f3nris
f7c5e99cc5
Replayed a real get_alerts and a real get_threats response through the bundled mappers to see what came out. get_alerts: a sigma alert matching a Windows event log carries the whole record under `eventlog`, and none of it was mapped. On a Defender 1116 detection that left the malware, the file, the acting user and the detecting product invisible — the incident indexed a hostname and nothing else. The event data uses the provider's own field names, spaces included, so the new entries quote them with JSONata backticks, and Defender's "file:_" path prefix is stripped. Also added the agent IP (placed before details_connection.SourceIp so a network alert's own source still wins), the DNS domain, device type, agent version and groups, the tenant, the alert subtype and threat type, the string severity and the event time. get_threats: `level` had no entry at all, so a threat's severity never reached the OCSF document even though field_mappings derived the incident's 1-5 from it. Added it, the event time, and the top agent's reachability — whether the endpoint is online decides what response is possible, and it was excluded without a reason. Both trailers now record why each remaining field is left out, and the event log's own SYSTEM writer and FQDN spelling are called out: indexing them would create a junk user entity and a second spelling of one host. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
1053 lines
53 KiB
YAML
1053 lines
53 KiB
YAML
id: harfanglab
|
|
name: HarfangLab EDR
|
|
version: 1.4.0
|
|
description: "HarfangLab EDR — endpoint detection & response: alert/threat ingestion, endpoint enrichment, isolation, threat-intelligence (IOC/whitelist), telemetry hunting and forensic collection jobs."
|
|
changelog: "1.4.0 — Mapper coverage from real payloads: get_alerts now maps the Windows event-log payload sigma alerts carry (alert_subtype = eventlog), which was entirely unmapped — Defender 1116/1117 yields the malware name, classification, severity and provider, the detected file, the process that touched it and the acting user, plus the log provider and event code. Also added the agent IP, DNS domain, device type, agent version and groups, the tenant, the alert subtype and threat type, the string severity and the event time. get_threats gained the threat level (previously never reaching the OCSF document at all), the event time and the top agent's reachability. 1.3.1 — Flagged get_alerts as ingestion-ready (ingest hints: results_path/dedup/incremental on from_date) so it appears in the recommended ingestion commands when creating an instance. 1.3.0 — Response & triage expansion: kill/dump process, on-demand AV/YARA scans, file/service/scheduled-task deletion, quarantine management, threat-level isolation, job cancel/relaunch/wait; alert search (get_alerts) and full alert/threat triage (tag, comments, notes, status, level, history, details); exhaustive alert OCSF mappers; reworked get_threats mapper (fixed MITRE tactics map handling, full top-agent/user/rule and counts coverage, rule-based incident title/description). 1.2.2 — Documentation wording cleanup. 1.2.1 — Corrected the get_threats OCSF mapper to native threat fields (top_agents/top_impacted_users/top_rules/mitre_tactics) instead of enriched-only arrays; added agent.osversion to get_security_events. 1.2.0 — Added ingestion commands get_security_events (alerts) and get_threats with bundled OCSF mappers and ingest hints (results_path/dedup/incremental). 1.1.1 — Added test_connection for the instance Test button. 1.1.0 — Command names prefixed with 'harfanglab-' (e.g. harfanglab-isolate-endpoint) for easier toolbox search; command IDs unchanged. 1.0.0 — Initial release: endpoint/agent management, isolation, policy assignment, IOC & whitelist management, security-event triage, telemetry hunting (processes, network, DNS, authentications, binaries, event logs), threat hunting by hash, and forensic collection jobs (pipes, prefetch, run keys, scheduled tasks, drivers, services, processes, network, sessions, WMI, IOC scan, artifacts, RAM dump) with their result retrieval commands. Compatible with HarfangLab EDR 2.13.7+."
|
|
category: endpoint
|
|
|
|
# Per-instance configuration. Scripts use <url> as the API base and call /api/... paths.
|
|
config_schema:
|
|
properties:
|
|
url:
|
|
type: string
|
|
description: HarfangLab EDR Manager URL, e.g. https://my-edr.example.com
|
|
api_token:
|
|
type: string
|
|
description: API key (HarfangLab EDR → user settings → API key)
|
|
x-soar-sensitive: true
|
|
required:
