f3nris
6b65c5f9df
Endpoint management & isolation, policy assignment, IOC & whitelist (threat intelligence), security-event triage, telemetry hunting (processes, network, DNS, authentications, event logs, binaries), hash threat hunting, and forensic collection jobs (pipes, prefetch, run keys, scheduled tasks, drivers, services, processes, network, sessions, WMI, IOC scan, artifacts, RAM dump) plus their result-retrieval commands. Script-based (urllib, INTEGRATION_SECRETS/INPUTS contract; Authorization: Token header). Platform-specific XSOAR mirroring/fetch commands intentionally excluded.
701 lines
32 KiB
YAML
701 lines
32 KiB
YAML
id: harfanglab
|
|
name: HarfangLab EDR
|
|
version: 1.0.0
|
|
description: "HarfangLab EDR — endpoint detection & response: endpoint enrichment, isolation, threat-intelligence (IOC/whitelist), telemetry hunting and forensic collection jobs."
|
|
changelog: "1.0.0 — Initial release: endpoint/agent management, isolation, policy assignment, IOC & whitelist management, security-event triage, telemetry hunting (processes, network, DNS, authentications, binaries, event logs), threat hunting by hash, and forensic collection jobs (pipes, prefetch, run keys, scheduled tasks, drivers, services, processes, network, sessions, WMI, IOC scan, artifacts, RAM dump) with their result retrieval commands. Compatible with HarfangLab EDR 2.13.7+."
|
|
category: endpoint
|
|
|
|
# Per-instance configuration. Scripts use <url> as the API base and call /api/... paths.
|
|
config_schema:
|
|
properties:
|
|
url:
|
|
type: string
|
|
description: HarfangLab EDR Manager URL, e.g. https://my-edr.example.com
|
|
api_token:
|
|
type: string
|
|
description: API key (HarfangLab EDR → user settings → API key)
|
|
x-soar-sensitive: true
|
|
required:
|
|
- url
|
|
- api_token
|
|
|
|
# Documented for reference; the bundled scripts build the header themselves
|
|
# (Authorization: Token <token>).
|
|
auth:
|
|
- id: apitoken
|
|
type: api_key
|
|
in: header
|
|
name: Authorization
|
|
value_template: "Token {{secret}}"
|
|
secret_field: api_token
|
|
|
|
commands:
|
|
# ── Endpoints / agents ────────────────────────────────────────────────────
|
|
- id: get_endpoint_info
|
|
name: Get endpoint info
|
|
description: Get endpoint (agent) information by agent ID.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: endpoint_search
|
|
name: Endpoint search
|
|
description: Search endpoints (agents) by hostname.
|
|
inputs_schema:
|
|
properties:
|
|
hostname: { type: string, description: "Hostname to filter agents by" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: isolate_endpoint
|
|
name: Isolate endpoint
|
|
description: Network-isolate an endpoint (agent) by agent ID.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: deisolate_endpoint
|
|
name: Deisolate endpoint
|
|
description: Remove network isolation from an endpoint (agent) by agent ID.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: assign_policy_to_agent
|
|
name: Assign policy to agent
|
|
description: Assign a security policy to an agent by policy name and agent ID.
|
|
inputs_schema:
|
|
properties:
|
|
policy: { type: string, description: "Name of the policy to assign" }
|
|
agentid: { type: string, description: "Agent unique identifier to assign the policy to" }
|
|
required: [policy, agentid]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Threat intelligence: whitelists ───────────────────────────────────────
|
|
- id: whitelist_search
|
|
name: Search whitelists
|
|
description: Search threat-intelligence whitelists by keyword.
|
|
inputs_schema:
|
|
properties:
|
|
keyword: { type: string, description: "Keyword to search" }
|
|
provided_by_hlab: { type: boolean, description: "Search HarfangLab-provided whitelists" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: whitelist_add
|
|
name: Add whitelist
|
|
description: Create a threat-intelligence whitelist rule with an initial criterion.
