f3nris/riposte-marketplace
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(marketplace): prefix official command names with the technology

Browse Source 
Rename every command 'name' in the official integrations to a
<technology>-<command> slug (e.g. sentinelone-isolate-agent,
harfanglab-isolate-endpoint) so they group together when searching the
toolbox. Command IDs (and thus script files and action refs) are unchanged.
Bump both integrations to 1.1.0.
This commit is contained in:
Guillaume BOURGEOIS
2026-06-22 14:41:22 +02:00
parent 6b65c5f9df
commit e3e363c2f9
2 changed files with 145 additions and 145 deletions
Download Patch File Download Diff File Expand all files Collapse all files
integrations/harfanglab/manifest.yaml
+73 -73
View File
@@ -1,8 +1,8 @@
id: harfanglab
name: HarfangLab EDR
version: 1.0.0
version: 1.1.0
description: "HarfangLab EDR — endpoint detection & response: endpoint enrichment, isolation, threat-intelligence (IOC/whitelist), telemetry hunting and forensic collection jobs."
changelog: "1.0.0 — Initial release: endpoint/agent management, isolation, policy assignment, IOC & whitelist management, security-event triage, telemetry hunting (processes, network, DNS, authentications, binaries, event logs), threat hunting by hash, and forensic collection jobs (pipes, prefetch, run keys, scheduled tasks, drivers, services, processes, network, sessions, WMI, IOC scan, artifacts, RAM dump) with their result retrieval commands. Compatible with HarfangLab EDR 2.13.7+."
changelog: "1.1.0 — Command names prefixed with 'harfanglab-' (e.g. harfanglab-isolate-endpoint) for easier toolbox search; command IDs unchanged. 1.0.0 — Initial release: endpoint/agent management, isolation, policy assignment, IOC & whitelist management, security-event triage, telemetry hunting (processes, network, DNS, authentications, binaries, event logs), threat hunting by hash, and forensic collection jobs (pipes, prefetch, run keys, scheduled tasks, drivers, services, processes, network, sessions, WMI, IOC scan, artifacts, RAM dump) with their result retrieval commands. Compatible with HarfangLab EDR 2.13.7+."
category: endpoint
# Per-instance configuration. Scripts use <url> as the API base and call /api/... paths.
@@ -32,7 +32,7 @@ auth:
commands:
# ── Endpoints / agents ────────────────────────────────────────────────────
- id: get_endpoint_info
name: Get endpoint info
name: harfanglab-get-endpoint-info
description: Get endpoint (agent) information by agent ID.
inputs_schema:
properties:
@@ -40,7 +40,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: endpoint_search
name: Endpoint search
name: harfanglab-endpoint-search
description: Search endpoints (agents) by hostname.
inputs_schema:
properties:
@@ -48,7 +48,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: isolate_endpoint
name: Isolate endpoint
name: harfanglab-isolate-endpoint
description: Network-isolate an endpoint (agent) by agent ID.
inputs_schema:
properties:
@@ -56,7 +56,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: deisolate_endpoint
name: Deisolate endpoint
name: harfanglab-deisolate-endpoint
description: Remove network isolation from an endpoint (agent) by agent ID.
inputs_schema:
properties:
@@ -64,7 +64,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: assign_policy_to_agent
name: Assign policy to agent
name: harfanglab-assign-policy-to-agent
description: Assign a security policy to an agent by policy name and agent ID.
inputs_schema:
properties:
@@ -75,7 +75,7 @@ commands:
# ── Threat intelligence: whitelists ───────────────────────────────────────
- id: whitelist_search
name: Search whitelists
name: harfanglab-whitelist-search
description: Search threat-intelligence whitelists by keyword.
inputs_schema:
properties:
@@ -84,7 +84,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: whitelist_add
name: Add whitelist
name: harfanglab-whitelist-add
description: Create a threat-intelligence whitelist rule with an initial criterion.
inputs_schema:
properties:
@@ -98,7 +98,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: whitelist_add_criterion
name: Add whitelist criterion
name: harfanglab-whitelist-add-criterion
description: Append a criterion to an existing whitelist rule.
inputs_schema:
properties:
@@ -110,7 +110,7 @@ commands:
required: [id]
outputs_schema: { properties: {} }
- id: whitelist_delete
name: Delete whitelist
name: harfanglab-whitelist-delete
description: Delete a threat-intelligence whitelist rule by id.
inputs_schema:
properties:
@@ -120,7 +120,7 @@ commands:
# ── Threat intelligence: IOCs ─────────────────────────────────────────────
- id: add_ioc_to_source
name: Add IOC to source
name: harfanglab-add-ioc-to-source
description: Add an IOC to a named IOC source if it does not already exist.
