The HarfangLab connector facilitates seamless integration with the HarfangLab EDR platform, enabling automated security monitoring and response actions.

HarfangLab is a cutting-edge endpoint security solution that provides comprehensive telemetry and actionable insights for threat detection and response. This connector enables Swimlane Turbine users to integrate HarfangLab's advanced endpoint isolation and incident management capabilities directly into their security workflows. By leveraging this integration, security teams can automate the containment of threats, streamline incident analysis, and enhance their overall security posture with minimal manual intervention.

To effectively utilize the HarfangLab connector within the Swimlane Turbine platform, ensure you have the following:

The HarfangLab Connector integrates with Swimlane Turbine to retrieve the incidents, endpoint info , isolate and deisolate the endpoints.

This connector provides the following capabilities:

This connector requires the below parameters for authentication:

Authenticates using bearer token such as a JWT, etc.

Reconnect a previously isolated endpoint to the network in HarfangLab by specifying the endpoint's ID.

{"json_body":{"additional_info":{"additional_info1":"","additional_info2":"","additional_info3":"","additional_info4":""},"description":"","group_count":0,"id":"3fa85f64-5717-4562-b3fc-2c963f66afa6","policy":{"agent_auto_forget":false,"agent_auto_forget_max_days":1,"agent_auto_update":false,"agent_ui_admin_message":"","agent_ui_enabled":true,"agent_ui_notification_level":2147483647,"agent_ui_notification_scope":2147483647,"agent_upgrade_strategy":"latest","audit_killswitch":true,"binary_download_enabled":true,"description":"","driverblock_mode":3,"feature_callback_tampering":true,"feature_dse_tampering_mode":2147483647,"feature_event_stacktrace":true,"feature_live_process_heuristics":true,"feature_ppl_antimalware":true,"feature_process_tampering":true,"feature_windows_filesystem_events":true,"fim_policy":"3fa85f64-5717-4562-b3fc-2c963f66afa6","hibou_minimum_level":"","hibou_mode":3,"hibou_skip_signed_ms":true,"hibou_skip_signed_others":true,"hlai_minimum_level":"","hlai_mode":3,"hlai_pdf":true,"hlai_scan_libraries":true,"hlai_scripts_minimum_level":"","hlai_scripts_mode":3,"hlai_skip_signed_ms":true,"hlai_skip_signed_others":true,"hlai_written_executable":true,"ioc_mode":3,"ioc_ruleset":0,"ioc_scan_libraries":true,"ioc_scan_written_executable":true,"isolation_exclusions_revision":2147483647,"library_download_enabled":true,"linux_paths_other_watched_globs":["/dev/shm/**","/home/*/*","/tmp/**"],"linux_self_protection":true,"linux_self_protection_feature_hosts":true,"linux_startup_block":true,"linux_use_isolation":true,"local_endpoint_cache_size":10240,"loglevel":"","macos_paths_muted_exact":["/Library/Bluetooth/com.apple.MobileBluetooth.ledevices.paired.db-wal","/private/var/root/Library/Logs/Bluetooth/bluetoothd-hci-latest.pklg"],"macos_paths_muted_globs":[],"macos_paths_muted_prefixes":["/System/Volumes/Data/.Spotlight-V100/","/usr/sbin/"],"macos_paths_other_watched_exact":["/.ssh/authorized_keys","/etc/resolv.conf","/private/var/at/cron.deny","/var/run/utmpx"],"macos_paths_other_watched_globs":["/Users/*/*","/etc/ssl/*"],"macos_paths_other_watched_prefixes":["/Library/LaunchAgents/","/private/var/at/tabs/"],"macos_paths_read_watched_exact":["/.ssh/authorized_keys","/var/run/utmpx"],"macos_paths_read_watched_globs":["/Users/*/*","/etc/ssl/*"],"macos_paths_read_watched_prefixes":["/Library/LaunchAgents/","/private/var/at/tabs/"],"macos_paths_write_watched_exact":["/private/var/at/cron.allow","/var/run/utmpx"],"macos_paths_write_watched_globs":["/Users/*/*","/etc/ssl/*"],"macos_paths_write_watched_prefixes":["/Library/LaunchAgents/","/private/var/at/tabs/"],"name":"","origin_stack":{"id":"","is_current":true,"is_supervisor":true,"is_tenant":true,"name":""},"ransomguard_heuristic_mode":2147483647,"ransomguard_mode":3,"self_protection":true,"self_protection_feature_hosts":true,"self_protection_feature_safe_mode":true,"self_protection_firewall":true,"sidewatch_mode":3,"sigma_mode":3,"sigma_ruleset":0,"sleepjitter":2147483647,"sleeptime":2147483647,"synchronization_status":"3fa85f64-5717-4562-b3fc-2c963f66afa6","telemetry_alerts_limit":true,"telemetry_alerts_limit_value":2147483647,"telemetry_amsi_dynamic_scripts_limit":true,"telemetry_amsi_dynamic_scripts_limit_value