with nothing
defaulted. The line follows the one sentinelone drew: impact on the estate,
not reversibility — isolate-agent is reversible and is the canonical
destructive example.

  read        only queries; changes nothing outside Riposte
  safe_write  additive or reversible inside the tool's own case/enrichment
              plane: comments, tickets, tags, alert statuses, threat-intel
              records, sandbox submissions, collection jobs, outbound messages
  destructive changes the estate or weakens a control: containment, blocklists
              and allowlists, exclusions and detection rules, every delete,
              identity and credential operations, code on a host, generic
              API escape hatches

Three calls that were not obvious, and are now applied throughout:

- Undoing a containment is tiered like the containment it lifts. Un-isolating
  a host or un-banning an IP mid-incident is its own decision, not a return to
  a neutral state. The catalog contradicted itself here — crowdstrike's
  lift_containment was destructive while harfanglab's deisolate_from_threat
  was safe_write — so deisolate_from_threat and unquarantine_file are
  re-tiered to destructive, the only two existing tiers this pass changes.
- Retrieving a live secret is destructive: cyberark get_password, delinea
  get_secret, vault read_secret, beyondtrust get_credential. It is a GET, but
  the tier describes the stake, not the HTTP verb.
- Sending outward to humans stays safe_write — slack, teams, twilio, telegram,
  mail. Irreversible, but it is the collaboration plane, not the estate.

An object created but not yet referenced by a rule is safe_write; editing one
a rule already reads is destructive. That is why fortigate create_address and
panos create_custom_url_category are safe_write while update_address_group and
edit_custom_url_category are not.

The template and README never documented the field, which is how 467 commands
came to omit it. Both now carry the tier table and these rules, so the next
integration declares a tier instead of inheriting one.

111 packages get a MINOR bump and a changelog entry: an instance compares
versions to offer an update, so an unbumped manifest would leave the tiers
sitting in the catalog and never reaching the estates that need them.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Guillaume BOURGEOIS
2026-09-08 12:55:20 +02:00
parent c7569fd4d0
commit 45e9cbd269
113 changed files with 727 additions and 224 deletions
Download Patch File Download Diff File Expand all files Collapse all files
integrations/harfanglab/manifest.yaml
+75 -4
View File
@@ -1,8 +1,8 @@
id: harfanglab
name: HarfangLab EDR
version: 1.4.1
version: 1.5.0
description: "HarfangLab EDR — endpoint detection & response: alert/threat ingestion, endpoint enrichment, isolation, threat-intelligence (IOC/whitelist), telemetry hunting and forensic collection jobs."
changelog: "1.4.1 — get_alerts now maps image_name, the one process path present on every alert subtype and the only one on those carrying neither a process object nor an event log (yara, binary, ioc). HarfangLab prefixes it with the matched threat name in brackets, so both halves are split out: the clean path feeds actor.process.file.path and its basename actor.process.name, and the threat name feeds malware.name — which now surfaces on every subtype rather than only on Defender event-log detections. Each half is guarded on the bracket being present so an unprefixed path is never written into malware.name. 1.4.0 — Mapper coverage from real payloads: get_alerts now maps the Windows event-log payload sigma alerts carry (alert_subtype = eventlog), which was entirely unmapped — Defender 1116/1117 yields the malware name, classification, severity and provider, the detected file, the process that touched it and the acting user, plus the log provider and event code. Also added the agent IP, DNS domain, device type, agent version and groups, the tenant, the alert subtype and threat type, the string severity and the event time. get_threats gained the threat level (previously never reaching the OCSF document at all), the event time and the top agent's reachability. 1.3.1 — Flagged get_alerts as ingestion-ready (ingest hints: results_path/dedup/incremental on from_date) so it appears in the recommended ingestion commands when creating an instance. 1.3.0 — Response & triage expansion: kill/dump process, on-demand AV/YARA scans, file/service/scheduled-task deletion, quarantine management, threat-level isolation, job cancel/relaunch/wait; alert search (get_alerts) and full alert/threat triage (tag, comments, notes, status, level, history, details); exhaustive alert OCSF mappers; reworked get_threats mapper (fixed MITRE tactics map handling, full top-agent/user/rule and counts coverage, rule-based incident title/description). 