inputs_schema:
properties:
@@ -132,7 +132,7 @@ commands:
required: [ioc_value, ioc_type, ioc_status, source_name]
outputs_schema: { properties: {} }
- id: delete_ioc_from_source
name: Delete IOC from source
name: harfanglab-delete-ioc-from-source
description: Remove an IOC from a named IOC source if it exists.
inputs_schema:
properties:
@@ -143,7 +143,7 @@ commands:
# ── Security events ───────────────────────────────────────────────────────
- id: change_security_event_status
name: Change security event status
name: harfanglab-change-security-event-status
description: "Change the status of a security event (New, Investigating, False Positive, Closed)."
inputs_schema:
properties:
@@ -154,7 +154,7 @@ commands:
# ── Generic / utility ─────────────────────────────────────────────────────
- id: api_call
name: API call
name: harfanglab-api-call
description: "Perform a generic authenticated call to the HarfangLab API."
inputs_schema:
properties:
@@ -165,7 +165,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: telemetry_process_graph
name: Telemetry process graph
name: harfanglab-telemetry-process-graph
description: "Retrieve the process graph for a telemetry process UUID."
inputs_schema:
properties:
@@ -175,7 +175,7 @@ commands:
# ── Threat hunting by hash ────────────────────────────────────────────────
- id: hunt_search_hash
name: Hunt search hash
name: harfanglab-hunt-search-hash
description: "Search the data explorer for a file hash."
inputs_schema:
properties:
@@ -183,7 +183,7 @@ commands:
required: [hash]
outputs_schema: { properties: {} }
- id: hunt_search_running_process_hash
name: Hunt search running process by hash
name: harfanglab-hunt-search-running-process-hash
description: "Hunt for currently running processes matching a SHA-256 hash."
inputs_schema:
properties:
@@ -191,7 +191,7 @@ commands:
required: [hash]
outputs_schema: { properties: {} }
- id: hunt_search_runned_process_hash
name: Hunt search runned process by hash
name: harfanglab-hunt-search-runned-process-hash
description: "Search process telemetry for executions matching a SHA-256 hash."
inputs_schema:
properties:
@@ -201,7 +201,7 @@ commands:
# ── Telemetry ─────────────────────────────────────────────────────────────
- id: telemetry_processes
name: Telemetry — processes
name: harfanglab-telemetry-processes
description: Search process telemetry.
inputs_schema:
properties:
@@ -213,7 +213,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: telemetry_dns
name: Telemetry — DNS resolution
name: harfanglab-telemetry-dns
description: Search DNS resolution telemetry.
inputs_schema:
properties:
@@ -226,7 +226,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: telemetry_network
name: Telemetry — network
name: harfanglab-telemetry-network
description: Search network connection telemetry.
inputs_schema:
properties:
@@ -241,7 +241,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: telemetry_eventlog
name: Telemetry — event log
name: harfanglab-telemetry-eventlog
description: Search Windows full event log telemetry.
inputs_schema:
properties:
@@ -253,7 +253,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: telemetry_binary
name: Telemetry — binary
name: harfanglab-telemetry-binary
description: Search binary telemetry.
inputs_schema:
properties:
@@ -264,7 +264,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: telemetry_authentication_windows
name: Telemetry — Windows authentication
name: harfanglab-telemetry-authentication-windows
description: Search Windows authentication telemetry.
inputs_schema:
properties:
@@ -281,7 +281,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: telemetry_authentication_linux
name: Telemetry — Linux authentication
name: harfanglab-telemetry-authentication-linux
description: Search Linux authentication telemetry.
inputs_schema:
properties:
@@ -296,7 +296,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: telemetry_authentication_macos
name: Telemetry — macOS authentication
name: harfanglab-telemetry-authentication-macos
description: Search macOS authentication telemetry.
inputs_schema:
properties:
@@ -311,7 +311,7 @@ commands:
required: []
outputs_schema: { properties: {} }
- id: telemetry_authentication_users
name: Telemetry — top authenticating users
name: harfanglab-telemetry-authentication-users
description: Rank users by authentication attempts across Windows, Linux and macOS.
inputs_schema:
properties:
@@ -324,7 +324,7 @@ commands:
# ── Collection jobs ───────────────────────────────────────────────────────
- id: job_pipelist
name: Job — list pipes
name: harfanglab-job-pipelist
description: Start a job to list named pipes on a host (Windows).
inputs_schema:
properties:
@@ -332,7 +332,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_prefetchlist
name: Job — list prefetch
name: harfanglab-job-prefetchlist
description: Start a job to collect Windows prefetch files on a host.