":2147483647,"telemetry_amsi_dynamic_scripts_state":"disabled","telemetry_amsi_other_scans_limit":true,"telemetry_amsi_other_scans_limit_value":2147483647,"telemetry_amsi_other_scans_state":"disabled","telemetry_authentication":true,"telemetry_authentication_limit":true,"telemetry_authentication_limit_value":2147483647,"telemetry_authentication_state":"disabled","telemetry_dns_resolution":true,"telemetry_dns_resolution_limit":true,"telemetry_dns_resolution_limit_value":2147483647,"telemetry_dns_resolution_state":"disabled","telemetry_dotnet_library_state":"disabled","telemetry_driverload":true,"telemetry_driverload_limit":true,"telemetry_driverload_limit_value":2147483647,"telemetry_driverload_state":"disabled","telemetry_file_download_limit":true,"telemetry_file_download_limit_value":2147483647,"telemetry_file_download_state":"disabled","telemetry_file_limit":true,"telemetry_file_limit_value":2147483647,"telemetry_file_state":"disabled","telemetry_library_load_limit":true,"telemetry_library_load_limit_value":2147483647,"telemetry_library_load_state":"disabled","telemetry_log":true,"telemetry_log_limit":true,"telemetry_log_limit_value":2147483647,"telemetry_log_state":"disabled","telemetry_named_pipe_limit":true,"telemetry_named_pipe_limit_value":2147483647,"telemetry_named_pipe_state":"disabled","telemetry_network":true,"telemetry_network_limit":true,"telemetry_network_limit_value":2147483647,"telemetry_network_listen_limit":true,"telemetry_network_listen_limit_value":2147483647,"telemetry_network_listen_state":"disabled","telemetry_network_state":"disabled","telemetry_on_alert_enabled":true,"telemetry_on_alert_post_alert_max_duration_secs":2147483647,"telemetry_on_alert_post_alert_max_event_count":2147483647,"telemetry_on_alert_pre_alert_event_count":2147483647,"telemetry_powershell":true,"telemetry_powershell_limit":true,"telemetry_powershell_limit_value":2147483647,"telemetry_powershell_state":"disabled","telemetry_process":true,"telemetry_process_access_limit":true,"telemetry_process_access_limit_value":2147483647,"telemetry_process_access_state":"disabled","telemetry_process_limit":true,"telemetry_process_limit_value":2147483647,"telemetry_process_state":"disabled","telemetry_process_tamper_limit":true,"telemetry_process_tamper_limit_value":2147483647,"telemetry_process_tamper_state":"disabled","telemetry_raw_device_access_limit":true,"telemetry_raw_device_access_limit_value":2147483647,"telemetry_raw_device_access_state":"disabled","telemetry_raw_socket_creation_limit":true,"telemetry_raw_socket_creation_limit_value":2147483647,"telemetry_raw_socket_creation_state":"disabled","telemetry_registry_limit":true,"telemetry_registry_limit_value":2147483647,"telemetry_registry_state":"disabled","telemetry_remotethread":true,"telemetry_remotethread_limit":true,"telemetry_remotethread_limit_value":2147483647,"telemetry_remotethread_state":"disabled","telemetry_service_limit":true,"telemetry_service_limit_value":2147483647,"telemetry_service_state":"disabled","telemetry_url_request_limit":true,"telemetry_url_request_limit_value":2147483647,"telemetry_url_request_state":"disabled","telemetry_usb_activity_limit":true,"telemetry_usb_activity_limit_value":2147483647,"telemetry_usb_activity_state":"disabled","telemetry_user_group_limit":true,"telemetry_user_group_limit_value":2147483647,"telemetry_user_group_state":"disabled","telemetry_wmi_event_limit":true,"telemetry_wmi_event_limit_value":2147483647,"telemetry_wmi_event_state":"disabled","thread_download_enabled":true,"use_isolation":true,"vulnerability_policy":"3fa85f64-5717-4562-b3fc-2c963f66afa6","windows_eventlog_config":{"detection_events":{},"telemetry_events":{}},"windows_read_watched_paths":["*\\PROGRAM FILES*","*\\\\USERS\\*"],"windows_registry_read_blacklist":[],"windows_registry_read_whitelist":["HKLM\\SAM\\SAM\\DOMAINS\\ACCOUNT\\USERS\\*\\*","HKLM\\SECURITY\\CACHE\\*","HKU\\*\\SOFTWARE\\SIMONTATHAM\\*"],"windows_self_protection":true,"windows_self_protection_feature_firewall":true,"windows_self_protection_feature_hosts":true,"windows_self_protection_feature_safe_mode":true,"windows_write_watched_paths":["*\\PROGRAM FILES*","*\\WINDOWS\\SYSTEM32\\TASKS\\*"],"yara_mode":3,"yara_ruleset":0,"yara_scan_libraries_load":true,"yara_scan_written_executable":true,"yara_skip_signed_ms":true,"yara_skip_signed_others":true},"subnet":{}},"path_parameters":{"id":"3fa85f64-5717-4562-b3fc-2c963f66afa6"}}

