riposte-marketplace/integrations/harfanglab/manifest.yaml

id: harfanglab
name: HarfangLab EDR
version: 1.9.0
description: "HarfangLab EDR — endpoint detection & response: alert/threat ingestion, endpoint enrichment, isolation, threat-intelligence (IOC/whitelist), telemetry hunting and forensic collection jobs."
changelog: "1.9.0 — endpoint_count takes four version bounds, version_lt, version_lte, version_gt and version_gte, so a fleet can be counted on the agents still to be upgraded to a target build, per OS beside ostype. The API matches a version only exactly and drops a filter it does not know without a word, so the bounds are not sent: the script reads every agent the other filters keep, 500 per page, and compares the versions number by number (4.10 is above 4.9, which a string comparison denies). An agent whose version cannot be read is left out of the count and reported under unreadable_version; scanned gives how many were read. A bound that is not a version fails the block instead of counting nothing. 1.8.0 — An instance can carry the tenant of the client it serves (tenant in its configuration), for clients sharing one multi-tenant manager: each gets its own instance with the same URL and key and its own tenant. endpoint_count is scoped to it when the block leaves its tenant filter empty, and so is the fleet total returned beside the count; a tenant named on the block still wins. A playbook bound to the run's client — a job fanned out over every client with HarfangLab — counted the whole manager for the clients that shared it. Left empty, nothing changes. 1.7.3 — Every command now retries a call HarfangLab answers with a transient error, up to three times after 1, 2 and 4 seconds. The API returns a 500 now and then on a call that passes when sent again, which failed an ingestion run or a playbook step for nothing. Reads (GET) are retried on 429, 500, 502, 503 and 504. Writes are retried only on 429, 502 and 503, answers that say the action was not run: a 500 or 504 on an isolation, a kill or a job creation may come after the action took effect, so it is reported rather than sent twice. | 1.7.1 — get_security_events, get_alerts and get_threats no longer pass on the `filters` block HarfangLab's list endpoints echo on every call: the catalogue of every filterable field, about 50 KB, unrelated to the results. One alert weighs about 10 KB, so that block alone made up most of a small fetch. The get_security_events and get_alerts mappers give an incident the rule's message (msg) as its description — what the rule detects and what to check — instead of the bare alert type, which now stands in only on alerts without a message. | 1.7.0 — New threat_security_events command: returns every security event of a threat. Since HarfangLab merged alerts and security events, a threat's events are the alerts whose threat_key is the threat id — the filter the vendor's own XSOAR integration uses. get_alerts could already filter on it but stops at one page of 100; threat_security_events pages through up to max_results (default 1000) and returns the threat's `total` with a `truncated` flag, so a cut-off list never passes for the whole threat. threat_status, threat_level and alert_tag now offer their status and level as drop-downs, and threat_status says it is where a threat is closed or marked a false positive — HarfangLab has no separate verdict field and no assignment on a threat. | 1.6.0 — New endpoint_count command: counts agents matching filters without listing them. The HarfangLab agent collection is DRF-paginated, so its `count` field already carries the filtered total; endpoint_count asks for limit=1 and reads it, instead of pulling up to 10000 agent records back through the playbook the way endpoint_search does. Filters cover the documented agent query parameters (hostname, os, version, status, isolation_state, tenant, network), add lastseen/firstseen bounds, and leave a raw `filters` escape hatch for the rest. The API silently drops a parameter it does not recognise as a filter — which turns a typo into a plausible-looking fleet-wide total — so the fleet `total` is returned next to `count` to make that case visible. | 1.5.0 — Declare the risk tier on the 71 commands that carried none: 39 read, 24 safe_write, 8 destructive. An unset risk is read as destructive by the agent approval gate, so the 63 that only read or only annotate sat behind the same prompt as the ones that change the estate. deisolate_from_threat and unquarantine_file move from safe_write to destructive in the same pass: undoing a containment mid-incident is its own decision, and is tiered like the containment it lifts. | 1.4.1 — get_alerts now maps image_name, the one process path present on every alert subtype and the only one on those carrying neither a process object nor an event log (yara, binary, ioc). HarfangLab prefixes it with the matched threat name in brackets, so both halves are split out: the clean path feeds actor.process.file.path and its basename actor.process.name, and the threat name feeds malware.name — which now surfaces on every subtype rather than only on Defender event-log detections. Each half is guarded on the bracket being present so an unprefixed path is never written into malware.name. 1.4.0 — Mapper coverage from real payloads: get_alerts now maps the Windows event-log payload sigma alerts carry (alert_subtype = eventlog), which was entirely unmapped — Defender 1116/1117 yields the malware name, classification, severity and provider, the detected file, the process that touched it and the acting user, plus the log provider and event code. Also added the agent IP, DNS domain, device type, agent version and groups, the tenant, the alert subtype and threat type, the string severity and the event time. get_threats gained the threat level (previously never reaching the OCSF document at all), the event time and the top agent's reachability. 1.3.1 — Flagged get_alerts as ingestion-ready (ingest hints: results_path/dedup/incremental on from_date) so it appears in the recommended ingestion commands when creating an instance. 1.3.0 — Response & triage expansion: kill/dump process, on-demand AV/YARA scans, file/service/scheduled-task deletion, quarantine management, threat-level isolation, job cancel/relaunch/wait; alert search (get_alerts) and full alert/threat triage (tag, comments, notes, status, level, history, details); exhaustive alert OCSF mappers; reworked get_threats mapper (fixed MITRE tactics map handling, full top-agent/user/rule and counts coverage, rule-based incident title/description). 1.2.2 — Documentation wording cleanup. 1.2.1 — Corrected the get_threats OCSF mapper to native threat fields (top_agents/top_impacted_users/top_rules/mitre_tactics) instead of enriched-only arrays; added agent.osversion to get_security_events. 1.2.0 — Added ingestion commands get_security_events (alerts) and get_threats with bundled OCSF mappers and ingest hints (results_path/dedup/incremental). 1.1.1 — Added test_connection for the instance Test button. 1.1.0 — Command names prefixed with 'harfanglab-' (e.g. harfanglab-isolate-endpoint) for easier toolbox search; command IDs unchanged. 1.0.0 — Initial release: endpoint/agent management, isolation, policy assignment, IOC & whitelist management, security-event triage, telemetry hunting (processes, network, DNS, authentications, binaries, event logs), threat hunting by hash, and forensic collection jobs (pipes, prefetch, run keys, scheduled tasks, drivers, services, processes, network, sessions, WMI, IOC scan, artifacts, RAM dump) with their result retrieval commands. Compatible with HarfangLab EDR 2.13.7+."
category: endpoint