inputs_schema:
properties:
@@ -340,7 +340,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_runkeylist
name: Job — list run keys
name: harfanglab-job-runkeylist
description: Start a job to collect registry run keys (hives) on a host.
inputs_schema:
properties:
@@ -348,7 +348,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_scheduledtasklist
name: Job — list scheduled tasks
name: harfanglab-job-scheduledtasklist
description: Start a job to list scheduled tasks on a host.
inputs_schema:
properties:
@@ -356,7 +356,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_driverlist
name: Job — list drivers
name: harfanglab-job-driverlist
description: Start a job to list loaded drivers on a host.
inputs_schema:
properties:
@@ -364,7 +364,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_servicelist
name: Job — list services
name: harfanglab-job-servicelist
description: Start a job to collect services from registry hives on a host.
inputs_schema:
properties:
@@ -372,7 +372,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_processlist
name: Job — list processes
name: harfanglab-job-processlist
description: Start a job to list running processes with signature info on a host.
inputs_schema:
properties:
@@ -380,7 +380,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_networkconnectionlist
name: Job — list network connections
name: harfanglab-job-networkconnectionlist
description: Start a job to list processes with their active network connections on a host.
inputs_schema:
properties:
@@ -388,7 +388,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_networksharelist
name: Job — list network shares
name: harfanglab-job-networksharelist
description: Start a job to list network shares on a host.
inputs_schema:
properties:
@@ -396,7 +396,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_sessionlist
name: Job — list sessions
name: harfanglab-job-sessionlist
description: Start a job to list active user sessions on a host.
inputs_schema:
properties:
@@ -404,7 +404,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_persistencelist
name: Job — list persistence
name: harfanglab-job-persistencelist
description: Start a job to scan for persistence mechanisms on a host.
inputs_schema:
properties:
@@ -412,7 +412,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_startuplist
name: Job — list startup files
name: harfanglab-job-startuplist
description: Start a job to list startup files on a host.
inputs_schema:
properties:
@@ -420,7 +420,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_wmilist
name: Job — list WMI
name: harfanglab-job-wmilist
description: Start a job to collect WMI persistence artifacts on a host.
inputs_schema:
properties:
@@ -428,7 +428,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_ioc
name: Job — IOC scan
name: harfanglab-job-ioc
description: Start an IOC scan job on a host using filename, filepath, hash, registry, or regex indicators.
inputs_schema:
properties:
@@ -444,7 +444,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_info
name: Job — get job info
name: harfanglab-job-info
description: Retrieve information for one or more jobs by their identifiers.
inputs_schema:
properties:
@@ -454,7 +454,7 @@ commands:
# ── Forensic artifact collection jobs ─────────────────────────────────────
- id: job_artifact_mft
name: Job — collect MFT
name: harfanglab-job-artifact-mft
description: Start a job to collect the NTFS Master File Table (MFT) from a host (Windows).
inputs_schema:
properties:
@@ -462,7 +462,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_artifact_hives
name: Job — collect registry hives
name: harfanglab-job-artifact-hives
description: Start a job to collect the Windows registry hives from a host.
inputs_schema:
properties:
@@ -470,7 +470,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_artifact_evtx
name: Job — collect event logs
name: harfanglab-job-artifact-evtx
description: Start a job to collect the Windows event logs (EVTX) from a host.
inputs_schema:
properties:
@@ -478,7 +478,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_artifact_logs
name: Job — collect system logs
name: harfanglab-job-artifact-logs
description: Start a job to collect the system logs from a host.
inputs_schema:
properties:
@@ -486,7 +486,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_artifact_filesystem
name: Job — collect filesystem listing
name: harfanglab-job-artifact-filesystem
description: Start a job to collect the filesystem listing from a host.
inputs_schema:
properties:
@@ -494,7 +494,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_artifact_all
name: Job — collect all raw evidence
name: harfanglab-job-artifact-all
description: Start a job to collect all raw forensic evidence (hives, event logs, MFT, prefetch, USN journal, logs, filesystem) from a host.
inputs_schema:
properties:
@@ -502,7 +502,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_artifact_ramdump
name: Job — dump RAM
name: harfanglab-job-artifact-ramdump
description: Start a job to capture a full memory (RAM) dump from a host.
inputs_schema:
properties:
@@ -510,7 +510,7 @@ commands:
required: [agent_id]
outputs_schema: { properties: {} }
- id: job_artifact_downloadfile
name: Job — download file
name: harfanglab-job-artifact-downloadfile
description: Start a job to download a specific file from a host by its full path.