|
|
inputs_schema:
|
|
properties:
|
|
comment: { type: string, description: "Whitelist comment" }
|
|
target: { type: string, description: "Whitelist target (e.g. all)" }
|
|
sigma_rule_id: { type: string, description: "Associated sigma rule id" }
|
|
field: { type: string, description: "Criterion field" }
|
|
case_insensitive: { type: boolean, description: "Match field value case-insensitively" }
|
|
operator: { type: string, description: "Criterion operator (e.g. eq)" }
|
|
value: { type: string, description: "Criterion value" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: whitelist_add_criterion
|
|
name: Add whitelist criterion
|
|
description: Append a criterion to an existing whitelist rule.
|
|
inputs_schema:
|
|
properties:
|
|
id: { type: string, description: "Whitelist rule id" }
|
|
field: { type: string, description: "Criterion field" }
|
|
case_insensitive: { type: boolean, description: "Match field value case-insensitively" }
|
|
operator: { type: string, description: "Criterion operator (e.g. eq)" }
|
|
value: { type: string, description: "Criterion value" }
|
|
required: [id]
|
|
outputs_schema: { properties: {} }
|
|
- id: whitelist_delete
|
|
name: Delete whitelist
|
|
description: Delete a threat-intelligence whitelist rule by id.
|
|
inputs_schema:
|
|
properties:
|
|
id: { type: string, description: "Whitelist rule id" }
|
|
required: [id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Threat intelligence: IOCs ─────────────────────────────────────────────
|
|
- id: add_ioc_to_source
|
|
name: Add IOC to source
|
|
description: Add an IOC to a named IOC source if it does not already exist.
|
|
inputs_schema:
|
|
properties:
|
|
ioc_value: { type: string, description: "IOC value" }
|
|
ioc_type: { type: string, description: "IOC type" }
|
|
ioc_comment: { type: string, description: "IOC comment" }
|
|
ioc_status: { type: string, description: "IOC status (e.g. testing, detection, blocking)" }
|
|
source_name: { type: string, description: "IOC source name" }
|
|
required: [ioc_value, ioc_type, ioc_status, source_name]
|
|
outputs_schema: { properties: {} }
|
|
- id: delete_ioc_from_source
|
|
name: Delete IOC from source
|
|
description: Remove an IOC from a named IOC source if it exists.
|
|
inputs_schema:
|
|
properties:
|
|
ioc_value: { type: string, description: "IOC value" }
|
|
source_name: { type: string, description: "IOC source name" }
|
|
required: [ioc_value, source_name]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Security events ───────────────────────────────────────────────────────
|
|
- id: change_security_event_status
|
|
name: Change security event status
|
|
description: "Change the status of a security event (New, Investigating, False Positive, Closed)."
|
|
inputs_schema:
|
|
properties:
|
|
security_event_id: { type: string, description: "Security event ID" }
|
|
status: { type: string, description: "New | Investigating | False Positive | Closed" }
|
|
required: [security_event_id, status]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Generic / utility ─────────────────────────────────────────────────────
|
|
- id: api_call
|
|
name: API call
|
|
description: "Perform a generic authenticated call to the HarfangLab API."
|
|
inputs_schema:
|
|
properties:
|
|
api_method: { type: string, description: "HTTP method (GET, POST, PUT, DELETE, PATCH)" }
|
|
api_endpoint: { type: string, description: "API endpoint path beginning with /api/" }
|
|
parameters: { type: string, description: "Query string parameters in key=value&key=value form" }
|
|
data: { type: string, description: "JSON-encoded request body" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: telemetry_process_graph
|
|
name: Telemetry process graph
|
|
description: "Retrieve the process graph for a telemetry process UUID."
|
|
inputs_schema:
|
|
properties:
|
|
process_uuid: { type: string, description: "Telemetry process UUID" }
|
|
required: [process_uuid]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Threat hunting by hash ────────────────────────────────────────────────
|
|
- id: hunt_search_hash
|
|
name: Hunt search hash
|
|
description: "Search the data explorer for a file hash."