# Per-instance configuration. Scripts use <url> as the API base and call /api/... paths.
config_schema:
  properties:
    url:
      type: string
      description: HarfangLab EDR Manager URL, e.g. https://my-edr.example.com
    api_token:
      type: string
      description: API key (HarfangLab EDR → user settings → API key)
      x-soar-sensitive: true
    tenant:
      type: string
      description: >-
        Optional tenant identifier, for an instance that serves one client of a
        shared multi-tenant manager. endpoint_count is scoped to it when the
        block leaves its own tenant filter empty.
  required:
    - url
    - api_token

# Documented for reference; the bundled scripts build the header themselves
# (Authorization: Token <token>).
auth:
  - id: apitoken
    type: api_key
    in: header
    name: Authorization
    value_template: "Token {{secret}}"
    secret_field: api_token

commands:
  # ── Alerts & threats (ingestion) ──────────────────────────────────────────
  - id: get_security_events
    name: harfanglab-get-security-events
    description: "Fetch HarfangLab EDR security events (alerts) for ingestion. Returns {results: [...]} — use results as the alert rule results path."
    risk: read
    inputs_schema:
      properties:
        min_severity: { type: string, description: "Minimum severity to fetch: low, medium, high, critical" }
        status: { type: string, description: "Comma-separated statuses (new, investigating, closed, false_positive)" }
        alert_type: { type: string, description: "Comma-separated alert types (sigma, yara, hlai, vt, ransom, ioc, glimps, orion...)" }
        created_after: { type: string, description: "ISO8601 lower bound on alert_time (incremental fetch watermark)" }
        limit: { type: number, description: "Maximum number of events to fetch" }
      required: []
    outputs_schema: { properties: {} }
    ingest:
      results_path: results
      dedup_key: id
      incremental_field: created_after
  - id: get_threats
    name: harfanglab-get-threats
    description: "Fetch HarfangLab EDR threats (aggregated security events) for ingestion. Returns {results: [...]} enriched with agents/impacted_users/rules."
    risk: read
    inputs_schema:
      properties:
        min_severity: { type: string, description: "Minimum severity to fetch: low, medium, high, critical" }
        status: { type: string, description: "Comma-separated statuses (new, investigating, closed, false_positive)" }
        created_after: { type: string, description: "ISO8601 lower bound on creation_date (incremental fetch watermark)" }
        limit: { type: number, description: "Maximum number of threats to fetch" }
      required: []
    outputs_schema: { properties: {} }
    ingest:
      results_path: results
      dedup_key: id
      incremental_field: created_after
  # ── Endpoints / agents ────────────────────────────────────────────────────
  - id: get_endpoint_info
    name: harfanglab-get-endpoint-info
    description: Get endpoint (agent) information by agent ID.
    risk: read
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: endpoint_search
    name: harfanglab-endpoint-search
    description: Search endpoints (agents) by hostname.
    risk: read
    inputs_schema:
      properties:
        hostname: { type: string, description: "Hostname to filter agents by" }
      required: []
    outputs_schema: { properties: {} }
  - id: endpoint_count
    name: harfanglab-endpoint-count
    description: "Count endpoints (agents) matching filters, without listing them. Returns {count, total, filters}: count is the number of matching agents, total the whole fleet (the instance tenant's fleet when the instance carries one). An unrecognised filter is silently ignored by the API, so compare count against total before trusting a figure."
    risk: read
    inputs_schema:
      properties:
        hostname: { type: string, description: "Exact hostname" }
        domainname: { type: string, description: "Exact DNS domain name" }
        domain: { type: string, description: "Exact Windows domain" }
        ipaddress: { type: string, description: "Exact internal IP address" }
        external_ipaddress: { type: string, description: "Exact external IP address" }
        ostype: { type: string, description: "Operating system type (windows, linux, macos)" }
        osproducttype: { type: string, description: "OS product type, e.g. Server or Workstation" }
        osversion: { type: string, description: "Exact OS version string" }
        producttype: { type: string, description: "Exact product type" }
        version: { type: string, description: "Exact agent version" }
        status: { type: string, description: "Agent status, e.g. online or offline" }
        isolation_state: { type: boolean, description: "true counts isolated agents, false counts non-isolated ones" }
        tenant: { type: string, description: "Exact tenant identifier" }
        version_lt: { type: string, description: "Only agents on a version strictly older than this one, e.g. 4.10.2 — the fleet still to be upgraded to it. Compared by Riposte, number by number, over every agent the other filters keep" }
        version_lte: { type: string, description: "Only agents on this version or older, e.g. 4.10.2" }
        version_gt: { type: string, description: "Only agents on a version strictly newer than this one, e.g. 4.10.2" }
        version_gte: { type: string, description: "Only agents on this version or newer, e.g. 4.10.2" }
        lastseen_after: { type: string, description: "ISO8601 lower bound on lastseen — agents seen since that instant" }
        lastseen_before: { type: string, description: "ISO8601 upper bound on lastseen — agents not seen since that instant" }
        firstseen_after: { type: string, description: "ISO8601 lower bound on firstseen — agents enrolled since that instant" }
        firstseen_before: { type: string, description: "ISO8601 upper bound on firstseen" }
        filters: { type: string, description: "Any other API filter, as k=v pairs joined by & (e.g. groups__name=Serveurs&osmajor=10)" }
      required: []
    outputs_schema: { properties: {} }
  - id: isolate_endpoint
    name: harfanglab-isolate-endpoint
    description: Network-isolate an endpoint (agent) by agent ID.
    risk: destructive
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: deisolate_endpoint
    name: harfanglab-deisolate-endpoint
    description: Remove network isolation from an endpoint (agent) by agent ID.
    risk: destructive
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: assign_policy_to_agent
    name: harfanglab-assign-policy-to-agent
    description: Assign a security policy to an agent by policy name and agent ID.
    risk: destructive
    inputs_schema:
      properties:
        policy: { type: string, description: "Name of the policy to assign" }
        agentid: { type: string, description: "Agent unique identifier to assign the policy to" }
      required: [policy, agentid]
    outputs_schema: { properties: {} }