1.2.2 — Documentation wording cleanup. 1.2.1 — Corrected the get_threats OCSF mapper to native threat fields (top_agents/top_impacted_users/top_rules/mitre_tactics) instead of enriched-only arrays; added agent.osversion to get_security_events. 1.2.0 — Added ingestion commands get_security_events (alerts) and get_threats with bundled OCSF mappers and ingest hints (results_path/dedup/incremental). 1.1.1 — Added test_connection for the instance Test button. 1.1.0 — Command names prefixed with 'harfanglab-' (e.g. harfanglab-isolate-endpoint) for easier toolbox search; command IDs unchanged. 1.0.0 — Initial release: endpoint/agent management, isolation, policy assignment, IOC & whitelist management, security-event triage, telemetry hunting (processes, network, DNS, authentications, binaries, event logs), threat hunting by hash, and forensic collection jobs (pipes, prefetch, run keys, scheduled tasks, drivers, services, processes, network, sessions, WMI, IOC scan, artifacts, RAM dump) with their result retrieval commands. Compatible with HarfangLab EDR 2.13.7+."
changelog: "1.5.0 — Declare the risk tier on the 71 commands that carried none: 39 read, 24 safe_write, 8 destructive. An unset risk is read as destructive by the agent approval gate, so the 63 that only read or only annotate sat behind the same prompt as the ones that change the estate. deisolate_from_threat and unquarantine_file move from safe_write to destructive in the same pass: undoing a containment mid-incident is its own decision, and is tiered like the containment it lifts. | 1.4.1 — get_alerts now maps image_name, the one process path present on every alert subtype and the only one on those carrying neither a process object nor an event log (yara, binary, ioc). HarfangLab prefixes it with the matched threat name in brackets, so both halves are split out: the clean path feeds actor.process.file.path and its basename actor.process.name, and the threat name feeds malware.name — which now surfaces on every subtype rather than only on Defender event-log detections. Each half is guarded on the bracket being present so an unprefixed path is never written into malware.name. 1.4.0 — Mapper coverage from real payloads: get_alerts now maps the Windows event-log payload sigma alerts carry (alert_subtype = eventlog), which was entirely unmapped — Defender 1116/1117 yields the malware name, classification, severity and provider, the detected file, the process that touched it and the acting user, plus the log provider and event code. Also added the agent IP, DNS domain, device type, agent version and groups, the tenant, the alert subtype and threat type, the string severity and the event time. get_threats gained the threat level (previously never reaching the OCSF document at all), the event time and the top agent's reachability. 1.3.1 — Flagged get_alerts as ingestion-ready (ingest hints: results_path/dedup/incremental on from_date) so it appears in the recommended ingestion commands when creating an instance. 1.3.0 — Response & triage expansion: kill/dump process, on-demand AV/YARA scans, file/service/scheduled-task deletion, quarantine management, threat-level isolation, job cancel/relaunch/wait; alert search (get_alerts) and full alert/threat triage (tag, comments, notes, status, level, history, details); exhaustive alert OCSF mappers; reworked get_threats mapper (fixed MITRE tactics map handling, full top-agent/user/rule and counts coverage, rule-based incident title/description). 1.2.2 — Documentation wording cleanup. 1.2.1 — Corrected the get_threats OCSF mapper to native threat fields (top_agents/top_impacted_users/top_rules/mitre_tactics) instead of enriched-only arrays; added agent.osversion to get_security_events. 1.2.0 — Added ingestion commands get_security_events (alerts) and get_threats with bundled OCSF mappers and ingest hints (results_path/dedup/incremental). 1.1.1 — Added test_connection for the instance Test button. 1.1.0 — Command names prefixed with 'harfanglab-' (e.g. harfanglab-isolate-endpoint) for easier toolbox search; command IDs unchanged. 1.0.0 — Initial release: endpoint/agent management, isolation, policy assignment, IOC & whitelist management, security-event triage, telemetry hunting (processes, network, DNS, authentications, binaries, event logs), threat hunting by hash, and forensic collection jobs (pipes, prefetch, run keys, scheduled tasks, drivers, services, processes, network, sessions, WMI, IOC scan, artifacts, RAM dump) with their result retrieval commands. Compatible with HarfangLab EDR 2.13.7+."