|
|
inputs_schema:
|
|
properties:
|
|
hash: { type: string, description: "File hash to search for" }
|
|
required: [hash]
|
|
outputs_schema: { properties: {} }
|
|
- id: hunt_search_running_process_hash
|
|
name: Hunt search running process by hash
|
|
description: "Hunt for currently running processes matching a SHA-256 hash."
|
|
inputs_schema:
|
|
properties:
|
|
hash: { type: string, description: "SHA-256 hash to search for" }
|
|
required: [hash]
|
|
outputs_schema: { properties: {} }
|
|
- id: hunt_search_runned_process_hash
|
|
name: Hunt search runned process by hash
|
|
description: "Search process telemetry for executions matching a SHA-256 hash."
|
|
inputs_schema:
|
|
properties:
|
|
hash: { type: string, description: "SHA-256 hash to search for" }
|
|
required: [hash]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Telemetry ─────────────────────────────────────────────────────────────
|
|
- id: telemetry_processes
|
|
name: Telemetry — processes
|
|
description: Search process telemetry.
|
|
inputs_schema:
|
|
properties:
|
|
hash: { type: string, description: "File hash (md5, sha1 or sha256)" }
|
|
hostname: { type: string, description: "Endpoint hostname" }
|
|
from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
|
|
to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
|
|
limit: { type: number, description: "Max elements (default 100)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: telemetry_dns
|
|
name: Telemetry — DNS resolution
|
|
description: Search DNS resolution telemetry.
|
|
inputs_schema:
|
|
properties:
|
|
hostname: { type: string, description: "Endpoint hostname" }
|
|
requested_name: { type: string, description: "Requested DNS name" }
|
|
query_type: { type: string, description: "DNS query type" }
|
|
from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
|
|
to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
|
|
limit: { type: number, description: "Max elements (default 100)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: telemetry_network
|
|
name: Telemetry — network
|
|
description: Search network connection telemetry.
|
|
inputs_schema:
|
|
properties:
|
|
hostname: { type: string, description: "Endpoint hostname" }
|
|
source_address: { type: string, description: "Source IP address" }
|
|
source_port: { type: number, description: "Source port" }
|
|
destination_address: { type: string, description: "Destination IP address" }
|
|
destination_port: { type: number, description: "Destination port" }
|
|
from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
|
|
to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
|
|
limit: { type: number, description: "Max elements (default 100)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: telemetry_eventlog
|
|
name: Telemetry — event log
|
|
description: Search Windows full event log telemetry.
|
|
inputs_schema:
|
|
properties:
|
|
hostname: { type: string, description: "Endpoint hostname" }
|
|
event_id: { type: number, description: "Windows event ID" }
|
|
from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
|
|
to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
|
|
limit: { type: number, description: "Max elements (default 100)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: telemetry_binary
|
|
name: Telemetry — binary
|
|
description: Search binary telemetry.
|
|
inputs_schema:
|
|
properties:
|
|
hash: { type: string, description: "File hash (md5, sha1 or sha256)" }
|
|
from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
|
|
to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
|
|
limit: { type: number, description: "Max elements (default 100)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: telemetry_authentication_windows
|
|
name: Telemetry — Windows authentication
|
|
description: Search Windows authentication telemetry.
|
|
inputs_schema:
|
|
properties:
|
|
hostname: { type: string, description: "Endpoint hostname" }
|
|
source_address: { type: string, description: "Source IP address" }
|
|
success: { type: boolean, description: "Authentication success" }
|
|
source_username: { type: string, description: "Source username" }
|
|
target_username: { type: string, description: "Target username" }
|
|
logon_title: { type: string, description: "Windows logon title" }
|
|
logon_type: { type: number, description: "Windows logon type" }
|
|
from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
|
|
to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
|
|
limit: { type: number, description: "Max elements (default 100)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: telemetry_authentication_linux
|
|
name: Telemetry — Linux authentication
|
|
description: Search Linux authentication telemetry.