  # ── Threat intelligence: whitelists ───────────────────────────────────────
  - id: whitelist_search
    name: harfanglab-whitelist-search
    description: Search threat-intelligence whitelists by keyword.
    risk: read
    inputs_schema:
      properties:
        keyword: { type: string, description: "Keyword to search" }
        provided_by_hlab: { type: boolean, description: "Search HarfangLab-provided whitelists" }
      required: []
    outputs_schema: { properties: {} }
  - id: whitelist_add
    name: harfanglab-whitelist-add
    description: Create a threat-intelligence whitelist rule with an initial criterion.
    risk: destructive
    inputs_schema:
      properties:
        comment: { type: string, description: "Whitelist comment" }
        target: { type: string, description: "Whitelist target (e.g. all)" }
        sigma_rule_id: { type: string, description: "Associated sigma rule id" }
        field: { type: string, description: "Criterion field" }
        case_insensitive: { type: boolean, description: "Match field value case-insensitively" }
        operator: { type: string, description: "Criterion operator (e.g. eq)" }
        value: { type: string, description: "Criterion value" }
      required: []
    outputs_schema: { properties: {} }
  - id: whitelist_add_criterion
    name: harfanglab-whitelist-add-criterion
    description: Append a criterion to an existing whitelist rule.
    risk: destructive
    inputs_schema:
      properties:
        id: { type: string, description: "Whitelist rule id" }
        field: { type: string, description: "Criterion field" }
        case_insensitive: { type: boolean, description: "Match field value case-insensitively" }
        operator: { type: string, description: "Criterion operator (e.g. eq)" }
        value: { type: string, description: "Criterion value" }
      required: [id]
    outputs_schema: { properties: {} }
  - id: whitelist_delete
    name: harfanglab-whitelist-delete
    description: Delete a threat-intelligence whitelist rule by id.
    risk: destructive
    inputs_schema:
      properties:
        id: { type: string, description: "Whitelist rule id" }
      required: [id]
    outputs_schema: { properties: {} }

  # ── Threat intelligence: IOCs ─────────────────────────────────────────────
  - id: add_ioc_to_source
    name: harfanglab-add-ioc-to-source
    description: Add an IOC to a named IOC source if it does not already exist.
    risk: safe_write
    inputs_schema:
      properties:
        ioc_value: { type: string, description: "IOC value" }
        ioc_type: { type: string, description: "IOC type" }
        ioc_comment: { type: string, description: "IOC comment" }
        ioc_status: { type: string, description: "IOC status (e.g. testing, detection, blocking)" }
        source_name: { type: string, description: "IOC source name" }
      required: [ioc_value, ioc_type, ioc_status, source_name]
    outputs_schema: { properties: {} }
  - id: delete_ioc_from_source
    name: harfanglab-delete-ioc-from-source
    description: Remove an IOC from a named IOC source if it exists.
    risk: destructive
    inputs_schema:
      properties:
        ioc_value: { type: string, description: "IOC value" }
        source_name: { type: string, description: "IOC source name" }
      required: [ioc_value, source_name]
    outputs_schema: { properties: {} }

  # ── Security events ───────────────────────────────────────────────────────
  - id: change_security_event_status
    name: harfanglab-change-security-event-status
    description: "Change the status of a security event (New, Investigating, False Positive, Closed)."
    risk: safe_write
    inputs_schema:
      properties:
        security_event_id: { type: string, description: "Security event ID" }
        status: { type: string, description: "New | Investigating | False Positive | Closed" }
      required: [security_event_id, status]
    outputs_schema: { properties: {} }

