fix(harfanglab): rework get_threats OCSF mapper from live threat sample
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
@@ -2,7 +2,7 @@ id: harfanglab
|
||||
name: HarfangLab EDR
|
||||
version: 1.3.0
|
||||
description: "HarfangLab EDR — endpoint detection & response: alert/threat ingestion, endpoint enrichment, isolation, threat-intelligence (IOC/whitelist), telemetry hunting and forensic collection jobs."
|
||||
changelog: "1.3.0 — Response & triage expansion: kill/dump process, on-demand AV/YARA scans, file/service/scheduled-task deletion, quarantine management, threat-level isolation, job cancel/relaunch/wait; alert search (get_alerts) and full alert/threat triage (tag, comments, notes, status, level, history, details); exhaustive alert OCSF mappers. 1.2.2 — Documentation wording cleanup. 1.2.1 — Corrected the get_threats OCSF mapper to native threat fields (top_agents/top_impacted_users/top_rules/mitre_tactics) instead of enriched-only arrays; added agent.osversion to get_security_events. 1.2.0 — Added ingestion commands get_security_events (alerts) and get_threats with bundled OCSF mappers and ingest hints (results_path/dedup/incremental). 1.1.1 — Added test_connection for the instance Test button. 1.1.0 — Command names prefixed with 'harfanglab-' (e.g. harfanglab-isolate-endpoint) for easier toolbox search; command IDs unchanged. 1.0.0 — Initial release: endpoint/agent management, isolation, policy assignment, IOC & whitelist management, security-event triage, telemetry hunting (processes, network, DNS, authentications, binaries, event logs), threat hunting by hash, and forensic collection jobs (pipes, prefetch, run keys, scheduled tasks, drivers, services, processes, network, sessions, WMI, IOC scan, artifacts, RAM dump) with their result retrieval commands. Compatible with HarfangLab EDR 2.13.7+."
|
||||
changelog: "1.3.0 — Response & triage expansion: kill/dump process, on-demand AV/YARA scans, file/service/scheduled-task deletion, quarantine management, threat-level isolation, job cancel/relaunch/wait; alert search (get_alerts) and full alert/threat triage (tag, comments, notes, status, level, history, details); exhaustive alert OCSF mappers; reworked get_threats mapper (fixed MITRE tactics map handling, full top-agent/user/rule and counts coverage, rule-based incident title/description). 1.2.2 — Documentation wording cleanup. 1.2.1 — Corrected the get_threats OCSF mapper to native threat fields (top_agents/top_impacted_users/top_rules/mitre_tactics) instead of enriched-only arrays; added agent.osversion to get_security_events. 1.2.0 — Added ingestion commands get_security_events (alerts) and get_threats with bundled OCSF mappers and ingest hints (results_path/dedup/incremental). 1.1.1 — Added test_connection for the instance Test button. 1.1.0 — Command names prefixed with 'harfanglab-' (e.g. harfanglab-isolate-endpoint) for easier toolbox search; command IDs unchanged. 1.0.0 — Initial release: endpoint/agent management, isolation, policy assignment, IOC & whitelist management, security-event triage, telemetry hunting (processes, network, DNS, authentications, binaries, event logs), threat hunting by hash, and forensic collection jobs (pipes, prefetch, run keys, scheduled tasks, drivers, services, processes, network, sessions, WMI, IOC scan, artifacts, RAM dump) with their result retrieval commands. Compatible with HarfangLab EDR 2.13.7+."
|
||||
category: endpoint
|
||||
|
||||
# Per-instance configuration. Scripts use <url> as the API base and call /api/... paths.
|
||||
|
||||
@@ -1,9 +1,9 @@
|
||||
name: "HarfangLab Threats → OCSF"
|
||||
description: "Maps a raw HarfangLab EDR threat (/api/data/alert/alert/Threat/, results_path = results) to OCSF. Uses native threat fields (top_agents/top_impacted_users/top_rules/mitre_tactics); the agents/impacted_users/rules arrays are only populated by external enrichment, which this connector does not perform."
|
||||
description: "Maps a raw HarfangLab EDR threat (/api/data/alert/alert/Threat/, results_path = results) to OCSF. Uses native threat fields; top_agents/top_impacted_users/top_rules are ranked aggregates — the first (most impacted) entry feeds the endpoint/user/rule fields. mitre_tactics is a map keyed by tactic slug (e.g. attack.persistence); its keys are extracted with $keys()."