{"status_code":200,"response_headers":{"Content-Type":"text/html; charset=utf-8","x-hsci-cache-time":"2024-12-18T12:01:22.328Z"},"reason":"OK","json_body":{"policy_not_allowed":[{}],"requested":[{}],"unrequested":[{}],"unsupported":[{}]}}

Retrieve endpoint information from HarfangLab by conducting a targeted search.

{"parameters":{"search":"string","ordering":"string","id":"12345678-1234-1234-1234-123456789abc","domainname":"Example Name","dnsdomainname":"Example Name","hostname":"Example Name","osmajor":123,"osminor":123,"osproducttype":"string","firstseen":"string","lastseen":"string","version":"string","bitness":"string","domain":"string","installdate":"string","ipaddress":"string","external_ipaddress":"string","osbuild":123,"osid":"string","osversion":"string","producttype":"string","servicepack":"string","total_memory":123,"cpu_count":123,"cpu_frequency":123,"avg_cpu":123,"avg_memory":123,"avg_system_cpu":123,"avg_system_memory":123,"starttime":"string","machine_boottime":"string","subnet__gateway_ipaddress":"string","subnet__gateway_macaddress":"string","subnet__name":"Example Name","isolation_state":"string","antivirus_name":"Example Name","antivirus_version":"string","antivirus_rules_version":"string","antivirus_last_update_date":"string","antivirus_rules_last_update_date":"string","additional_info":"string","additional_info__additional_info1":"string","additional_info__additional_info2":"string","additional_info__additional_info3":"string"}}

{"count":123,"next":"string","previous":"string","results":[{"additional_info":{},"antivirus_last_update_date":"string","antivirus_name":"Example Name","antivirus_profile":{},"antivirus_profile_status":"active","antivirus_rules_last_update_date":"string","antivirus_rules_version":"string","antivirus_version":"string","application_count":123,"avg_cpu":123,"avg_memory":123,"avg_system_cpu":123,"avg_system_memory":123,"bitness":"string","cpu_count":123}]}

Fetches a list of incidents from HarfangLab, providing an overview of security alerts and breaches.

{"parameters":{"limit":3,"offset":1}}

{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"count":0,"next":"","previous":"/api/data/alert/alert/Alert/?limit=3","results":[""],"filters":{"wildcard":[]}}}

Retrieve detailed information for a specific Agent in HarfangLab using the provided unique identifier (ID).