  # ── Generic / utility ─────────────────────────────────────────────────────
  - id: api_call
    name: harfanglab-api-call
    description: "Perform a generic authenticated call to the HarfangLab API."
    risk: destructive
    inputs_schema:
      properties:
        api_method: { type: string, description: "HTTP method (GET, POST, PUT, DELETE, PATCH)" }
        api_endpoint: { type: string, description: "API endpoint path beginning with /api/" }
        parameters: { type: string, description: "Query string parameters in key=value&key=value form" }
        data: { type: string, description: "JSON-encoded request body" }
      required: []
    outputs_schema: { properties: {} }
  - id: telemetry_process_graph
    name: harfanglab-telemetry-process-graph
    description: "Retrieve the process graph for a telemetry process UUID."
    risk: read
    inputs_schema:
      properties:
        process_uuid: { type: string, description: "Telemetry process UUID" }
      required: [process_uuid]
    outputs_schema: { properties: {} }

  # ── Threat hunting by hash ────────────────────────────────────────────────
  - id: hunt_search_hash
    name: harfanglab-hunt-search-hash
    description: "Search the data explorer for a file hash."
    risk: read
    inputs_schema:
      properties:
        hash: { type: string, description: "File hash to search for" }
      required: [hash]
    outputs_schema: { properties: {} }
  - id: hunt_search_running_process_hash
    name: harfanglab-hunt-search-running-process-hash
    description: "Hunt for currently running processes matching a SHA-256 hash."
    risk: read
    inputs_schema:
      properties:
        hash: { type: string, description: "SHA-256 hash to search for" }
      required: [hash]
    outputs_schema: { properties: {} }
  - id: hunt_search_runned_process_hash
    name: harfanglab-hunt-search-runned-process-hash
    description: "Search process telemetry for executions matching a SHA-256 hash."
    risk: read
    inputs_schema:
      properties:
        hash: { type: string, description: "SHA-256 hash to search for" }
      required: [hash]
    outputs_schema: { properties: {} }

  # ── Telemetry ─────────────────────────────────────────────────────────────
  - id: telemetry_processes
    name: harfanglab-telemetry-processes
    description: Search process telemetry.
    risk: read
    inputs_schema:
      properties:
        hash: { type: string, description: "File hash (md5, sha1 or sha256)" }
        hostname: { type: string, description: "Endpoint hostname" }
        from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
        to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
        limit: { type: number, description: "Max elements (default 100)" }
      required: []
    outputs_schema: { properties: {} }
  - id: telemetry_dns
    name: harfanglab-telemetry-dns
    description: Search DNS resolution telemetry.
    risk: read
    inputs_schema:
      properties:
        hostname: { type: string, description: "Endpoint hostname" }
        requested_name: { type: string, description: "Requested DNS name" }
        query_type: { type: string, description: "DNS query type" }
        from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
        to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
        limit: { type: number, description: "Max elements (default 100)" }
      required: []
    outputs_schema: { properties: {} }
  - id: telemetry_network
    name: harfanglab-telemetry-network
    description: Search network connection telemetry.
    risk: read
    inputs_schema:
      properties:
        hostname: { type: string, description: "Endpoint hostname" }
        source_address: { type: string, description: "Source IP address" }
        source_port: { type: number, description: "Source port" }
        destination_address: { type: string, description: "Destination IP address" }
        destination_port: { type: number, description: "Destination port" }
        from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
        to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
        limit: { type: number, description: "Max elements (default 100)" }
      required: []
    outputs_schema: { properties: {} }
  - id: telemetry_eventlog
    name: harfanglab-telemetry-eventlog
    description: Search Windows full event log telemetry.
    risk: read
    inputs_schema:
      properties:
        hostname: { type: string, description: "Endpoint hostname" }
        event_id: { type: number, description: "Windows event ID" }
        from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
        to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
        limit: { type: number, description: "Max elements (default 100)" }
      required: []
    outputs_schema: { properties: {} }
  - id: telemetry_binary
    name: harfanglab-telemetry-binary
    description: Search binary telemetry.
    risk: read
    inputs_schema:
      properties:
        hash: { type: string, description: "File hash (md5, sha1 or sha256)" }
        from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
        to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
        limit: { type: number, description: "Max elements (default 100)" }
      required: []
    outputs_schema: { properties: {} }
  - id: telemetry_authentication_windows
    name: harfanglab-telemetry-authentication-windows
    description: Search Windows authentication telemetry.
    risk: read
    inputs_schema:
      properties:
        hostname: { type: string, description: "Endpoint hostname" }
        source_address: { type: string, description: "Source IP address" }
        success: { type: boolean, description: "Authentication success" }
        source_username: { type: string, description: "Source username" }
        target_username: { type: string, description: "Target username" }
        logon_title: { type: string, description: "Windows logon title" }
        logon_type: { type: number, description: "Windows logon type" }
        from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
        to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
        limit: { type: number, description: "Max elements (default 100)" }
      required: []
    outputs_schema: { properties: {} }
  - id: telemetry_authentication_linux
    name: harfanglab-telemetry-authentication-linux
    description: Search Linux authentication telemetry.
    risk: read
    inputs_schema:
      properties:
        hostname: { type: string, description: "Endpoint hostname" }
        source_address: { type: string, description: "Source IP address" }
        success: { type: boolean, description: "Authentication success" }
        source_username: { type: string, description: "Source username" }
        target_username: { type: string, description: "Target username" }
        from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
        to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
        limit: { type: number, description: "Max elements (default 100)" }
      required: []
    outputs_schema: { properties: {} }
  - id: telemetry_authentication_macos
    name: harfanglab-telemetry-authentication-macos
    description: Search macOS authentication telemetry.
    risk: read
    inputs_schema:
      properties:
        hostname: { type: string, description: "Endpoint hostname" }
        source_address: { type: string, description: "Source IP address" }
        success: { type: boolean, description: "Authentication success" }
        source_username: { type: string, description: "Source username" }
        target_username: { type: string, description: "Target username" }
        from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
        to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
        limit: { type: number, description: "Max elements (default 100)" }
      required: []
    outputs_schema: { properties: {} }
  - id: telemetry_authentication_users
    name: harfanglab-telemetry-authentication-users
    description: Rank users by authentication attempts across Windows, Linux and macOS.
    risk: read
    inputs_schema:
      properties:
        hostname: { type: string, description: "Endpoint hostname" }
        from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
        to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
        limit: { type: number, description: "Max users to return (default 3)" }
      required: [hostname]
    outputs_schema: { properties: {} }