inputs_schema:
properties:
@@ -521,7 +521,7 @@ commands:
# ── Job results (hunting) ─────────────────────────────────────────────────
- id: result_pipelist
name: Result — pipes
name: harfanglab-result-pipelist
description: Get a host's list of named pipes from a job result.
inputs_schema:
properties:
@@ -529,7 +529,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_prefetchlist
name: Result — prefetch
name: harfanglab-result-prefetchlist
description: Get a host's prefetch entries from a job result.
inputs_schema:
properties:
@@ -537,7 +537,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_runkeylist
name: Result — run keys
name: harfanglab-result-runkeylist
description: Get a host's registry run keys from a job result.
inputs_schema:
properties:
@@ -545,7 +545,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_scheduledtasklist
name: Result — scheduled tasks
name: harfanglab-result-scheduledtasklist
description: Get a host's scheduled tasks from a job result.
inputs_schema:
properties:
@@ -553,7 +553,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_driverlist
name: Result — drivers
name: harfanglab-result-driverlist
description: Get a host's list of drivers from a job result.
inputs_schema:
properties:
@@ -561,7 +561,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_servicelist
name: Result — services
name: harfanglab-result-servicelist
description: Get a host's list of services from a job result.
inputs_schema:
properties:
@@ -569,7 +569,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_processlist
name: Result — processes
name: harfanglab-result-processlist
description: Get a host's list of running processes from a job result.
inputs_schema:
properties:
@@ -577,7 +577,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_networkconnectionlist
name: Result — network connections
name: harfanglab-result-networkconnectionlist
description: Get a host's network connections from a job result.
inputs_schema:
properties:
@@ -585,7 +585,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_networksharelist
name: Result — network shares
name: harfanglab-result-networksharelist
description: Get a host's list of network shares from a job result.
inputs_schema:
properties:
@@ -593,7 +593,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_sessionlist
name: Result — sessions
name: harfanglab-result-sessionlist
description: Get a host's list of user sessions from a job result.
inputs_schema:
properties:
@@ -601,7 +601,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_persistencelist
name: Result — persistence
name: harfanglab-result-persistencelist
description: Get a host's persistence files from a job result.
inputs_schema:
properties:
@@ -609,7 +609,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_startuplist
name: Result — startup items
name: harfanglab-result-startuplist
description: Get a host's startup items from a job result.
inputs_schema:
properties:
@@ -617,7 +617,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_wmilist
name: Result — WMI
name: harfanglab-result-wmilist
description: Get a host's WMI persistence entries from a job result.
inputs_schema:
properties:
@@ -625,7 +625,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_ioc
name: Result — IOC matches
name: harfanglab-result-ioc
description: Get a host's IOC matches from a job result.
inputs_schema:
properties:
@@ -635,7 +635,7 @@ commands:
# ── Job results (forensic artifacts) ──────────────────────────────────────
- id: result_artifact_mft
name: Result — MFT artifact
name: harfanglab-result-artifact-mft
description: Get the MFT download links from a collection job result.
inputs_schema:
properties:
@@ -643,7 +643,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_artifact_hives
name: Result — Registry hives artifact
name: harfanglab-result-artifact-hives
description: Get the Windows registry hive download links from a collection job result.
inputs_schema:
properties:
@@ -651,7 +651,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_artifact_evtx
name: Result — EVTX artifact
name: harfanglab-result-artifact-evtx
description: Get the Windows event log (EVTX) download links from a collection job result.
inputs_schema:
properties:
@@ -659,7 +659,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_artifact_logs
name: Result — Linux logs artifact
name: harfanglab-result-artifact-logs
description: Get the Linux system log download links from a collection job result.
inputs_schema:
properties:
@@ -667,7 +667,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_artifact_filesystem
name: Result — Filesystem artifact
name: harfanglab-result-artifact-filesystem
description: Get the filesystem listing download links from a collection job result.
inputs_schema:
properties:
@@ -675,7 +675,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_artifact_all
name: Result — All artifacts
name: harfanglab-result-artifact-all
description: Get the download links for all collected artifacts from a collection job result.
inputs_schema:
properties:
@@ -683,7 +683,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_artifact_downloadfile
name: Result — Downloaded file artifact
name: harfanglab-result-artifact-downloadfile
description: Get the download link for a file retrieved by a download-file job result.
inputs_schema:
properties:
@@ -691,7 +691,7 @@ commands:
required: [job_id]
outputs_schema: { properties: {} }
- id: result_artifact_ramdump
name: Result — RAM dump artifact
name: harfanglab-result-artifact-ramdump
description: Get the memory (RAM) dump download links from a collection job result.
inputs_schema:
properties: