riposte-marketplace/integrations/harfanglab/manifest.yaml

id: harfanglab
name: HarfangLab EDR
version: 1.2.2
description: "HarfangLab EDR — endpoint detection & response: alert/threat ingestion, endpoint enrichment, isolation, threat-intelligence (IOC/whitelist), telemetry hunting and forensic collection jobs."
changelog: "1.2.2 — Documentation wording cleanup. 1.2.1 — Corrected the get_threats OCSF mapper to native threat fields (top_agents/top_impacted_users/top_rules/mitre_tactics) instead of enriched-only arrays; added agent.osversion to get_security_events. 1.2.0 — Added ingestion commands get_security_events (alerts) and get_threats with bundled OCSF mappers and ingest hints (results_path/dedup/incremental). 1.1.1 — Added test_connection for the instance Test button. 1.1.0 — Command names prefixed with 'harfanglab-' (e.g. harfanglab-isolate-endpoint) for easier toolbox search; command IDs unchanged. 1.0.0 — Initial release: endpoint/agent management, isolation, policy assignment, IOC & whitelist management, security-event triage, telemetry hunting (processes, network, DNS, authentications, binaries, event logs), threat hunting by hash, and forensic collection jobs (pipes, prefetch, run keys, scheduled tasks, drivers, services, processes, network, sessions, WMI, IOC scan, artifacts, RAM dump) with their result retrieval commands. Compatible with HarfangLab EDR 2.13.7+."
category: endpoint

# Per-instance configuration. Scripts use <url> as the API base and call /api/... paths.
config_schema:
  properties:
    url:
      type: string
      description: HarfangLab EDR Manager URL, e.g. https://my-edr.example.com
    api_token:
      type: string
      description: API key (HarfangLab EDR → user settings → API key)
      x-soar-sensitive: true
  required:
    - url
    - api_token

# Documented for reference; the bundled scripts build the header themselves
# (Authorization: Token <token>).
auth:
  - id: apitoken
    type: api_key
    in: header
    name: Authorization
    value_template: "Token {{secret}}"
    secret_field: api_token

commands:
  # ── Alerts & threats (ingestion) ──────────────────────────────────────────
  - id: get_security_events
    name: harfanglab-get-security-events
    description: "Fetch HarfangLab EDR security events (alerts) for ingestion. Returns {results: [...]} — use results as the alert rule results path."
    risk: read
    inputs_schema:
      properties:
        min_severity: { type: string, description: "Minimum severity to fetch: low, medium, high, critical" }
        status: { type: string, description: "Comma-separated statuses (new, investigating, closed, false_positive)" }
        alert_type: { type: string, description: "Comma-separated alert types (sigma, yara, hlai, vt, ransom, ioc, glimps, orion...)" }
        created_after: { type: string, description: "ISO8601 lower bound on alert_time (incremental fetch watermark)" }
        limit: { type: number, description: "Maximum number of events to fetch" }
      required: []
    outputs_schema: { properties: {} }
    ingest:
      results_path: results
      dedup_key: id
      incremental_field: created_after
  - id: get_threats
    name: harfanglab-get-threats
    description: "Fetch HarfangLab EDR threats (aggregated security events) for ingestion. Returns {results: [...]} enriched with agents/impacted_users/rules."
    risk: read
    inputs_schema:
      properties:
        min_severity: { type: string, description: "Minimum severity to fetch: low, medium, high, critical" }
        status: { type: string, description: "Comma-separated statuses (new, investigating, closed, false_positive)" }
        created_after: { type: string, description: "ISO8601 lower bound on creation_date (incremental fetch watermark)" }
        limit: { type: number, description: "Maximum number of threats to fetch" }
      required: []
    outputs_schema: { properties: {} }
    ingest:
      results_path: results
      dedup_key: id
      incremental_field: created_after
  # ── Endpoints / agents ────────────────────────────────────────────────────
  - id: get_endpoint_info
    name: harfanglab-get-endpoint-info
    description: Get endpoint (agent) information by agent ID.
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: endpoint_search
    name: harfanglab-endpoint-search
    description: Search endpoints (agents) by hostname.
    inputs_schema:
      properties:
        hostname: { type: string, description: "Hostname to filter agents by" }
      required: []
    outputs_schema: { properties: {} }
  - id: isolate_endpoint
    name: harfanglab-isolate-endpoint
    description: Network-isolate an endpoint (agent) by agent ID.
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: deisolate_endpoint
    name: harfanglab-deisolate-endpoint
    description: Remove network isolation from an endpoint (agent) by agent ID.
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: assign_policy_to_agent
    name: harfanglab-assign-policy-to-agent
    description: Assign a security policy to an agent by policy name and agent ID.
    inputs_schema:
      properties:
        policy: { type: string, description: "Name of the policy to assign" }
        agentid: { type: string, description: "Agent unique identifier to assign the policy to" }
      required: [policy, agentid]
    outputs_schema: { properties: {} }