  # ── Collection jobs ───────────────────────────────────────────────────────
  - id: job_pipelist
    name: harfanglab-job-pipelist
    description: Start a job to list named pipes on a host (Windows).
    risk: safe_write
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_prefetchlist
    name: harfanglab-job-prefetchlist
    description: Start a job to collect Windows prefetch files on a host.
    risk: safe_write
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_runkeylist
    name: harfanglab-job-runkeylist
    description: Start a job to collect registry run keys (hives) on a host.
    risk: safe_write
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_scheduledtasklist
    name: harfanglab-job-scheduledtasklist
    description: Start a job to list scheduled tasks on a host.
    risk: safe_write
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_driverlist
    name: harfanglab-job-driverlist
    description: Start a job to list loaded drivers on a host.
    risk: safe_write
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_servicelist
    name: harfanglab-job-servicelist
    description: Start a job to collect services from registry hives on a host.
    risk: safe_write
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_processlist
    name: harfanglab-job-processlist
    description: Start a job to list running processes with signature info on a host.
    risk: safe_write
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_networkconnectionlist
    name: harfanglab-job-networkconnectionlist
    description: Start a job to list processes with their active network connections on a host.
    risk: safe_write
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_networksharelist
    name: harfanglab-job-networksharelist
    description: Start a job to list network shares on a host.
    risk: safe_write
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_sessionlist
    name: harfanglab-job-sessionlist
    description: Start a job to list active user sessions on a host.
    risk: safe_write
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_persistencelist
    name: harfanglab-job-persistencelist
    description: Start a job to scan for persistence mechanisms on a host.
    risk: safe_write
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_startuplist
    name: harfanglab-job-startuplist
    description: Start a job to list startup files on a host.
    risk: safe_write
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_wmilist
    name: harfanglab-job-wmilist
    description: Start a job to collect WMI persistence artifacts on a host.
    risk: safe_write
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_ioc
    name: harfanglab-job-ioc
    description: Start an IOC scan job on a host using filename, filepath, hash, registry, or regex indicators.
    risk: safe_write
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
        filename: { type: string, description: "Filename to search for" }
        filepath: { type: string, description: "File path to search for" }
        hash: { type: string, description: "File hash to search for (MD5, SHA-1 or SHA-256)" }
        search_in_path: { type: string, description: "Restrict the search to this path" }
        filesize: { type: string, description: "File size in bytes associated with the filename indicator" }
        hash_filesize: { type: string, description: "File size in bytes associated with the hash indicator" }
        registry: { type: string, description: "Registry key or value to search for" }
        filepath_regex: { type: string, description: "Regular expression to match file paths" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_info
    name: harfanglab-job-info
    description: Retrieve information for one or more jobs by their identifiers.
    risk: read
    inputs_schema:
      properties:
        ids: { type: string, description: "Comma-separated list of job IDs to retrieve" }
      required: [ids]
    outputs_schema: { properties: {} }

  # ── Forensic artifact collection jobs ─────────────────────────────────────
  - id: job_artifact_mft
    name: harfanglab-job-artifact-mft
    description: Start a job to collect the NTFS Master File Table (MFT) from a host (Windows).
    risk: safe_write
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_artifact_hives
    name: harfanglab-job-artifact-hives
    description: Start a job to collect the Windows registry hives from a host.
    risk: safe_write
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_artifact_evtx
    name: harfanglab-job-artifact-evtx
    description: Start a job to collect the Windows event logs (EVTX) from a host.
    risk: safe_write
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_artifact_logs
    name: harfanglab-job-artifact-logs
    description: Start a job to collect the system logs from a host.
    risk: safe_write
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_artifact_filesystem
    name: harfanglab-job-artifact-filesystem
    description: Start a job to collect the filesystem listing from a host.
    risk: safe_write
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_artifact_all
    name: harfanglab-job-artifact-all
    description: Start a job to collect all raw forensic evidence (hives, event logs, MFT, prefetch, USN journal, logs, filesystem) from a host.
    risk: safe_write
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_artifact_ramdump
    name: harfanglab-job-artifact-ramdump
    description: Start a job to capture a full memory (RAM) dump from a host.
    risk: safe_write
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_artifact_downloadfile
    name: harfanglab-job-artifact-downloadfile
    description: Start a job to download a specific file from a host by its full path.
    risk: safe_write
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
        filename: { type: string, description: "Full path of the file to download from the host" }
      required: [agent_id, filename]
    outputs_schema: { properties: {} }