category: endpoint
# Per-instance configuration. Scripts use <url> as the API base and call /api/... paths.
@@ -68,6 +68,7 @@ commands:
- id: get_endpoint_info
name: harfanglab-get-endpoint-info
description: Get endpoint (agent) information by agent ID.
risk: read
inputs_schema:
properties:
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
@@ -76,6 +77,7 @@ commands:
- id: endpoint_search
name: harfanglab-endpoint-search
description: Search endpoints (agents) by hostname.
risk: read
inputs_schema:
properties:
hostname: { type: string, description: "Hostname to filter agents by" }
@@ -84,6 +86,7 @@ commands:
- id: isolate_endpoint
name: harfanglab-isolate-endpoint
description: Network-isolate an endpoint (agent) by agent ID.
risk: destructive
inputs_schema:
properties:
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
@@ -92,6 +95,7 @@ commands:
- id: deisolate_endpoint
name: harfanglab-deisolate-endpoint
description: Remove network isolation from an endpoint (agent) by agent ID.
risk: destructive
inputs_schema:
properties:
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
@@ -100,6 +104,7 @@ commands:
- id: assign_policy_to_agent
name: harfanglab-assign-policy-to-agent
description: Assign a security policy to an agent by policy name and agent ID.
risk: destructive
inputs_schema:
properties:
policy: { type: string, description: "Name of the policy to assign" }
@@ -111,6 +116,7 @@ commands:
- id: whitelist_search
name: harfanglab-whitelist-search
description: Search threat-intelligence whitelists by keyword.
risk: read
inputs_schema:
properties:
keyword: { type: string, description: "Keyword to search" }
@@ -120,6 +126,7 @@ commands:
- id: whitelist_add
name: harfanglab-whitelist-add
description: Create a threat-intelligence whitelist rule with an initial criterion.
risk: destructive
inputs_schema:
properties:
comment: { type: string, description: "Whitelist comment" }
@@ -134,6 +141,7 @@ commands:
- id: whitelist_add_criterion
name: harfanglab-whitelist-add-criterion
description: Append a criterion to an existing whitelist rule.
risk: destructive
inputs_schema:
properties:
id: { type: string, description: "Whitelist rule id" }
@@ -146,6 +154,7 @@ commands:
- id: whitelist_delete
name: harfanglab-whitelist-delete
description: Delete a threat-intelligence whitelist rule by id.
risk: destructive
inputs_schema:
properties:
id: { type: string, description: "Whitelist rule id" }
@@ -156,6 +165,7 @@ commands:
- id: add_ioc_to_source
name: harfanglab-add-ioc-to-source
description: Add an IOC to a named IOC source if it does not already exist.
risk: safe_write
inputs_schema:
properties:
ioc_value: { type: string, description: "IOC value" }
@@ -168,6 +178,7 @@ commands:
- id: delete_ioc_from_source
name: harfanglab-delete-ioc-from-source
description: Remove an IOC from a named IOC source if it exists.
risk: destructive
inputs_schema:
properties:
ioc_value: { type: string, description: "IOC value" }
@@ -179,6 +190,7 @@ commands:
- id: change_security_event_status
name: harfanglab-change-security-event-status
description: "Change the status of a security event (New, Investigating, False Positive, Closed)."