|
||||
field_mappings:
|
||||
title: "slug"
|
||||
title: "top_rules[0].rule_name ? top_rules[0].rule_name & ' — ' & slug : slug"
|
||||
severity: "level = 'critical' ? 5 : (level = 'high' ? 4 : (level = 'medium' ? 3 : 2))"
|
||||
description: "status"
|
||||
description: "top_rules[0].rule_msg ? top_rules[0].rule_msg : status"
|
||||
# results_path = results; source_path is JSONata over ONE threat object.
|
||||
# Paths absent from a given threat are skipped at ingestion, so extra entries are safe.
|
||||
ocsf:
|
||||
@@ -13,11 +13,32 @@ ocsf:
|
||||
- { source_path: "creation_date", ocsf_field: "finding_info.created_time" }
|
||||
- { source_path: "first_seen", ocsf_field: "finding_info.first_seen_time" }
|
||||
- { source_path: "last_seen", ocsf_field: "finding_info.last_seen_time" }
|
||||
- { source_path: "last_update", ocsf_field: "finding_info.modified_time" }
|
||||
- { source_path: "closed_date", ocsf_field: "end_time" }
|
||||
- { source_path: "status", ocsf_field: "status" }
|
||||
# ── MITRE ATT&CK (native mitre_tactics list) ──────────────────────
|
||||
- { source_path: "mitre_tactics[0]", ocsf_field: "attacks.tactic.name" }
|
||||
# ── Top impacted endpoint / user / rule (native aggregates) ───────
|
||||
- { source_path: "top_agents[0].agent_hostname", ocsf_field: "src_endpoint.hostname" }
|
||||
- { source_path: "linked_threat", ocsf_field: "finding_info.uid_alt" }
|
||||
- { source_path: "tenant", ocsf_field: "metadata.tenant_uid" }
|
||||
# ── Aggregate counts ──────────────────────────────────────────────
|
||||
- { source_path: "total_security_event_count", ocsf_field: "finding_info.related_events_count" }
|
||||
- { source_path: "agent_count", ocsf_field: "unmapped.agent_count" }
|
||||
- { source_path: "impacted_user_count", ocsf_field: "unmapped.impacted_user_count" }
|
||||
- { source_path: "rule_count", ocsf_field: "unmapped.rule_count" }
|
||||
# ── MITRE ATT&CK — mitre_tactics is a MAP {"attack.persistence": {...}} ──
|
||||
- { source_path: "$keys(mitre_tactics)", ocsf_field: "attacks" }
|
||||
# ── Top impacted endpoint (most security events first) ────────────
|
||||
- { source_path: "top_agents[0].agent_hostname", ocsf_field: "src_endpoint.hostname" }
|
||||
- { source_path: "top_agents[0].agent_id", ocsf_field: "device.uid" }
|
||||
- { source_path: "top_agents[0].agent_osproducttype", ocsf_field: "src_endpoint.os.name" }
|
||||
- { source_path: "top_agents[0].agent_ostype", ocsf_field: "src_endpoint.os.type" }
|
||||
- { source_path: "top_agents[0].agent_osversion", ocsf_field: "device.os.version" }
|
||||
# ── Top impacted user ─────────────────────────────────────────────
|
||||
- { source_path: "top_impacted_users[0].user_name", ocsf_field: "user.name" }
|
||||
- { source_path: "top_rules[0].rule_name", ocsf_field: "rule.name" }
|
||||
- { source_path: "top_impacted_users[0].user_sid", ocsf_field: "user.uid" }
|
||||
# ── Top rule ──────────────────────────────────────────────────────
|
||||
- { source_path: "top_rules[0].rule_name", ocsf_field: "rule.name" }
|
||||
- { source_path: "top_rules[0].rule_id", ocsf_field: "rule.uid" }
|
||||
- { source_path: "top_rules[0].rule_type", ocsf_field: "finding_info.analytic.type" }
|
||||
- { source_path: "top_rules[0].rule_msg", ocsf_field: "finding_info.desc" }
|
||||
# Deliberately unmapped: old_id/origin_stack (legacy/console internals), agent_status,
|
||||
# per-item security_event_count, rule_os/rule_level/rule creation dates (no OCSF home),
|
||||
# top_rules[0].description (duplicate of rule_msg), and entries [1..] of the top_* arrays
|
||||
# (OCSF detection_finding models a single primary endpoint/user/rule; counts convey scale).
|
||||
|
||||
Reference in New Issue
Block a user