  # ── Job results (hunting) ─────────────────────────────────────────────────
  - id: result_pipelist
    name: harfanglab-result-pipelist
    description: Get a host's list of named pipes from a job result.
    risk: read
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_prefetchlist
    name: harfanglab-result-prefetchlist
    description: Get a host's prefetch entries from a job result.
    risk: read
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_runkeylist
    name: harfanglab-result-runkeylist
    description: Get a host's registry run keys from a job result.
    risk: read
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_scheduledtasklist
    name: harfanglab-result-scheduledtasklist
    description: Get a host's scheduled tasks from a job result.
    risk: read
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_driverlist
    name: harfanglab-result-driverlist
    description: Get a host's list of drivers from a job result.
    risk: read
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_servicelist
    name: harfanglab-result-servicelist
    description: Get a host's list of services from a job result.
    risk: read
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_processlist
    name: harfanglab-result-processlist
    description: Get a host's list of running processes from a job result.
    risk: read
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_networkconnectionlist
    name: harfanglab-result-networkconnectionlist
    description: Get a host's network connections from a job result.
    risk: read
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_networksharelist
    name: harfanglab-result-networksharelist
    description: Get a host's list of network shares from a job result.
    risk: read
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_sessionlist
    name: harfanglab-result-sessionlist
    description: Get a host's list of user sessions from a job result.
    risk: read
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_persistencelist
    name: harfanglab-result-persistencelist
    description: Get a host's persistence files from a job result.
    risk: read
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_startuplist
    name: harfanglab-result-startuplist
    description: Get a host's startup items from a job result.
    risk: read
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_wmilist
    name: harfanglab-result-wmilist
    description: Get a host's WMI persistence entries from a job result.
    risk: read
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_ioc
    name: harfanglab-result-ioc
    description: Get a host's IOC matches from a job result.
    risk: read
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching job command" }
      required: [job_id]
    outputs_schema: { properties: {} }

  # ── Job results (forensic artifacts) ──────────────────────────────────────
  - id: result_artifact_mft
    name: harfanglab-result-artifact-mft
    description: Get the MFT download links from a collection job result.
    risk: read
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_artifact_hives
    name: harfanglab-result-artifact-hives
    description: Get the Windows registry hive download links from a collection job result.
    risk: read
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_artifact_evtx
    name: harfanglab-result-artifact-evtx
    description: Get the Windows event log (EVTX) download links from a collection job result.
    risk: read
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_artifact_logs
    name: harfanglab-result-artifact-logs
    description: Get the Linux system log download links from a collection job result.
    risk: read
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_artifact_filesystem
    name: harfanglab-result-artifact-filesystem
    description: Get the filesystem listing download links from a collection job result.
    risk: read
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_artifact_all
    name: harfanglab-result-artifact-all
    description: Get the download links for all collected artifacts from a collection job result.
    risk: read
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_artifact_downloadfile
    name: harfanglab-result-artifact-downloadfile
    description: Get the download link for a file retrieved by a download-file job result.
    risk: read
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_artifact_ramdump
    name: harfanglab-result-artifact-ramdump
    description: Get the memory (RAM) dump download links from a collection job result.
    risk: read
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
      required: [job_id]
    outputs_schema: { properties: {} }