risk: safe_write
inputs_schema:
properties:
security_event_id: { type: string, description: "Security event ID" }
@@ -190,6 +202,7 @@ commands:
- id: api_call
name: harfanglab-api-call
description: "Perform a generic authenticated call to the HarfangLab API."
risk: destructive
inputs_schema:
properties:
api_method: { type: string, description: "HTTP method (GET, POST, PUT, DELETE, PATCH)" }
@@ -201,6 +214,7 @@ commands:
- id: telemetry_process_graph
name: harfanglab-telemetry-process-graph
description: "Retrieve the process graph for a telemetry process UUID."
risk: read
inputs_schema:
properties:
process_uuid: { type: string, description: "Telemetry process UUID" }
@@ -211,6 +225,7 @@ commands:
- id: hunt_search_hash
name: harfanglab-hunt-search-hash
description: "Search the data explorer for a file hash."
risk: read
inputs_schema:
properties:
hash: { type: string, description: "File hash to search for" }
@@ -219,6 +234,7 @@ commands:
- id: hunt_search_running_process_hash
name: harfanglab-hunt-search-running-process-hash
description: "Hunt for currently running processes matching a SHA-256 hash."
risk: read
inputs_schema:
properties:
hash: { type: string, description: "SHA-256 hash to search for" }
@@ -227,6 +243,7 @@ commands:
- id: hunt_search_runned_process_hash
name: harfanglab-hunt-search-runned-process-hash
description: "Search process telemetry for executions matching a SHA-256 hash."
risk: read
inputs_schema:
properties:
hash: { type: string, description: "SHA-256 hash to search for" }
@@ -237,6 +254,7 @@ commands:
- id: telemetry_processes
name: harfanglab-telemetry-processes
description: Search process telemetry.
risk: read
inputs_schema:
properties:
hash: { type: string, description: "File hash (md5, sha1 or sha256)" }
@@ -249,6 +267,7 @@ commands:
- id: telemetry_dns
name: harfanglab-telemetry-dns
description: Search DNS resolution telemetry.
risk: read
inputs_schema:
properties:
hostname: { type: string, description: "Endpoint hostname" }
@@ -262,6 +281,7 @@ commands:
- id: telemetry_network
name: harfanglab-telemetry-network
description: Search network connection telemetry.
risk: read
inputs_schema:
properties:
hostname: { type: string, description: "Endpoint hostname" }
@@ -277,6 +297,7 @@ commands:
- id: telemetry_eventlog
name: harfanglab-telemetry-eventlog
description: Search Windows full event log telemetry.
risk: read
inputs_schema:
properties:
hostname: { type: string, description: "Endpoint hostname" }
@@ -289,6 +310,7 @@ commands:
- id: telemetry_binary
name: harfanglab-telemetry-binary
description: Search binary telemetry.
risk: read
inputs_schema:
properties:
hash: { type: string, description: "File hash (md5, sha1 or sha256)" }
@@ -300,6 +322,7 @@ commands:
- id: telemetry_authentication_windows
name: harfanglab-telemetry-authentication-windows
description: Search Windows authentication telemetry.
risk: read
inputs_schema:
properties:
hostname: { type: string, description: "Endpoint hostname" }
@@ -317,6 +340,7 @@ commands:
- id: telemetry_authentication_linux
name: harfanglab-telemetry-authentication-linux
description: Search Linux authentication telemetry.
risk: read
inputs_schema:
properties:
hostname: { type: string, description: "Endpoint hostname" }
@@ -332,6 +356,7 @@ commands:
- id: telemetry_authentication_macos
name: harfanglab-telemetry-authentication-macos
description: Search macOS authentication telemetry.
risk: read
inputs_schema:
properties:
hostname: { type: string, description: "Endpoint hostname" }
@@ -347,6 +372,7 @@ commands:
- id: telemetry_authentication_users
name: harfanglab-telemetry-authentication-users
description: Rank users by authentication attempts across Windows, Linux and macOS.