|
|
inputs_schema:
|
|
properties:
|
|
hostname: { type: string, description: "Endpoint hostname" }
|
|
source_address: { type: string, description: "Source IP address" }
|
|
success: { type: boolean, description: "Authentication success" }
|
|
source_username: { type: string, description: "Source username" }
|
|
target_username: { type: string, description: "Target username" }
|
|
from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
|
|
to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
|
|
limit: { type: number, description: "Max elements (default 100)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: telemetry_authentication_macos
|
|
name: Telemetry — macOS authentication
|
|
description: Search macOS authentication telemetry.
|
|
inputs_schema:
|
|
properties:
|
|
hostname: { type: string, description: "Endpoint hostname" }
|
|
source_address: { type: string, description: "Source IP address" }
|
|
success: { type: boolean, description: "Authentication success" }
|
|
source_username: { type: string, description: "Source username" }
|
|
target_username: { type: string, description: "Target username" }
|
|
from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
|
|
to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
|
|
limit: { type: number, description: "Max elements (default 100)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: telemetry_authentication_users
|
|
name: Telemetry — top authenticating users
|
|
description: Rank users by authentication attempts across Windows, Linux and macOS.
|
|
inputs_schema:
|
|
properties:
|
|
hostname: { type: string, description: "Endpoint hostname" }
|
|
from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
|
|
to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
|
|
limit: { type: number, description: "Max users to return (default 3)" }
|
|
required: [hostname]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Collection jobs ───────────────────────────────────────────────────────
|
|
- id: job_pipelist
|
|
name: Job — list pipes
|
|
description: Start a job to list named pipes on a host (Windows).
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_prefetchlist
|
|
name: Job — list prefetch
|
|
description: Start a job to collect Windows prefetch files on a host.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_runkeylist
|
|
name: Job — list run keys
|
|
description: Start a job to collect registry run keys (hives) on a host.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_scheduledtasklist
|
|
name: Job — list scheduled tasks
|
|
description: Start a job to list scheduled tasks on a host.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_driverlist
|
|
name: Job — list drivers
|
|
description: Start a job to list loaded drivers on a host.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_servicelist
|
|
name: Job — list services
|
|
description: Start a job to collect services from registry hives on a host.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_processlist
|
|
name: Job — list processes
|
|
description: Start a job to list running processes with signature info on a host.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_networkconnectionlist
|
|
name: Job — list network connections
|
|
description: Start a job to list processes with their active network connections on a host.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_networksharelist
|
|
name: Job — list network shares
|
|
description: Start a job to list network shares on a host.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_sessionlist
|
|
name: Job — list sessions
|
|
description: Start a job to list active user sessions on a host.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_persistencelist
|
|
name: Job — list persistence
|
|
description: Start a job to scan for persistence mechanisms on a host.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_startuplist
|
|
name: Job — list startup files
|
|
description: Start a job to list startup files on a host.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_wmilist
|
|
name: Job — list WMI
|
|
description: Start a job to collect WMI persistence artifacts on a host.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_ioc
|
|
name: Job — IOC scan
|
|
description: Start an IOC scan job on a host using filename, filepath, hash, registry, or regex indicators.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
filename: { type: string, description: "Filename to search for" }
|
|
filepath: { type: string, description: "File path to search for" }
|
|
hash: { type: string, description: "File hash to search for (MD5, SHA-1 or SHA-256)" }
|
|
search_in_path: { type: string, description: "Restrict the search to this path" }
|
|
filesize: { type: string, description: "File size in bytes associated with the filename indicator" }
|
|
hash_filesize: { type: string, description: "File size in bytes associated with the hash indicator" }
|
|
registry: { type: string, description: "Registry key or value to search for" }
|
|
filepath_regex: { type: string, description: "Regular expression to match file paths" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_info
|
|
name: Job — get job info
|
|
description: Retrieve information for one or more jobs by their identifiers.