  # ── Response: process ─────────────────────────────────────────────────────
  - id: kill_process
    name: harfanglab-kill-process
    description: "Kill processes on an endpoint matching a criterion (name, path, pid, hash, command line...). Destructive: matching processes are terminated. Returns the created job; poll with harfanglab-wait-for-job."
    risk: destructive
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
        field: { type: string, description: "Criterion field: name, path, username, commandline, parent_name, parent_path, parent_commandline, pid, md5, sha1, sha256 (default name)" }
        operator: { type: string, description: "Criterion operator: eq, not_eq, contains, not_contains (default eq)" }
        value: { type: string, description: "Criterion value to match" }
      required: [agent_id, value]
    outputs_schema: { properties: {} }
  - id: dump_process
    name: harfanglab-dump-process
    description: "Dump the memory of processes matching a criterion (same criteria as kill-process). Returns the created job."
    risk: safe_write
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
        field: { type: string, description: "Criterion field: name, path, username, commandline, parent_name, parent_path, parent_commandline, pid, md5, sha1, sha256 (default name)" }
        operator: { type: string, description: "Criterion operator: eq, not_eq, contains, not_contains (default eq)" }
        value: { type: string, description: "Criterion value to match" }
      required: [agent_id, value]
    outputs_schema: { properties: {} }
  # ── Response: scans ───────────────────────────────────────────────────────
  - id: av_scan
    name: harfanglab-av-scan
    description: "Start an on-demand antivirus scan on an endpoint (full, quick, or resource with explicit paths). Returns the created job."
    risk: safe_write
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
        scan_type: { type: string, description: "Scan type: full, quick or resource (default quick)" }
        paths: { type: string, description: "Comma-separated paths to scan (required for resource scans)" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: yara_scan
    name: harfanglab-yara-scan
    description: "Start a YARA scan on an endpoint using named YARA sources. Returns the created job."
    risk: safe_write
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
        sources: { type: string, description: "Comma-separated YARA source names" }
        directories: { type: string, description: "Comma-separated directories to scan" }
        scan_filesystem: { type: boolean, description: "Scan the filesystem (default true)" }
        scan_processes: { type: boolean, description: "Scan running processes (default false)" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  # ── Response: remediation ─────────────────────────────────────────────────
  - id: delete_file
    name: harfanglab-delete-file
    description: "Delete a file on an endpoint by full path. Destructive. Returns the created job."
    risk: destructive
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
        filepath: { type: string, description: "Full path of the file to delete on the host" }
      required: [agent_id, filepath]
    outputs_schema: { properties: {} }
  - id: delete_service
    name: harfanglab-delete-service
    description: "Delete a Windows service on an endpoint by service name. Destructive. Returns the created job."
    risk: destructive
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
        service_name: { type: string, description: "Name of the service to delete" }
      required: [agent_id, service_name]
    outputs_schema: { properties: {} }
  - id: delete_scheduled_task
    name: harfanglab-delete-scheduled-task
    description: "Delete a scheduled task on an endpoint by task URI. Destructive. Returns the created job."
    risk: destructive
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
        schtask_uri: { type: string, description: "URI of the scheduled task to delete (e.g. \\Microsoft\\Windows\\...)" }
      required: [agent_id, schtask_uri]
    outputs_schema: { properties: {} }
  # ── Response: quarantine ──────────────────────────────────────────────────
  - id: quarantine_file
    name: harfanglab-quarantine-file
    description: "Move a file on an endpoint into HarfangLab quarantine by full path. Returns the created job."
    risk: safe_write
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
        file_path: { type: string, description: "Full path of the file to quarantine on the host" }
        comment: { type: string, description: "Quarantine comment" }
      required: [agent_id, file_path]
    outputs_schema: { properties: {} }
  - id: unquarantine_file
    name: harfanglab-unquarantine-file
    description: "Restore a quarantined file to its original location on the endpoint. Returns the created job."
    risk: destructive
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
        local_id: { type: string, description: "Quarantined item local UUID (from harfanglab-quarantine-search)" }
        overwrite_existing: { type: boolean, description: "Overwrite an existing file at the original path (default true)" }
      required: [agent_id, local_id]
    outputs_schema: { properties: {} }
  - id: quarantine_search
    name: harfanglab-quarantine-search
    description: "Search quarantined files by hash, hostname or agent. Items include their id; once acquired on the manager the file is downloadable at /api/data/quarantine/item/{id}/download/."
    risk: read
    inputs_schema:
      properties:
        hash: { type: string, description: "File hash (md5, sha1 or sha256 — routed by length)" }
        agent_hostname: { type: string, description: "Endpoint hostname" }
        agent_id: { type: string, description: "Agent unique identifier" }
        search: { type: string, description: "Free-text search term" }
        limit: { type: number, description: "Max results (default 100)" }
        offset: { type: number, description: "Pagination offset (default 0)" }
      required: []
    outputs_schema: { properties: {} }
  - id: quarantine_request_upload
    name: harfanglab-quarantine-request-upload
    description: "Request upload of a quarantined file from the endpoint to the manager (returns the upload job). Once done, download at /api/data/quarantine/item/{id}/download/."
    risk: safe_write
    inputs_schema:
      properties:
        item_id: { type: string, description: "Quarantined item UUID (from harfanglab-quarantine-search)" }
      required: [item_id]
    outputs_schema: { properties: {} }
  # ── Response: threat isolation & job lifecycle ────────────────────────────
  - id: isolate_from_threat
    name: harfanglab-isolate-from-threat
    description: "Network-isolate ALL agents involved in a threat. Destructive: cuts network access on every impacted endpoint."
    risk: destructive
    inputs_schema:
      properties:
        threat_id: { type: string, description: "Threat identifier" }
      required: [threat_id]
    outputs_schema: { properties: {} }
  - id: deisolate_from_threat
    name: harfanglab-deisolate-from-threat
    description: "Remove network isolation from all agents involved in a threat."
    risk: destructive
    inputs_schema:
      properties:
        threat_id: { type: string, description: "Threat identifier" }
      required: [threat_id]
    outputs_schema: { properties: {} }
  - id: job_cancel
    name: harfanglab-job-cancel
    description: "Cancel a running job by job ID."
    risk: safe_write
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID to cancel" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: job_relaunch
    name: harfanglab-job-relaunch
    description: "Relaunch a cancelled or errored job by job ID."
    risk: safe_write
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID to relaunch" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: wait_for_job
    name: harfanglab-wait-for-job