risk: read
inputs_schema:
properties:
hostname: { type: string, description: "Endpoint hostname" }
@@ -360,6 +386,7 @@ commands:
- id: job_pipelist
name: harfanglab-job-pipelist
description: Start a job to list named pipes on a host (Windows).
risk: safe_write
inputs_schema:
properties:
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
@@ -368,6 +395,7 @@ commands:
- id: job_prefetchlist
name: harfanglab-job-prefetchlist
description: Start a job to collect Windows prefetch files on a host.
risk: safe_write
inputs_schema:
properties:
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
@@ -376,6 +404,7 @@ commands:
- id: job_runkeylist
name: harfanglab-job-runkeylist
description: Start a job to collect registry run keys (hives) on a host.
risk: safe_write
inputs_schema:
properties:
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
@@ -384,6 +413,7 @@ commands:
- id: job_scheduledtasklist
name: harfanglab-job-scheduledtasklist
description: Start a job to list scheduled tasks on a host.
risk: safe_write
inputs_schema:
properties:
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
@@ -392,6 +422,7 @@ commands:
- id: job_driverlist
name: harfanglab-job-driverlist
description: Start a job to list loaded drivers on a host.
risk: safe_write
inputs_schema:
properties:
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
@@ -400,6 +431,7 @@ commands:
- id: job_servicelist
name: harfanglab-job-servicelist
description: Start a job to collect services from registry hives on a host.
risk: safe_write
inputs_schema:
properties:
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
@@ -408,6 +440,7 @@ commands:
- id: job_processlist
name: harfanglab-job-processlist
description: Start a job to list running processes with signature info on a host.
risk: safe_write
inputs_schema:
properties:
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
@@ -416,6 +449,7 @@ commands:
- id: job_networkconnectionlist
name: harfanglab-job-networkconnectionlist
description: Start a job to list processes with their active network connections on a host.
risk: safe_write
inputs_schema:
properties:
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
@@ -424,6 +458,7 @@ commands:
- id: job_networksharelist
name: harfanglab-job-networksharelist
description: Start a job to list network shares on a host.
risk: safe_write
inputs_schema:
properties:
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
@@ -432,6 +467,7 @@ commands:
- id: job_sessionlist
name: harfanglab-job-sessionlist
description: Start a job to list active user sessions on a host.
risk: safe_write
inputs_schema:
properties:
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
@@ -440,6 +476,7 @@ commands:
- id: job_persistencelist
name: harfanglab-job-persistencelist
description: Start a job to scan for persistence mechanisms on a host.
risk: safe_write
inputs_schema:
properties:
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
@@ -448,6 +485,7 @@ commands:
- id: job_startuplist
name: harfanglab-job-startuplist
description: Start a job to list startup files on a host.
risk: safe_write
inputs_schema:
properties:
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
@@ -456,6 +494,7 @@ commands:
- id: job_wmilist
name: harfanglab-job-wmilist
description: Start a job to collect WMI persistence artifacts on a host.
risk: safe_write
inputs_schema:
properties:
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
@@ -464,6 +503,7 @@ commands:
- id: job_ioc
name: harfanglab-job-ioc
description: Start an IOC scan job on a host using filename, filepath, hash, registry, or regex indicators.
risk: safe_write
inputs_schema:
properties:
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
@@ -480,6 +520,7 @@ commands:
- id: job_info
name: harfanglab-job-info
description: Retrieve information for one or more jobs by their identifiers.
risk: read
inputs_schema:
properties:
ids: { type: string, description: "Comma-separated list of job IDs to retrieve" }
@@ -490,6 +531,7 @@ commands:
- id: job_artifact_mft
name: harfanglab-job-artifact-mft
description: Start a job to collect the NTFS Master File Table (MFT) from a host (Windows).
risk: safe_write
inputs_schema:
properties:
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
@@ -498,6 +540,7 @@ commands:
- id: job_artifact_hives
name: harfanglab-job-artifact-hives
description: Start a job to collect the Windows registry hives from a host.
risk: safe_write
inputs_schema:
properties:
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
@@ -506,6 +549,7 @@ commands:
- id: job_artifact_evtx
name: harfanglab-job-artifact-evtx
description: Start a job to collect the Windows event logs (EVTX) from a host.
risk: safe_write
inputs_schema:
properties:
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
@@ -514,6 +558,7 @@ commands:
- id: job_artifact_logs
name: harfanglab-job-artifact-logs
description: Start a job to collect the system logs from a host.
risk: safe_write
inputs_schema:
properties:
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
@@ -522,6 +567,7 @@ commands:
- id: job_artifact_filesystem
name: harfanglab-job-artifact-filesystem
description: Start a job to collect the filesystem listing from a host.
risk: safe_write
inputs_schema:
properties:
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
@@ -530,6 +576,7 @@ commands:
- id: job_artifact_all
name: harfanglab-job-artifact-all
description: Start a job to collect all raw forensic evidence (hives, event logs, MFT, prefetch, USN journal, logs, filesystem) from a host.
risk: safe_write
inputs_schema:
properties:
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
@@ -538,6 +585,7 @@ commands:
- id: job_artifact_ramdump
name: harfanglab-job-artifact-ramdump
description: Start a job to capture a full memory (RAM) dump from a host.
risk: safe_write
inputs_schema:
properties:
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
@@ -546,6 +594,7 @@ commands:
- id: job_artifact_downloadfile
name: harfanglab-job-artifact-downloadfile
description: Start a job to download a specific file from a host by its full path.
risk: safe_write
inputs_schema:
properties:
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
@@ -557,6 +606,7 @@ commands:
- id: result_pipelist
name: harfanglab-result-pipelist
description: Get a host's list of named pipes from a job result.
risk: read
inputs_schema:
properties:
job_id: { type: string, description: "Job ID returned by the matching job command" }
@@ -565,6 +615,7 @@ commands:
- id: result_prefetchlist
name: harfanglab-result-prefetchlist
description: Get a host's prefetch entries from a job result.
risk: read
inputs_schema:
properties:
job_id: { type: string, description: "Job ID returned by the matching job command" }
@@ -573,6 +624,7 @@ commands:
- id: result_runkeylist
name: harfanglab-result-runkeylist
description: Get a host's registry run keys from a job result.
risk: read
inputs_schema:
properties:
job_id: { type: string, description: "Job ID returned by the matching job command" }
@@ -581,6 +633,7 @@ commands:
- id: result_scheduledtasklist
name: harfanglab-result-scheduledtasklist
description: Get a host's scheduled tasks from a job result.
risk: read
inputs_schema:
properties:
job_id: { type: string, description: "Job ID returned by the matching job command" }
@@ -589,6 +642,7 @@ commands:
- id: result_driverlist
name: harfanglab-result-driverlist
description: Get a host's list of drivers from a job result.
risk: read
inputs_schema:
properties:
job_id: { type: string, description: "Job ID returned by the matching job command" }
@@ -597,6 +651,7 @@ commands:
- id: result_servicelist
name: harfanglab-result-servicelist
description: Get a host's list of services from a job result.
risk: read
inputs_schema:
properties:
job_id: { type: string, description: "Job ID returned by the matching job command" }
@@ -605,6 +660,7 @@ commands:
- id: result_processlist
name: harfanglab-result-processlist
description: Get a host's list of running processes from a job result.
risk: read
inputs_schema:
properties:
job_id: { type: string, description: "Job ID returned by the matching job command" }
@@ -613,6 +669,7 @@ commands:
- id: result_networkconnectionlist
name: harfanglab-result-networkconnectionlist
description: Get a host's network connections from a job result.
risk: read
inputs_schema:
properties:
job_id: { type: string, description: "Job ID returned by the matching job command" }
@@ -621,6 +678,7 @@ commands:
- id: result_networksharelist
name: harfanglab-result-networksharelist
description: Get a host's list of network shares from a job result.