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated list of job IDs to retrieve" }
|
|
required: [ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Forensic artifact collection jobs ─────────────────────────────────────
|
|
- id: job_artifact_mft
|
|
name: Job — collect MFT
|
|
description: Start a job to collect the NTFS Master File Table (MFT) from a host (Windows).
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_artifact_hives
|
|
name: Job — collect registry hives
|
|
description: Start a job to collect the Windows registry hives from a host.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_artifact_evtx
|
|
name: Job — collect event logs
|
|
description: Start a job to collect the Windows event logs (EVTX) from a host.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_artifact_logs
|
|
name: Job — collect system logs
|
|
description: Start a job to collect the system logs from a host.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_artifact_filesystem
|
|
name: Job — collect filesystem listing
|
|
description: Start a job to collect the filesystem listing from a host.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_artifact_all
|
|
name: Job — collect all raw evidence
|
|
description: Start a job to collect all raw forensic evidence (hives, event logs, MFT, prefetch, USN journal, logs, filesystem) from a host.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_artifact_ramdump
|
|
name: Job — dump RAM
|
|
description: Start a job to capture a full memory (RAM) dump from a host.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_artifact_downloadfile
|
|
name: Job — download file
|
|
description: Start a job to download a specific file from a host by its full path.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
filename: { type: string, description: "Full path of the file to download from the host" }
|
|
required: [agent_id, filename]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Job results (hunting) ─────────────────────────────────────────────────
|
|
- id: result_pipelist
|
|
name: Result — pipes
|
|
description: Get a host's list of named pipes from a job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_prefetchlist
|
|
name: Result — prefetch
|
|
description: Get a host's prefetch entries from a job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_runkeylist
|
|
name: Result — run keys
|
|
description: Get a host's registry run keys from a job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_scheduledtasklist
|
|
name: Result — scheduled tasks
|
|
description: Get a host's scheduled tasks from a job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_driverlist
|
|
name: Result — drivers
|
|
description: Get a host's list of drivers from a job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_servicelist
|
|
name: Result — services
|
|
description: Get a host's list of services from a job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_processlist
|
|
name: Result — processes
|
|
description: Get a host's list of running processes from a job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_networkconnectionlist
|
|
name: Result — network connections
|
|
description: Get a host's network connections from a job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_networksharelist
|
|
name: Result — network shares
|
|
description: Get a host's list of network shares from a job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_sessionlist
|
|
name: Result — sessions
|
|
description: Get a host's list of user sessions from a job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_persistencelist
|
|
name: Result — persistence
|
|
description: Get a host's persistence files from a job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_startuplist
|
|
name: Result — startup items
|
|
description: Get a host's startup items from a job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_wmilist
|
|
name: Result — WMI
|
|
description: Get a host's WMI persistence entries from a job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_ioc
|
|
name: Result — IOC matches
|
|
description: Get a host's IOC matches from a job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Job results (forensic artifacts) ──────────────────────────────────────
|
|
- id: result_artifact_mft
|
|
name: Result — MFT artifact
|
|
description: Get the MFT download links from a collection job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_artifact_hives
|
|
name: Result — Registry hives artifact
|
|
description: Get the Windows registry hive download links from a collection job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_artifact_evtx
|
|
name: Result — EVTX artifact
|
|
description: Get the Windows event log (EVTX) download links from a collection job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_artifact_logs
|
|
name: Result — Linux logs artifact
|
|
description: Get the Linux system log download links from a collection job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_artifact_filesystem
|
|
name: Result — Filesystem artifact
|
|
description: Get the filesystem listing download links from a collection job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_artifact_all
|
|
name: Result — All artifacts
|
|
description: Get the download links for all collected artifacts from a collection job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_artifact_downloadfile
|
|
name: Result — Downloaded file artifact
|
|
description: Get the download link for a file retrieved by a download-file job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_artifact_ramdump
|
|
name: Result — RAM dump artifact
|
|
description: Get the memory (RAM) dump download links from a collection job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|