    description: "Poll a job until all its instances finish (done/error/canceled) or the timeout elapses. Returns {done: true|false, job: {...}} — never fails on timeout, so playbooks can branch on done."
    risk: read
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID to wait for" }
        timeout: { type: number, description: "Max seconds to wait (default 300)" }
        interval: { type: number, description: "Seconds between polls (default 10)" }
      required: [job_id]
    outputs_schema: { properties: {} }
  # ── Triage: alerts ────────────────────────────────────────────────────────
  - id: get_alerts
    name: harfanglab-get-alerts
    description: "Search security events (alerts) for playbooks: by IDs, hostname, agent, threat, rule name, level/status/type, date range. Returns {count, results}."
    risk: read
    inputs_schema:
      properties:
        alert_ids: { type: string, description: "Comma-separated alert IDs (fetched individually; other filters ignored)" }
        hostname: { type: string, description: "Endpoint hostname" }
        agent_id: { type: string, description: "Agent unique identifier" }
        threat_id: { type: string, description: "Threat id — alerts aggregated under this threat (one page; threat_security_events fetches them all)" }
        rule_name: { type: string, description: "Detection rule name" }
        level: { type: string, description: "Comma-separated severities (low, medium, high, critical)" }
        status: { type: string, description: "Comma-separated statuses (new, investigating, closed, false_positive)" }
        alert_type: { type: string, description: "Comma-separated alert types (sigma, yara, hlai, vt, ransom, ioc...)" }
        from_date: { type: string, description: "ISO8601 lower bound on alert_time" }
        to_date: { type: string, description: "ISO8601 upper bound on alert_time" }
        search: { type: string, description: "Free-text search term" }
        ordering: { type: string, description: "Sort field (default -alert_time)" }
        limit: { type: number, description: "Max results (default 100)" }
        offset: { type: number, description: "Pagination offset (default 0)" }
      required: []
    outputs_schema: { properties: {} }
    ingest:
      results_path: results
      dedup_key: id
      incremental_field: from_date
  - id: alert_tag
    name: harfanglab-alert-tag
    description: "Change the status of one or more alerts in bulk (new, investigating, false_positive, closed), optionally with a comment."
    risk: safe_write
    inputs_schema:
      properties:
        alert_ids: { type: string, description: "Comma-separated alert IDs" }
        new_status:
          type: string
          description: "New status of the alerts."
          enum: [new, investigating, false_positive, closed]
        new_comment: { type: string, description: "Optional comment attached to the status change" }
      required: [alert_ids, new_status]
    outputs_schema: { properties: {} }
  - id: alert_comment
    name: harfanglab-alert-comment
    description: "Add a comment to a security event (alert)."
    risk: safe_write
    inputs_schema:
      properties:
        alert_id: { type: string, description: "Alert ID" }
        comment: { type: string, description: "Comment text" }
      required: [alert_id, comment]
    outputs_schema: { properties: {} }
  - id: alert_details
    name: harfanglab-alert-details
    description: "Get the full details of an alert (raw Sigma/YARA rule, binary availability, process unique id...)."
    risk: read
    inputs_schema:
      properties:
        alert_id: { type: string, description: "Alert ID" }
      required: [alert_id]
    outputs_schema: { properties: {} }
  - id: alert_history
    name: harfanglab-alert-history
    description: "Get the status-change history of an alert."
    risk: read
    inputs_schema:
      properties:
        alert_id: { type: string, description: "Alert ID" }
      required: [alert_id]
    outputs_schema: { properties: {} }
  # ── Triage: threats ───────────────────────────────────────────────────────
  - id: get_threat
    name: harfanglab-get-threat
    description: "Get a single threat by ID."
    risk: read
    inputs_schema:
      properties:
        threat_id: { type: string, description: "Threat identifier" }
      required: [threat_id]
    outputs_schema: { properties: {} }
  - id: threat_security_events
    name: harfanglab-get-threat-security-events
    description: "Fetch every security event (alert) of a threat, paging through them. Returns {threat_id, count, total, truncated, results}."
    risk: read
    inputs_schema:
      properties:
        threat_id: { type: string, description: "Threat identifier" }
        status: { type: string, description: "Comma-separated statuses to keep (new, probable_false_positive, investigating, false_positive, closed); all when empty" }
        level: { type: string, description: "Comma-separated severities to keep (low, medium, high, critical); all when empty" }
        max_results: { type: number, description: "Maximum number of events to return (default 1000); truncated is true when the threat has more" }
      required: [threat_id]
    outputs_schema: { properties: {} }
  - id: threat_status
    name: harfanglab-threat-status
    description: "Update a threat's status — take it into investigation, close it, or mark it a false positive (HarfangLab's only verdict) — optionally propagating to its security events."
    risk: safe_write
    inputs_schema:
      properties:
        threat_ids: { type: string, description: "Comma-separated threat IDs" }
        new_status:
          type: string
          description: "New status. false_positive is the verdict HarfangLab records; closed ends the threat as handled."
          enum: [new, investigating, false_positive, closed]
        tag_security_events: { type: boolean, description: "Also apply the status to the threat's security events (default false)" }
      required: [threat_ids, new_status]
    outputs_schema: { properties: {} }
  - id: threat_level
    name: harfanglab-threat-level
    description: "Change the severity level of one or more threats (low, medium, high, critical)."
    risk: safe_write
    inputs_schema:
      properties:
        threat_ids: { type: string, description: "Comma-separated threat IDs" }
        new_level:
          type: string
          description: "New severity level."
          enum: [low, medium, high, critical]
      required: [threat_ids, new_level]
    outputs_schema: { properties: {} }
  - id: threat_comment
    name: harfanglab-threat-comment
    description: "Add a comment to a threat."
    risk: safe_write
    inputs_schema:
      properties:
        threat_id: { type: string, description: "Threat identifier" }
        comment: { type: string, description: "Comment text" }
      required: [threat_id, comment]
    outputs_schema: { properties: {} }
  - id: threat_note_set
    name: harfanglab-threat-note-set
    description: "Create or update the analyst note of a threat (title + content). Upserts: creates the note, or replaces it if one exists."
    risk: safe_write
    inputs_schema:
      properties:
        threat_id: { type: string, description: "Threat identifier" }
        title: { type: string, description: "Note title" }
        content: { type: string, description: "Note content" }
      required: [threat_id, title, content]
    outputs_schema: { properties: {} }
  - id: threat_history
    name: harfanglab-threat-history
    description: "Get the status-change history of a threat."
    risk: read
    inputs_schema:
      properties:
        threat_id: { type: string, description: "Threat identifier" }
      required: [threat_id]
    outputs_schema: { properties: {} }

  # ── Connectivity test ─────────────────────────────────────────────────────
  - id: test_connection
    name: harfanglab-test-connection
    description: "Verify connectivity and credentials (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }

ingestion:
  command: get_threats
  mapper: get_threats
  default_incident_type: "HarfangLab Threat"