|
|
- url
|
|
- api_token
|
|
|
|
# Documented for reference; the bundled scripts build the header themselves
|
|
# (Authorization: Token <token>).
|
|
auth:
|
|
- id: apitoken
|
|
type: api_key
|
|
in: header
|
|
name: Authorization
|
|
value_template: "Token {{secret}}"
|
|
secret_field: api_token
|
|
|
|
commands:
|
|
# ── Alerts & threats (ingestion) ──────────────────────────────────────────
|
|
- id: get_security_events
|
|
name: harfanglab-get-security-events
|
|
description: "Fetch HarfangLab EDR security events (alerts) for ingestion. Returns {results: [...]} — use results as the alert rule results path."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
min_severity: { type: string, description: "Minimum severity to fetch: low, medium, high, critical" }
|
|
status: { type: string, description: "Comma-separated statuses (new, investigating, closed, false_positive)" }
|
|
alert_type: { type: string, description: "Comma-separated alert types (sigma, yara, hlai, vt, ransom, ioc, glimps, orion...)" }
|
|
created_after: { type: string, description: "ISO8601 lower bound on alert_time (incremental fetch watermark)" }
|
|
limit: { type: number, description: "Maximum number of events to fetch" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
ingest:
|
|
results_path: results
|
|
dedup_key: id
|
|
incremental_field: created_after
|
|
- id: get_threats
|
|
name: harfanglab-get-threats
|
|
description: "Fetch HarfangLab EDR threats (aggregated security events) for ingestion. Returns {results: [...]} enriched with agents/impacted_users/rules."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
min_severity: { type: string, description: "Minimum severity to fetch: low, medium, high, critical" }
|
|
status: { type: string, description: "Comma-separated statuses (new, investigating, closed, false_positive)" }
|
|
created_after: { type: string, description: "ISO8601 lower bound on creation_date (incremental fetch watermark)" }
|
|
limit: { type: number, description: "Maximum number of threats to fetch" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
ingest:
|
|
results_path: results
|
|
dedup_key: id
|
|
incremental_field: created_after
|
|
# ── Endpoints / agents ────────────────────────────────────────────────────
|
|
- id: get_endpoint_info
|
|
name: harfanglab-get-endpoint-info
|
|
description: Get endpoint (agent) information by agent ID.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: endpoint_search
|
|
name: harfanglab-endpoint-search
|
|
description: Search endpoints (agents) by hostname.
|
|
inputs_schema:
|
|
properties:
|
|
hostname: { type: string, description: "Hostname to filter agents by" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: isolate_endpoint
|
|
name: harfanglab-isolate-endpoint
|
|
description: Network-isolate an endpoint (agent) by agent ID.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: deisolate_endpoint
|
|
name: harfanglab-deisolate-endpoint
|
|
description: Remove network isolation from an endpoint (agent) by agent ID.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: assign_policy_to_agent
|
|
name: harfanglab-assign-policy-to-agent
|
|
description: Assign a security policy to an agent by policy name and agent ID.
|
|
inputs_schema:
|
|
properties:
|
|
policy: { type: string, description: "Name of the policy to assign" }
|
|
agentid: { type: string, description: "Agent unique identifier to assign the policy to" }
|
|
required: [policy, agentid]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Threat intelligence: whitelists ───────────────────────────────────────
|
|
- id: whitelist_search
|
|
name: harfanglab-whitelist-search
|
|
description: Search threat-intelligence whitelists by keyword.
|
|
inputs_schema:
|
|
properties:
|
|
keyword: { type: string, description: "Keyword to search" }
|
|
provided_by_hlab: { type: boolean, description: "Search HarfangLab-provided whitelists" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: whitelist_add
|
|
name: harfanglab-whitelist-add
|
|
description: Create a threat-intelligence whitelist rule with an initial criterion.
|
|
inputs_schema:
|
|
properties:
|
|
comment: { type: string, description: "Whitelist comment" }
|
|
target: { type: string, description: "Whitelist target (e.g. all)" }
|
|
sigma_rule_id: { type: string, description: "Associated sigma rule id" }
|
|
field: { type: string, description: "Criterion field" }
|
|
case_insensitive: { type: boolean, description: "Match field value case-insensitively" }
|
|
operator: { type: string, description: "Criterion operator (e.g. eq)" }
|
|
value: { type: string, description: "Criterion value" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: whitelist_add_criterion
|
|
name: harfanglab-whitelist-add-criterion
|
|
description: Append a criterion to an existing whitelist rule.
|
|
inputs_schema:
|
|
properties:
|
|
id: { type: string, description: "Whitelist rule id" }
|
|
field: { type: string, description: "Criterion field" }
|
|
case_insensitive: { type: boolean, description: "Match field value case-insensitively" }
|
|
operator: { type: string, description: "Criterion operator (e.g. eq)" }
|
|
value: { type: string, description: "Criterion value" }
|
|
required: [id]
|
|
outputs_schema: { properties: {} }
|
|
- id: whitelist_delete
|
|
name: harfanglab-whitelist-delete
|
|
description: Delete a threat-intelligence whitelist rule by id.
|
|
inputs_schema:
|
|
properties:
|
|
id: { type: string, description: "Whitelist rule id" }
|
|
required: [id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Threat intelligence: IOCs ─────────────────────────────────────────────
|
|
- id: add_ioc_to_source
|
|
name: harfanglab-add-ioc-to-source
|
|
description: Add an IOC to a named IOC source if it does not already exist.
|
|
inputs_schema:
|
|
properties:
|
|
ioc_value: { type: string, description: "IOC value" }
|
|
ioc_type: { type: string, description: "IOC type" }
|
|
ioc_comment: { type: string, description: "IOC comment" }
|
|
ioc_status: { type: string, description: "IOC status (e.g. testing, detection, blocking)" }
|
|
source_name: { type: string, description: "IOC source name" }
|
|
required: [ioc_value, ioc_type, ioc_status, source_name]
|
|
outputs_schema: { properties: {} }
|
|
- id: delete_ioc_from_source
|
|
name: harfanglab-delete-ioc-from-source
|
|
description: Remove an IOC from a named IOC source if it exists.
|
|
inputs_schema:
|
|
properties:
|
|
ioc_value: { type: string, description: "IOC value" }
|
|
source_name: { type: string, description: "IOC source name" }
|
|
required: [ioc_value, source_name]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Security events ───────────────────────────────────────────────────────
|
|
- id: change_security_event_status
|
|
name: harfanglab-change-security-event-status
|
|
description: "Change the status of a security event (New, Investigating, False Positive, Closed)."
|
|
inputs_schema:
|
|
properties:
|
|
security_event_id: { type: string, description: "Security event ID" }
|
|
status: { type: string, description: "New | Investigating | False Positive | Closed" }
|
|
required: [security_event_id, status]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Generic / utility ─────────────────────────────────────────────────────
|
|
- id: api_call
|
|
name: harfanglab-api-call
|
|
description: "Perform a generic authenticated call to the HarfangLab API."
|
|
inputs_schema:
|
|
properties:
|
|
api_method: { type: string, description: "HTTP method (GET, POST, PUT, DELETE, PATCH)" }
|
|
api_endpoint: { type: string, description: "API endpoint path beginning with /api/" }
|
|
parameters: { type: string, description: "Query string parameters in key=value&key=value form" }
|
|
data: { type: string, description: "JSON-encoded request body" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: telemetry_process_graph
|
|
name: harfanglab-telemetry-process-graph
|
|
description: "Retrieve the process graph for a telemetry process UUID."
|
|
inputs_schema:
|
|
properties:
|
|
process_uuid: { type: string, description: "Telemetry process UUID" }
|
|
required: [process_uuid]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Threat hunting by hash ────────────────────────────────────────────────
|
|
- id: hunt_search_hash
|
|
name: harfanglab-hunt-search-hash
|
|
description: "Search the data explorer for a file hash."
|
|
inputs_schema:
|
|
properties:
|
|
hash: { type: string, description: "File hash to search for" }
|
|
required: [hash]
|
|
outputs_schema: { properties: {} }
|
|
- id: hunt_search_running_process_hash
|
|
name: harfanglab-hunt-search-running-process-hash
|
|
description: "Hunt for currently running processes matching a SHA-256 hash."
|
|
inputs_schema:
|
|
properties:
|
|
hash: { type: string, description: "SHA-256 hash to search for" }
|
|
required: [hash]
|
|
outputs_schema: { properties: {} }
|
|
- id: hunt_search_runned_process_hash
|
|
name: harfanglab-hunt-search-runned-process-hash
|
|
description: "Search process telemetry for executions matching a SHA-256 hash."
|
|
inputs_schema:
|
|
properties:
|
|
hash: { type: string, description: "SHA-256 hash to search for" }
|
|
required: [hash]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Telemetry ─────────────────────────────────────────────────────────────
|
|
- id: telemetry_processes
|
|
name: harfanglab-telemetry-processes
|
|
description: Search process telemetry.
|
|
inputs_schema:
|
|
properties:
|
|
hash: { type: string, description: "File hash (md5, sha1 or sha256)" }
|
|
hostname: { type: string, description: "Endpoint hostname" }
|
|
from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
|
|
to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
|
|
limit: { type: number, description: "Max elements (default 100)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: telemetry_dns
|
|
name: harfanglab-telemetry-dns
|
|
description: Search DNS resolution telemetry.
|
|
inputs_schema:
|
|
properties:
|
|
hostname: { type: string, description: "Endpoint hostname" }
|
|
requested_name: { type: string, description: "Requested DNS name" }
|
|
query_type: { type: string, description: "DNS query type" }
|
|
from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
|
|
to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
|
|
limit: { type: number, description: "Max elements (default 100)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: telemetry_network
|
|
name: harfanglab-telemetry-network
|
|
description: Search network connection telemetry.
|
|
inputs_schema:
|
|
properties:
|
|
hostname: { type: string, description: "Endpoint hostname" }
|
|
source_address: { type: string, description: "Source IP address" }
|
|
source_port: { type: number, description: "Source port" }
|
|
destination_address: { type: string, description: "Destination IP address" }
|
|
destination_port: { type: number, description: "Destination port" }
|
|
from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
|
|
to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
|
|
limit: { type: number, description: "Max elements (default 100)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: telemetry_eventlog
|
|
name: harfanglab-telemetry-eventlog
|
|
description: Search Windows full event log telemetry.
|
|
inputs_schema:
|
|
properties:
|
|
hostname: { type: string, description: "Endpoint hostname" }
|
|
event_id: { type: number, description: "Windows event ID" }
|
|
from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
|
|
to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
|
|
limit: { type: number, description: "Max elements (default 100)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: telemetry_binary
|
|
name: harfanglab-telemetry-binary
|
|
description: Search binary telemetry.
|
|
inputs_schema:
|
|
properties:
|
|
hash: { type: string, description: "File hash (md5, sha1 or sha256)" }
|
|
from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
|
|
to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
|
|
limit: { type: number, description: "Max elements (default 100)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: telemetry_authentication_windows
|
|
name: harfanglab-telemetry-authentication-windows
|
|
description: Search Windows authentication telemetry.
|
|
inputs_schema:
|
|
properties:
|
|
hostname: { type: string, description: "Endpoint hostname" }
|
|
source_address: { type: string, description: "Source IP address" }
|
|
success: { type: boolean, description: "Authentication success" }
|
|
source_username: { type: string, description: "Source username" }
|
|
target_username: { type: string, description: "Target username" }
|
|
logon_title: { type: string, description: "Windows logon title" }
|
|
logon_type: { type: number, description: "Windows logon type" }
|
|
from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
|
|
to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
|
|
limit: { type: number, description: "Max elements (default 100)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: telemetry_authentication_linux
|
|
name: harfanglab-telemetry-authentication-linux
|
|
description: Search Linux authentication telemetry.
|
|
inputs_schema:
|
|
properties:
|
|
hostname: { type: string, description: "Endpoint hostname" }
|
|
source_address: { type: string, description: "Source IP address" }
|
|
success: { type: boolean, description: "Authentication success" }
|
|
source_username: { type: string, description: "Source username" }
|
|
target_username: { type: string, description: "Target username" }
|
|
from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
|
|
to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
|
|
limit: { type: number, description: "Max elements (default 100)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: telemetry_authentication_macos
|
|
name: harfanglab-telemetry-authentication-macos
|
|
description: Search macOS authentication telemetry.
|
|
inputs_schema:
|
|
properties:
|
|
hostname: { type: string, description: "Endpoint hostname" }
|
|
source_address: { type: string, description: "Source IP address" }
|
|
success: { type: boolean, description: "Authentication success" }
|
|
source_username: { type: string, description: "Source username" }
|
|
target_username: { type: string, description: "Target username" }
|
|
from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
|
|
to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
|
|
limit: { type: number, description: "Max elements (default 100)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: telemetry_authentication_users
|
|
name: harfanglab-telemetry-authentication-users
|
|
description: Rank users by authentication attempts across Windows, Linux and macOS.
|
|
inputs_schema:
|
|
properties:
|
|
hostname: { type: string, description: "Endpoint hostname" }
|
|
from_date: { type: string, description: "Start date (YYYY-MM-DDTHH:MM:SS)" }
|
|
to_date: { type: string, description: "End date (YYYY-MM-DDTHH:MM:SS)" }
|
|
limit: { type: number, description: "Max users to return (default 3)" }
|
|
required: [hostname]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Collection jobs ───────────────────────────────────────────────────────
|
|
- id: job_pipelist
|
|
name: harfanglab-job-pipelist
|
|
description: Start a job to list named pipes on a host (Windows).
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_prefetchlist
|
|
name: harfanglab-job-prefetchlist
|
|
description: Start a job to collect Windows prefetch files on a host.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_runkeylist
|
|
name: harfanglab-job-runkeylist
|
|
description: Start a job to collect registry run keys (hives) on a host.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_scheduledtasklist
|
|
name: harfanglab-job-scheduledtasklist
|
|
description: Start a job to list scheduled tasks on a host.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_driverlist
|
|
name: harfanglab-job-driverlist
|
|
description: Start a job to list loaded drivers on a host.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_servicelist
|
|
name: harfanglab-job-servicelist
|
|
description: Start a job to collect services from registry hives on a host.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_processlist
|
|
name: harfanglab-job-processlist
|
|
description: Start a job to list running processes with signature info on a host.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_networkconnectionlist
|
|
name: harfanglab-job-networkconnectionlist
|
|
description: Start a job to list processes with their active network connections on a host.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_networksharelist
|
|
name: harfanglab-job-networksharelist
|
|
description: Start a job to list network shares on a host.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_sessionlist
|
|
name: harfanglab-job-sessionlist
|
|
description: Start a job to list active user sessions on a host.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_persistencelist
|
|
name: harfanglab-job-persistencelist
|
|
description: Start a job to scan for persistence mechanisms on a host.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_startuplist
|
|
name: harfanglab-job-startuplist
|
|
description: Start a job to list startup files on a host.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_wmilist
|
|
name: harfanglab-job-wmilist
|
|
description: Start a job to collect WMI persistence artifacts on a host.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_ioc
|
|
name: harfanglab-job-ioc
|
|
description: Start an IOC scan job on a host using filename, filepath, hash, registry, or regex indicators.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
filename: { type: string, description: "Filename to search for" }
|
|
filepath: { type: string, description: "File path to search for" }
|
|
hash: { type: string, description: "File hash to search for (MD5, SHA-1 or SHA-256)" }
|
|
search_in_path: { type: string, description: "Restrict the search to this path" }
|
|
filesize: { type: string, description: "File size in bytes associated with the filename indicator" }
|
|
hash_filesize: { type: string, description: "File size in bytes associated with the hash indicator" }
|
|
registry: { type: string, description: "Registry key or value to search for" }
|
|
filepath_regex: { type: string, description: "Regular expression to match file paths" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_info
|
|
name: harfanglab-job-info
|
|
description: Retrieve information for one or more jobs by their identifiers.
|
|
inputs_schema:
|
|
properties:
|
|
ids: { type: string, description: "Comma-separated list of job IDs to retrieve" }
|
|
required: [ids]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Forensic artifact collection jobs ─────────────────────────────────────
|
|
- id: job_artifact_mft
|
|
name: harfanglab-job-artifact-mft
|
|
description: Start a job to collect the NTFS Master File Table (MFT) from a host (Windows).
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_artifact_hives
|
|
name: harfanglab-job-artifact-hives
|
|
description: Start a job to collect the Windows registry hives from a host.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_artifact_evtx
|
|
name: harfanglab-job-artifact-evtx
|
|
description: Start a job to collect the Windows event logs (EVTX) from a host.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_artifact_logs
|
|
name: harfanglab-job-artifact-logs
|
|
description: Start a job to collect the system logs from a host.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_artifact_filesystem
|
|
name: harfanglab-job-artifact-filesystem
|
|
description: Start a job to collect the filesystem listing from a host.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_artifact_all
|
|
name: harfanglab-job-artifact-all
|
|
description: Start a job to collect all raw forensic evidence (hives, event logs, MFT, prefetch, USN journal, logs, filesystem) from a host.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_artifact_ramdump
|
|
name: harfanglab-job-artifact-ramdump
|
|
description: Start a job to capture a full memory (RAM) dump from a host.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_artifact_downloadfile
|
|
name: harfanglab-job-artifact-downloadfile
|
|
description: Start a job to download a specific file from a host by its full path.
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
filename: { type: string, description: "Full path of the file to download from the host" }
|
|
required: [agent_id, filename]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Job results (hunting) ─────────────────────────────────────────────────
|
|
- id: result_pipelist
|
|
name: harfanglab-result-pipelist
|
|
description: Get a host's list of named pipes from a job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_prefetchlist
|
|
name: harfanglab-result-prefetchlist
|
|
description: Get a host's prefetch entries from a job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_runkeylist
|
|
name: harfanglab-result-runkeylist
|
|
description: Get a host's registry run keys from a job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_scheduledtasklist
|
|
name: harfanglab-result-scheduledtasklist
|
|
description: Get a host's scheduled tasks from a job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_driverlist
|
|
name: harfanglab-result-driverlist
|
|
description: Get a host's list of drivers from a job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_servicelist
|
|
name: harfanglab-result-servicelist
|
|
description: Get a host's list of services from a job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_processlist
|
|
name: harfanglab-result-processlist
|
|
description: Get a host's list of running processes from a job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_networkconnectionlist
|
|
name: harfanglab-result-networkconnectionlist
|
|
description: Get a host's network connections from a job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_networksharelist
|
|
name: harfanglab-result-networksharelist
|
|
description: Get a host's list of network shares from a job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_sessionlist
|
|
name: harfanglab-result-sessionlist
|
|
description: Get a host's list of user sessions from a job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_persistencelist
|
|
name: harfanglab-result-persistencelist
|
|
description: Get a host's persistence files from a job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_startuplist
|
|
name: harfanglab-result-startuplist
|
|
description: Get a host's startup items from a job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_wmilist
|
|
name: harfanglab-result-wmilist
|
|
description: Get a host's WMI persistence entries from a job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_ioc
|
|
name: harfanglab-result-ioc
|
|
description: Get a host's IOC matches from a job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Job results (forensic artifacts) ──────────────────────────────────────
|
|
- id: result_artifact_mft
|
|
name: harfanglab-result-artifact-mft
|
|
description: Get the MFT download links from a collection job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_artifact_hives
|
|
name: harfanglab-result-artifact-hives
|
|
description: Get the Windows registry hive download links from a collection job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_artifact_evtx
|
|
name: harfanglab-result-artifact-evtx
|
|
description: Get the Windows event log (EVTX) download links from a collection job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_artifact_logs
|
|
name: harfanglab-result-artifact-logs
|
|
description: Get the Linux system log download links from a collection job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_artifact_filesystem
|
|
name: harfanglab-result-artifact-filesystem
|
|
description: Get the filesystem listing download links from a collection job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_artifact_all
|
|
name: harfanglab-result-artifact-all
|
|
description: Get the download links for all collected artifacts from a collection job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_artifact_downloadfile
|
|
name: harfanglab-result-artifact-downloadfile
|
|
description: Get the download link for a file retrieved by a download-file job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: result_artifact_ramdump
|
|
name: harfanglab-result-artifact-ramdump
|
|
description: Get the memory (RAM) dump download links from a collection job result.
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID returned by the matching artifact job command" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Response: process ─────────────────────────────────────────────────────
|
|
- id: kill_process
|
|
name: harfanglab-kill-process
|
|
description: "Kill processes on an endpoint matching a criterion (name, path, pid, hash, command line...). Destructive: matching processes are terminated. Returns the created job; poll with harfanglab-wait-for-job."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
field: { type: string, description: "Criterion field: name, path, username, commandline, parent_name, parent_path, parent_commandline, pid, md5, sha1, sha256 (default name)" }
|
|
operator: { type: string, description: "Criterion operator: eq, not_eq, contains, not_contains (default eq)" }
|
|
value: { type: string, description: "Criterion value to match" }
|
|
required: [agent_id, value]
|
|
outputs_schema: { properties: {} }
|
|
- id: dump_process
|
|
name: harfanglab-dump-process
|
|
description: "Dump the memory of processes matching a criterion (same criteria as kill-process). Returns the created job."
|
|
risk: safe_write
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
field: { type: string, description: "Criterion field: name, path, username, commandline, parent_name, parent_path, parent_commandline, pid, md5, sha1, sha256 (default name)" }
|
|
operator: { type: string, description: "Criterion operator: eq, not_eq, contains, not_contains (default eq)" }
|
|
value: { type: string, description: "Criterion value to match" }
|
|
required: [agent_id, value]
|
|
outputs_schema: { properties: {} }
|
|
# ── Response: scans ───────────────────────────────────────────────────────
|
|
- id: av_scan
|
|
name: harfanglab-av-scan
|
|
description: "Start an on-demand antivirus scan on an endpoint (full, quick, or resource with explicit paths). Returns the created job."
|
|
risk: safe_write
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
scan_type: { type: string, description: "Scan type: full, quick or resource (default quick)" }
|
|
paths: { type: string, description: "Comma-separated paths to scan (required for resource scans)" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: yara_scan
|
|
name: harfanglab-yara-scan
|
|
description: "Start a YARA scan on an endpoint using named YARA sources. Returns the created job."
|
|
risk: safe_write
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
sources: { type: string, description: "Comma-separated YARA source names" }
|
|
directories: { type: string, description: "Comma-separated directories to scan" }
|
|
scan_filesystem: { type: boolean, description: "Scan the filesystem (default true)" }
|
|
scan_processes: { type: boolean, description: "Scan running processes (default false)" }
|
|
required: [agent_id]
|
|
outputs_schema: { properties: {} }
|
|
# ── Response: remediation ─────────────────────────────────────────────────
|
|
- id: delete_file
|
|
name: harfanglab-delete-file
|
|
description: "Delete a file on an endpoint by full path. Destructive. Returns the created job."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
filepath: { type: string, description: "Full path of the file to delete on the host" }
|
|
required: [agent_id, filepath]
|
|
outputs_schema: { properties: {} }
|
|
- id: delete_service
|
|
name: harfanglab-delete-service
|
|
description: "Delete a Windows service on an endpoint by service name. Destructive. Returns the created job."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
service_name: { type: string, description: "Name of the service to delete" }
|
|
required: [agent_id, service_name]
|
|
outputs_schema: { properties: {} }
|
|
- id: delete_scheduled_task
|
|
name: harfanglab-delete-scheduled-task
|
|
description: "Delete a scheduled task on an endpoint by task URI. Destructive. Returns the created job."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
schtask_uri: { type: string, description: "URI of the scheduled task to delete (e.g. \\Microsoft\\Windows\\...)" }
|
|
required: [agent_id, schtask_uri]
|
|
outputs_schema: { properties: {} }
|
|
# ── Response: quarantine ──────────────────────────────────────────────────
|
|
- id: quarantine_file
|
|
name: harfanglab-quarantine-file
|
|
description: "Move a file on an endpoint into HarfangLab quarantine by full path. Returns the created job."
|
|
risk: safe_write
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
file_path: { type: string, description: "Full path of the file to quarantine on the host" }
|
|
comment: { type: string, description: "Quarantine comment" }
|
|
required: [agent_id, file_path]
|
|
outputs_schema: { properties: {} }
|
|
- id: unquarantine_file
|
|
name: harfanglab-unquarantine-file
|
|
description: "Restore a quarantined file to its original location on the endpoint. Returns the created job."
|
|
risk: safe_write
|
|
inputs_schema:
|
|
properties:
|
|
agent_id: { type: string, description: "Agent unique identifier from the HarfangLab EDR Manager" }
|
|
local_id: { type: string, description: "Quarantined item local UUID (from harfanglab-quarantine-search)" }
|
|
overwrite_existing: { type: boolean, description: "Overwrite an existing file at the original path (default true)" }
|
|
required: [agent_id, local_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: quarantine_search
|
|
name: harfanglab-quarantine-search
|
|
description: "Search quarantined files by hash, hostname or agent. Items include their id; once acquired on the manager the file is downloadable at /api/data/quarantine/item/{id}/download/."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
hash: { type: string, description: "File hash (md5, sha1 or sha256 — routed by length)" }
|
|
agent_hostname: { type: string, description: "Endpoint hostname" }
|
|
agent_id: { type: string, description: "Agent unique identifier" }
|
|
search: { type: string, description: "Free-text search term" }
|
|
limit: { type: number, description: "Max results (default 100)" }
|
|
offset: { type: number, description: "Pagination offset (default 0)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: quarantine_request_upload
|
|
name: harfanglab-quarantine-request-upload
|
|
description: "Request upload of a quarantined file from the endpoint to the manager (returns the upload job). Once done, download at /api/data/quarantine/item/{id}/download/."
|
|
risk: safe_write
|
|
inputs_schema:
|
|
properties:
|
|
item_id: { type: string, description: "Quarantined item UUID (from harfanglab-quarantine-search)" }
|
|
required: [item_id]
|
|
outputs_schema: { properties: {} }
|
|
# ── Response: threat isolation & job lifecycle ────────────────────────────
|
|
- id: isolate_from_threat
|
|
name: harfanglab-isolate-from-threat
|
|
description: "Network-isolate ALL agents involved in a threat. Destructive: cuts network access on every impacted endpoint."
|
|
risk: destructive
|
|
inputs_schema:
|
|
properties:
|
|
threat_id: { type: string, description: "Threat identifier" }
|
|
required: [threat_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: deisolate_from_threat
|
|
name: harfanglab-deisolate-from-threat
|
|
description: "Remove network isolation from all agents involved in a threat."
|
|
risk: safe_write
|
|
inputs_schema:
|
|
properties:
|
|
threat_id: { type: string, description: "Threat identifier" }
|
|
required: [threat_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_cancel
|
|
name: harfanglab-job-cancel
|
|
description: "Cancel a running job by job ID."
|
|
risk: safe_write
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID to cancel" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: job_relaunch
|
|
name: harfanglab-job-relaunch
|
|
description: "Relaunch a cancelled or errored job by job ID."
|
|
risk: safe_write
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID to relaunch" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: wait_for_job
|
|
name: harfanglab-wait-for-job
|
|
description: "Poll a job until all its instances finish (done/error/canceled) or the timeout elapses. Returns {done: true|false, job: {...}} — never fails on timeout, so playbooks can branch on done."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
job_id: { type: string, description: "Job ID to wait for" }
|
|
timeout: { type: number, description: "Max seconds to wait (default 300)" }
|
|
interval: { type: number, description: "Seconds between polls (default 10)" }
|
|
required: [job_id]
|
|
outputs_schema: { properties: {} }
|
|
# ── Triage: alerts ────────────────────────────────────────────────────────
|
|
- id: get_alerts
|
|
name: harfanglab-get-alerts
|
|
description: "Search security events (alerts) for playbooks: by IDs, hostname, agent, threat, rule name, level/status/type, date range. Returns {count, results}."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
alert_ids: { type: string, description: "Comma-separated alert IDs (fetched individually; other filters ignored)" }
|
|
hostname: { type: string, description: "Endpoint hostname" }
|
|
agent_id: { type: string, description: "Agent unique identifier" }
|
|
threat_id: { type: string, description: "Threat key — alerts aggregated under this threat" }
|
|
rule_name: { type: string, description: "Detection rule name" }
|
|
level: { type: string, description: "Comma-separated severities (low, medium, high, critical)" }
|
|
status: { type: string, description: "Comma-separated statuses (new, investigating, closed, false_positive)" }
|
|
alert_type: { type: string, description: "Comma-separated alert types (sigma, yara, hlai, vt, ransom, ioc...)" }
|
|
from_date: { type: string, description: "ISO8601 lower bound on alert_time" }
|
|
to_date: { type: string, description: "ISO8601 upper bound on alert_time" }
|
|
search: { type: string, description: "Free-text search term" }
|
|
ordering: { type: string, description: "Sort field (default -alert_time)" }
|
|
limit: { type: number, description: "Max results (default 100)" }
|
|
offset: { type: number, description: "Pagination offset (default 0)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
ingest:
|
|
results_path: results
|
|
dedup_key: id
|
|
incremental_field: from_date
|
|
- id: alert_tag
|
|
name: harfanglab-alert-tag
|
|
description: "Change the status of one or more alerts in bulk (new, investigating, false_positive, closed), optionally with a comment."
|
|
risk: safe_write
|
|
inputs_schema:
|
|
properties:
|
|
alert_ids: { type: string, description: "Comma-separated alert IDs" }
|
|
new_status: { type: string, description: "new | investigating | false_positive | closed" }
|
|
new_comment: { type: string, description: "Optional comment attached to the status change" }
|
|
required: [alert_ids, new_status]
|
|
outputs_schema: { properties: {} }
|
|
- id: alert_comment
|
|
name: harfanglab-alert-comment
|
|
description: "Add a comment to a security event (alert)."
|
|
risk: safe_write
|
|
inputs_schema:
|
|
properties:
|
|
alert_id: { type: string, description: "Alert ID" }
|
|
comment: { type: string, description: "Comment text" }
|
|
required: [alert_id, comment]
|
|
outputs_schema: { properties: {} }
|
|
- id: alert_details
|
|
name: harfanglab-alert-details
|
|
description: "Get the full details of an alert (raw Sigma/YARA rule, binary availability, process unique id...)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
alert_id: { type: string, description: "Alert ID" }
|
|
required: [alert_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: alert_history
|
|
name: harfanglab-alert-history
|
|
description: "Get the status-change history of an alert."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
alert_id: { type: string, description: "Alert ID" }
|
|
required: [alert_id]
|
|
outputs_schema: { properties: {} }
|
|
# ── Triage: threats ───────────────────────────────────────────────────────
|
|
- id: get_threat
|
|
name: harfanglab-get-threat
|
|
description: "Get a single threat by ID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
threat_id: { type: string, description: "Threat identifier" }
|
|
required: [threat_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: threat_status
|
|
name: harfanglab-threat-status
|
|
description: "Change the status of one or more threats (new, investigating, false_positive, closed), optionally propagating to their security events."
|
|
risk: safe_write
|
|
inputs_schema:
|
|
properties:
|
|
threat_ids: { type: string, description: "Comma-separated threat IDs" }
|
|
new_status: { type: string, description: "new | investigating | false_positive | closed" }
|
|
tag_security_events: { type: boolean, description: "Also apply the status to the threat's security events (default false)" }
|
|
required: [threat_ids, new_status]
|
|
outputs_schema: { properties: {} }
|
|
- id: threat_level
|
|
name: harfanglab-threat-level
|
|
description: "Change the severity level of one or more threats (low, medium, high, critical)."
|
|
risk: safe_write
|
|
inputs_schema:
|
|
properties:
|
|
threat_ids: { type: string, description: "Comma-separated threat IDs" }
|
|
new_level: { type: string, description: "low | medium | high | critical" }
|
|
required: [threat_ids, new_level]
|
|
outputs_schema: { properties: {} }
|
|
- id: threat_comment
|
|
name: harfanglab-threat-comment
|
|
description: "Add a comment to a threat."
|
|
risk: safe_write
|
|
inputs_schema:
|
|
properties:
|
|
threat_id: { type: string, description: "Threat identifier" }
|
|
comment: { type: string, description: "Comment text" }
|
|
required: [threat_id, comment]
|
|
outputs_schema: { properties: {} }
|
|
- id: threat_note_set
|
|
name: harfanglab-threat-note-set
|
|
description: "Create or update the analyst note of a threat (title + content). Upserts: creates the note, or replaces it if one exists."
|
|
risk: safe_write
|
|
inputs_schema:
|
|
properties:
|
|
threat_id: { type: string, description: "Threat identifier" }
|
|
title: { type: string, description: "Note title" }
|
|
content: { type: string, description: "Note content" }
|
|
required: [threat_id, title, content]
|
|
outputs_schema: { properties: {} }
|
|
- id: threat_history
|
|
name: harfanglab-threat-history
|
|
description: "Get the status-change history of a threat."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
threat_id: { type: string, description: "Threat identifier" }
|
|
required: [threat_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Connectivity test ─────────────────────────────────────────────────────
|
|
- id: test_connection
|
|
name: harfanglab-test-connection
|
|
description: "Verify connectivity and credentials (used by the Test button)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
ingestion:
|
|
command: get_threats
|
|
mapper: get_threats
|
|
default_incident_type: "HarfangLab Threat"
|