risk: read
inputs_schema:
properties:
job_id: { type: string, description: "Job ID returned by the matching job command" }
@@ -629,6 +687,7 @@ commands:
- id: result_sessionlist
name: harfanglab-result-sessionlist
description: Get a host's list of user sessions from a job result.
risk: read
inputs_schema:
properties:
job_id: { type: string, description: "Job ID returned by the matching job command" }
@@ -637,6 +696,7 @@ commands:
- id: result_persistencelist
name: harfanglab-result-persistencelist
description: Get a host's persistence files from a job result.
risk: read
inputs_schema:
properties:
job_id: { type: string, description: "Job ID returned by the matching job command" }
@@ -645,6 +705,7 @@ commands:
- id: result_startuplist
name: harfanglab-result-startuplist
description: Get a host's startup items from a job result.
risk: read
inputs_schema:
properties:
job_id: { type: string, description: "Job ID returned by the matching job command" }
@@ -653,6 +714,7 @@ commands:
- id: result_wmilist
name: harfanglab-result-wmilist
description: Get a host's WMI persistence entries from a job result.
risk: read
inputs_schema:
properties:
job_id: { type: string, description: "Job ID returned by the matching job command" }
@@ -661,6 +723,7 @@ commands:
- id: result_ioc
name: harfanglab-result-ioc
description: Get a host's IOC matches from a job result.
risk: read
inputs_schema:
properties:
job_id: { type: string, description: "Job ID returned by the matching job command" }
@@ -671,6 +734,7 @@ commands:
- id: result_artifact_mft
name: harfanglab-result-artifact-mft
description: Get the MFT download links from a collection job result.
risk: read
inputs_schema:
properties:
job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
@@ -679,6 +743,7 @@ commands:
- id: result_artifact_hives
name: harfanglab-result-artifact-hives
description: Get the Windows registry hive download links from a collection job result.
risk: read
inputs_schema:
properties:
job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
@@ -687,6 +752,7 @@ commands:
- id: result_artifact_evtx
name: harfanglab-result-artifact-evtx
description: Get the Windows event log (EVTX) download links from a collection job result.
risk: read
inputs_schema:
properties:
job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
@@ -695,6 +761,7 @@ commands:
- id: result_artifact_logs
name: harfanglab-result-artifact-logs
description: Get the Linux system log download links from a collection job result.
risk: read
inputs_schema:
properties:
job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
@@ -703,6 +770,7 @@ commands:
- id: result_artifact_filesystem
name: harfanglab-result-artifact-filesystem
description: Get the filesystem listing download links from a collection job result.
risk: read
inputs_schema:
properties:
job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
@@ -711,6 +779,7 @@ commands:
- id: result_artifact_all
name: harfanglab-result-artifact-all
description: Get the download links for all collected artifacts from a collection job result.
risk: read
inputs_schema:
properties:
job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
@@ -719,6 +788,7 @@ commands:
- id: result_artifact_downloadfile
name: harfanglab-result-artifact-downloadfile
description: Get the download link for a file retrieved by a download-file job result.
risk: read
inputs_schema:
properties:
job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
@@ -727,6 +797,7 @@ commands:
- id: result_artifact_ramdump
name: harfanglab-result-artifact-ramdump
description: Get the memory (RAM) dump download links from a collection job result.
risk: read
inputs_schema:
properties:
job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
@@ -829,7 +900,7 @@ commands:
- id: unquarantine_file
name: harfanglab-unquarantine-file
description: "Restore a quarantined file to its original location on the endpoint. Returns the created job."
risk: safe_write
risk: destructive
inputs_schema:
properties:
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
@@ -873,7 +944,7 @@ commands:
- id: deisolate_from_threat
name: harfanglab-deisolate-from-threat
description: "Remove network isolation from all agents involved in a threat."
risk: safe_write
risk: destructive
inputs_schema:
properties:
threat_id: { type: string, description: "Threat identifier" }