f3nris
144089a099
fix(harfanglab): flag get_alerts as ingestion-ready (v1.3.1)
...
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
2026-07-21 23:19:58 +02:00
f3nris
a4b5b44157
fix(harfanglab): null guards and stable attacks array in get_threats mapper
...
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
2026-07-21 22:52:11 +02:00
f3nris
4ea3af6c1d
fix(harfanglab): rework get_threats OCSF mapper from live threat sample
...
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
2026-07-21 22:49:31 +02:00
f3nris
952dc7efda
feat(harfanglab): v1.3.0 — response & triage expansion (27 commands + alert mappers)
...
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
2026-07-21 22:33:59 +02:00
f3nris
cba746a9f9
feat(harfanglab): exhaustive alert OCSF mappers (get_alerts + upgraded get_security_events)
...
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
2026-07-21 22:26:19 +02:00
f3nris
5d6f823189
feat(harfanglab): threat triage commands (status, level, comment, note, history)
...
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
2026-07-21 22:20:54 +02:00
f3nris
098b90d6f3
feat(harfanglab): alert triage commands (tag, comment, details, history)
...
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
2026-07-21 22:18:01 +02:00
f3nris
db902c35bc
feat(harfanglab): alert search and single-threat read commands
...
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
2026-07-21 22:14:25 +02:00
f3nris
59e9211c0d
feat(harfanglab): threat-level isolation and job lifecycle commands
...
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
2026-07-21 22:09:56 +02:00
f3nris
fcbd2ff135
feat(harfanglab): quarantine management commands
...
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
2026-07-21 22:04:47 +02:00
f3nris
ef60cec0fa
feat(harfanglab): file/service/scheduled-task deletion commands
...
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
2026-07-21 22:01:22 +02:00
f3nris
6d993f584f
feat(harfanglab): on-demand AV and YARA scan commands
...
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
2026-07-21 21:57:37 +02:00
f3nris
6d311740f9
feat(harfanglab): kill/dump process response commands
...
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
2026-07-21 21:52:39 +02:00
6bccbb5a50
feat(integrations): declare default ingestion (command, mapper, default type)
...
cortex-xdr, crowdstrike, harfanglab and splunk now ship an `ingestion` block
(fetch command + bundled mapper + default incident type) and a bundled default
incident type under incident-types/, so the instance Collect section is pre-filled
on first configuration and the default type is created on install.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-27 10:38:09 +02:00
f3b0f269b8
docs: remove vendor-tool wording from mapper descriptions and changelogs
...
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-26 15:32:30 +02:00
0f4852bb54
fix(harfanglab): correct get_threats mapper to native threat fields; add agent.osversion
...
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-26 14:53:16 +02:00
2c4d40103e
feat(harfanglab): add get_security_events + get_threats ingestion commands, OCSF mappers and ingest hints
...
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-26 14:15:57 +02:00
5251441962
feat: add test_connection command to all integrations for the instance Test button
...
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-26 00:00:06 +02:00
f3nris
e3e363c2f9
feat(marketplace): prefix official command names with the technology
...
Rename every command 'name' in the official integrations to a
<technology>-<command> slug (e.g. sentinelone-isolate-agent,
harfanglab-isolate-endpoint) so they group together when searching the
toolbox. Command IDs (and thus script files and action refs) are unchanged.
Bump both integrations to 1.1.0.
2026-06-22 14:41:22 +02:00
f3nris
6b65c5f9df
feat(harfanglab): HarfangLab EDR integration (71 analyst commands)
...
Endpoint management & isolation, policy assignment, IOC & whitelist (threat
intelligence), security-event triage, telemetry hunting (processes, network,
DNS, authentications, event logs, binaries), hash threat hunting, and forensic
collection jobs (pipes, prefetch, run keys, scheduled tasks, drivers, services,
processes, network, sessions, WMI, IOC scan, artifacts, RAM dump) plus their
result-retrieval commands. Script-based (urllib, INTEGRATION_SECRETS/INPUTS
contract; Authorization: Token header). Platform-specific XSOAR mirroring/fetch
commands intentionally excluded.
2026-06-22 13:50:20 +02:00
f3nris
Guillaume BOURGEOIS