  # ── Threat intelligence: whitelists ───────────────────────────────────────
  - id: whitelist_search
    name: harfanglab-whitelist-search
    description: Search threat-intelligence whitelists by keyword.
    inputs_schema:
      properties:
        keyword: { type: string, description: "Keyword to search" }
        provided_by_hlab: { type: boolean, description: "Search HarfangLab-provided whitelists" }
      required: []
    outputs_schema: { properties: {} }
  - id: whitelist_add
    name: harfanglab-whitelist-add
    description: Create a threat-intelligence whitelist rule with an initial criterion.
    inputs_schema:
      properties:
        comment: { type: string, description: "Whitelist comment" }
        target: { type: string, description: "Whitelist target (e.g. all)" }
        sigma_rule_id: { type: string, description: "Associated sigma rule id" }
        field: { type: string, description: "Criterion field" }
        case_insensitive: { type: boolean, description: "Match field value case-insensitively" }
        operator: { type: string, description: "Criterion operator (e.g. eq)" }
        value: { type: string, description: "Criterion value" }
      required: []
    outputs_schema: { properties: {} }
  - id: whitelist_add_criterion
    name: harfanglab-whitelist-add-criterion
    description: Append a criterion to an existing whitelist rule.
    inputs_schema:
      properties:
        id: { type: string, description: "Whitelist rule id" }
        field: { type: string, description: "Criterion field" }
        case_insensitive: { type: boolean, description: "Match field value case-insensitively" }
        operator: { type: string, description: "Criterion operator (e.g. eq)" }
        value: { type: string, description: "Criterion value" }
      required: [id]
    outputs_schema: { properties: {} }
  - id: whitelist_delete
    name: harfanglab-whitelist-delete
    description: Delete a threat-intelligence whitelist rule by id.
    inputs_schema:
      properties:
        id: { type: string, description: "Whitelist rule id" }
      required: [id]
    outputs_schema: { properties: {} }

  # ── Threat intelligence: IOCs ─────────────────────────────────────────────
  - id: add_ioc_to_source
    name: harfanglab-add-ioc-to-source
    description: Add an IOC to a named IOC source if it does not already exist.
    inputs_schema:
      properties:
        ioc_value: { type: string, description: "IOC value" }
        ioc_type: { type: string, description: "IOC type" }
        ioc_comment: { type: string, description: "IOC comment" }
        ioc_status: { type: string, description: "IOC status (e.g. testing, detection, blocking)" }
        source_name: { type: string, description: "IOC source name" }
      required: [ioc_value, ioc_type, ioc_status, source_name]
    outputs_schema: { properties: {} }
  - id: delete_ioc_from_source
    name: harfanglab-delete-ioc-from-source
    description: Remove an IOC from a named IOC source if it exists.
    inputs_schema:
      properties:
        ioc_value: { type: string, description: "IOC value" }
        source_name: { type: string, description: "IOC source name" }
      required: [ioc_value, source_name]
    outputs_schema: { properties: {} }

  # ── Security events ───────────────────────────────────────────────────────
  - id: change_security_event_status
    name: harfanglab-change-security-event-status
    description: "Change the status of a security event (New, Investigating, False Positive, Closed)."
    inputs_schema:
      properties:
        security_event_id: { type: string, description: "Security event ID" }
        status: { type: string, description: "New | Investigating | False Positive | Closed" }
      required: [security_event_id, status]
    outputs_schema: { properties: {} }

  # ── Generic / utility ─────────────────────────────────────────────────────
  - id: api_call
    name: harfanglab-api-call
    description: "Perform a generic authenticated call to the HarfangLab API."
    inputs_schema:
      properties:
        api_method: { type: string, description: "HTTP method (GET, POST, PUT, DELETE, PATCH)" }
        api_endpoint: { type: string, description: "API endpoint path beginning with /api/" }
        parameters: { type: string, description: "Query string parameters in key=value&key=value form" }
        data: { type: string, description: "JSON-encoded request body" }
      required: []
    outputs_schema: { properties: {} }
  - id: telemetry_process_graph
    name: harfanglab-telemetry-process-graph
    description: "Retrieve the process graph for a telemetry process UUID."
    inputs_schema:
      properties:
        process_uuid: { type: string, description: "Telemetry process UUID" }
      required: [process_uuid]
    outputs_schema: { properties: {} }

  # ── Threat hunting by hash ────────────────────────────────────────────────
  - id: hunt_search_hash
    name: harfanglab-hunt-search-hash
    description: "Search the data explorer for a file hash."
    inputs_schema:
      properties:
        hash: { type: string, description: "File hash to search for" }
      required: [hash]
    outputs_schema: { properties: {} }
  - id: hunt_search_running_process_hash
    name: harfanglab-hunt-search-running-process-hash
    description: "Hunt for currently running processes matching a SHA-256 hash."
    inputs_schema:
      properties:
        hash: { type: string, description: "SHA-256 hash to search for" }
      required: [hash]
    outputs_schema: { properties: {} }
  - id: hunt_search_runned_process_hash
    name: harfanglab-hunt-search-runned-process-hash
    description: "Search process telemetry for executions matching a SHA-256 hash."
    inputs_schema:
      properties:
        hash: { type: string, description: "SHA-256 hash to search for" }
      required: [hash]
    outputs_schema: { properties: {} }

  # ── Telemetry ─────────────────────────────────────────────────────────────
  - id: telemetry_processes
    name: harfanglab-telemetry-processes
    description: Search process telemetry.
    inputs_schema:
      properties:
        hash: { type: string, description: "File hash (md5, sha1 or sha256)" }
        hostname: { type: string, description: "Endpoint hostname" }
        from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
        to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
        limit: { type: number, description: "Max elements (default 100)" }
      required: []
    outputs_schema: { properties: {} }
  - id: telemetry_dns
    name: harfanglab-telemetry-dns
    description: Search DNS resolution telemetry.
    inputs_schema:
      properties:
        hostname: { type: string, description: "Endpoint hostname" }
        requested_name: { type: string, description: "Requested DNS name" }
        query_type: { type: string, description: "DNS query type" }
        from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
        to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
        limit: { type: number, description: "Max elements (default 100)" }
      required: []
    outputs_schema: { properties: {} }
  - id: telemetry_network
    name: harfanglab-telemetry-network
    description: Search network connection telemetry.
    inputs_schema:
      properties:
        hostname: { type: string, description: "Endpoint hostname" }
        source_address: { type: string, description: "Source IP address" }
        source_port: { type: number, description: "Source port" }
        destination_address: { type: string, description: "Destination IP address" }
        destination_port: { type: number, description: "Destination port" }
        from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
        to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
        limit: { type: number, description: "Max elements (default 100)" }
      required: []
    outputs_schema: { properties: {} }
  - id: telemetry_eventlog
    name: harfanglab-telemetry-eventlog
    description: Search Windows full event log telemetry.
    inputs_schema:
      properties:
        hostname: { type: string, description: "Endpoint hostname" }
        event_id: { type: number, description: "Windows event ID" }
        from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
        to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
        limit: { type: number, description: "Max elements (default 100)" }
      required: []
    outputs_schema: { properties: {} }
  - id: telemetry_binary
    name: harfanglab-telemetry-binary
    description: Search binary telemetry.
    inputs_schema:
      properties:
        hash: { type: string, description: "File hash (md5, sha1 or sha256)" }
        from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
        to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
        limit: { type: number, description: "Max elements (default 100)" }
      required: []
    outputs_schema: { properties: {} }
  - id: telemetry_authentication_windows
    name: harfanglab-telemetry-authentication-windows
    description: Search Windows authentication telemetry.
    inputs_schema:
      properties:
        hostname: { type: string, description: "Endpoint hostname" }
        source_address: { type: string, description: "Source IP address" }
        success: { type: boolean, description: "Authentication success" }
        source_username: { type: string, description: "Source username" }
        target_username: { type: string, description: "Target username" }
        logon_title: { type: string, description: "Windows logon title" }
        logon_type: { type: number, description: "Windows logon type" }
        from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
        to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
        limit: { type: number, description: "Max elements (default 100)" }
      required: []
    outputs_schema: { properties: {} }
  - id: telemetry_authentication_linux
    name: harfanglab-telemetry-authentication-linux
    description: Search Linux authentication telemetry.
    inputs_schema:
      properties:
        hostname: { type: string, description: "Endpoint hostname" }
        source_address: { type: string, description: "Source IP address" }
        success: { type: boolean, description: "Authentication success" }
        source_username: { type: string, description: "Source username" }
        target_username: { type: string, description: "Target username" }
        from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
        to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
        limit: { type: number, description: "Max elements (default 100)" }
      required: []
    outputs_schema: { properties: {} }
  - id: telemetry_authentication_macos
    name: harfanglab-telemetry-authentication-macos
    description: Search macOS authentication telemetry.
    inputs_schema:
      properties:
        hostname: { type: string, description: "Endpoint hostname" }
        source_address: { type: string, description: "Source IP address" }
        success: { type: boolean, description: "Authentication success" }
        source_username: { type: string, description: "Source username" }
        target_username: { type: string, description: "Target username" }
        from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
        to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
        limit: { type: number, description: "Max elements (default 100)" }
      required: []
    outputs_schema: { properties: {} }
  - id: telemetry_authentication_users
    name: harfanglab-telemetry-authentication-users
    description: Rank users by authentication attempts across Windows, Linux and macOS.
    inputs_schema:
      properties:
        hostname: { type: string, description: "Endpoint hostname" }
        from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
        to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
        limit: { type: number, description: "Max users to return (default 3)" }
      required: [hostname]
    outputs_schema: { properties: {} }

  # ── Collection jobs ───────────────────────────────────────────────────────
  - id: job_pipelist
    name: harfanglab-job-pipelist
    description: Start a job to list named pipes on a host (Windows).
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_prefetchlist
    name: harfanglab-job-prefetchlist
    description: Start a job to collect Windows prefetch files on a host.
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_runkeylist
    name: harfanglab-job-runkeylist
    description: Start a job to collect registry run keys (hives) on a host.
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_scheduledtasklist
    name: harfanglab-job-scheduledtasklist
    description: Start a job to list scheduled tasks on a host.
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_driverlist
    name: harfanglab-job-driverlist
    description: Start a job to list loaded drivers on a host.
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_servicelist
    name: harfanglab-job-servicelist
    description: Start a job to collect services from registry hives on a host.
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_processlist
    name: harfanglab-job-processlist
    description: Start a job to list running processes with signature info on a host.
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_networkconnectionlist
    name: harfanglab-job-networkconnectionlist
    description: Start a job to list processes with their active network connections on a host.
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_networksharelist
    name: harfanglab-job-networksharelist
    description: Start a job to list network shares on a host.
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_sessionlist
    name: harfanglab-job-sessionlist
    description: Start a job to list active user sessions on a host.
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_persistencelist
    name: harfanglab-job-persistencelist
    description: Start a job to scan for persistence mechanisms on a host.
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_startuplist
    name: harfanglab-job-startuplist
    description: Start a job to list startup files on a host.
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_wmilist
    name: harfanglab-job-wmilist
    description: Start a job to collect WMI persistence artifacts on a host.
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_ioc
    name: harfanglab-job-ioc
    description: Start an IOC scan job on a host using filename, filepath, hash, registry, or regex indicators.
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
        filename: { type: string, description: "Filename to search for" }
        filepath: { type: string, description: "File path to search for" }
        hash: { type: string, description: "File hash to search for (MD5, SHA-1 or SHA-256)" }
        search_in_path: { type: string, description: "Restrict the search to this path" }
        filesize: { type: string, description: "File size in bytes associated with the filename indicator" }
        hash_filesize: { type: string, description: "File size in bytes associated with the hash indicator" }
        registry: { type: string, description: "Registry key or value to search for" }
        filepath_regex: { type: string, description: "Regular expression to match file paths" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_info
    name: harfanglab-job-info
    description: Retrieve information for one or more jobs by their identifiers.
    inputs_schema:
      properties:
        ids: { type: string, description: "Comma-separated list of job IDs to retrieve" }
      required: [ids]
    outputs_schema: { properties: {} }

  # ── Forensic artifact collection jobs ─────────────────────────────────────
  - id: job_artifact_mft
    name: harfanglab-job-artifact-mft
    description: Start a job to collect the NTFS Master File Table (MFT) from a host (Windows).
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_artifact_hives
    name: harfanglab-job-artifact-hives
    description: Start a job to collect the Windows registry hives from a host.
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_artifact_evtx
    name: harfanglab-job-artifact-evtx
    description: Start a job to collect the Windows event logs (EVTX) from a host.
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_artifact_logs
    name: harfanglab-job-artifact-logs
    description: Start a job to collect the system logs from a host.
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_artifact_filesystem
    name: harfanglab-job-artifact-filesystem
    description: Start a job to collect the filesystem listing from a host.
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_artifact_all
    name: harfanglab-job-artifact-all
    description: Start a job to collect all raw forensic evidence (hives, event logs, MFT, prefetch, USN journal, logs, filesystem) from a host.
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_artifact_ramdump
    name: harfanglab-job-artifact-ramdump
    description: Start a job to capture a full memory (RAM) dump from a host.
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
      required: [agent_id]
    outputs_schema: { properties: {} }
  - id: job_artifact_downloadfile
    name: harfanglab-job-artifact-downloadfile
    description: Start a job to download a specific file from a host by its full path.
    inputs_schema:
      properties:
        agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
        filename: { type: string, description: "Full path of the file to download from the host" }
      required: [agent_id, filename]
    outputs_schema: { properties: {} }

  # ── Job results (hunting) ─────────────────────────────────────────────────
  - id: result_pipelist
    name: harfanglab-result-pipelist
    description: Get a host's list of named pipes from a job result.
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_prefetchlist
    name: harfanglab-result-prefetchlist
    description: Get a host's prefetch entries from a job result.
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_runkeylist
    name: harfanglab-result-runkeylist
    description: Get a host's registry run keys from a job result.
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_scheduledtasklist
    name: harfanglab-result-scheduledtasklist
    description: Get a host's scheduled tasks from a job result.
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_driverlist
    name: harfanglab-result-driverlist
    description: Get a host's list of drivers from a job result.
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_servicelist
    name: harfanglab-result-servicelist
    description: Get a host's list of services from a job result.
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_processlist
    name: harfanglab-result-processlist
    description: Get a host's list of running processes from a job result.
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_networkconnectionlist
    name: harfanglab-result-networkconnectionlist
    description: Get a host's network connections from a job result.
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_networksharelist
    name: harfanglab-result-networksharelist
    description: Get a host's list of network shares from a job result.
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_sessionlist
    name: harfanglab-result-sessionlist
    description: Get a host's list of user sessions from a job result.
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_persistencelist
    name: harfanglab-result-persistencelist
    description: Get a host's persistence files from a job result.
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_startuplist
    name: harfanglab-result-startuplist
    description: Get a host's startup items from a job result.
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_wmilist
    name: harfanglab-result-wmilist
    description: Get a host's WMI persistence entries from a job result.
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_ioc
    name: harfanglab-result-ioc
    description: Get a host's IOC matches from a job result.
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching job command" }
      required: [job_id]
    outputs_schema: { properties: {} }

  # ── Job results (forensic artifacts) ──────────────────────────────────────
  - id: result_artifact_mft
    name: harfanglab-result-artifact-mft
    description: Get the MFT download links from a collection job result.
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_artifact_hives
    name: harfanglab-result-artifact-hives
    description: Get the Windows registry hive download links from a collection job result.
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_artifact_evtx
    name: harfanglab-result-artifact-evtx
    description: Get the Windows event log (EVTX) download links from a collection job result.
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_artifact_logs
    name: harfanglab-result-artifact-logs
    description: Get the Linux system log download links from a collection job result.
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_artifact_filesystem
    name: harfanglab-result-artifact-filesystem
    description: Get the filesystem listing download links from a collection job result.
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_artifact_all
    name: harfanglab-result-artifact-all
    description: Get the download links for all collected artifacts from a collection job result.
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_artifact_downloadfile
    name: harfanglab-result-artifact-downloadfile
    description: Get the download link for a file retrieved by a download-file job result.
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
      required: [job_id]
    outputs_schema: { properties: {} }
  - id: result_artifact_ramdump
    name: harfanglab-result-artifact-ramdump
    description: Get the memory (RAM) dump download links from a collection job result.
    inputs_schema:
      properties:
        job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
      required: [job_id]
    outputs_schema: { properties: {} }

  # ── Connectivity test ─────────────────────────────────────────────────────
  - id: test_connection
    name: harfanglab-test-connection
    description: "Verify connectivity and credentials (used by the Test button)."
    risk: read
    inputs_schema:
      properties: {}
      required: []
    outputs_schema: { properties: {} }