{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}

{"additional_info":{"additional_info1":"string","additional_info2":"string","additional_info3":"string","additional_info4":"string"},"antivirus_last_update_date":"string","antivirus_name":"Example Name","antivirus_profile":{"agent_count":123,"antivirus_object":{},"antivirus_slug":"string","creation_date":"string","description":"string","id":"12345678-1234-1234-1234-123456789abc","last_modifier":{"id":123,"username":"Example Name"},"last_update":"string","name":"Example Name","revision":123},"ant...

Initiates network isolation on a specified agent using its ID in HarfangLab, to contain potential threats.

{"json_body":{"additional_info":{"additional_info1":"","additional_info2":"","additional_info3":"","additional_info4":""},"description":"","group_count":0,"id":"3fa85f64-5717-4562-b3fc-2c963f66afa6","policy":{"agent_auto_forget":false,"agent_auto_forget_max_days":1,"agent_auto_update":false,"agent_ui_admin_message":"","agent_ui_enabled":true,"agent_ui_notification_level":2147483647,"agent_ui_notification_scope":2147483647,"agent_upgrade_strategy":"latest","audit_killswitch":true,"binary_download_enabled":true,"description":"","driverblock_mode":3,"feature_callback_tampering":true,"feature_dse_tampering_mode":2147483647,"feature_event_stacktrace":true,"feature_live_process_heuristics":true,"feature_ppl_antimalware":true,"feature_process_tampering":true,"feature_windows_filesystem_events":true,"fim_policy":"3fa85f64-5717-4562-b3fc-2c963f66afa6","hibou_minimum_level":"","hibou_mode":3,"hibou_skip_signed_ms":true,"hibou_skip_signed_others":true,"hlai_minimum_level":"","hlai_mode":3,"hlai_pdf":true,"hlai_scan_libraries":true,"hlai_scripts_minimum_level":"","hlai_scripts_mode":3,"hlai_skip_signed_ms":true,"hlai_skip_signed_others":true,"hlai_written_executable":true,"ioc_mode":3,"ioc_ruleset":0,"ioc_scan_libraries":true,"ioc_scan_written_executable":true,"isolation_exclusions_revision":2147483647,"library_download_enabled":true,"linux_paths_other_watched_globs":["/dev/shm/**","/home/*/*","/tmp/**"],"linux_self_protection":true,"linux_self_protection_feature_hosts":true,"linux_startup_block":true,"linux_use_isolation":true,"local_endpoint_cache_size":10240,"loglevel":"","macos_paths_muted_exact":["/Library/Bluetooth/com.apple.MobileBluetooth.ledevices.paired.db-wal","/private/var/root/Library/Logs/Bluetooth/bluetoothd-hci-latest.pklg"],"macos_paths_muted_globs":[],"macos_paths_muted_prefixes":["/System/Volumes/Data/.Spotlight-V100/","/usr/sbin/"],"macos_paths_other_watched_exact":["/.ssh/authorized_keys","/etc/resolv.conf","/private/var/at/cron.deny","/var/run/utmpx"],"macos_paths_other_watched_globs":["/Users/*/*","/etc/ssl/*"],"macos_paths_other_watched_prefixes":["/Library/LaunchAgents/","/private/var/at/tabs/"],"macos_paths_read_watched_exact":["/.ssh/authorized_keys","/var/run/utmpx"],"macos_paths_read_watched_globs":["/Users/*/*","/etc/ssl/*"],"macos_paths_read_watched_prefixes":["/Library/LaunchAgents/","/private/var/at/tabs/"],"macos_paths_write_watched_exact":["/private/var/at/cron.allow","/var/run/utmpx"],"macos_paths_write_watched_globs":["/Users/*/*","/etc/ssl/*"],"macos_paths_write_watched_prefixes":["/Library/LaunchAgents/","/private/var/at/tabs/"],"name":"","origin_stack":{"id":"","is_current":true,"is_supervisor":true,"is_tenant":true,"name":""},"ransomguard_heuristic_mode":2147483647,"ransomguard_mode":3,"self_protection":true,"self_protection_feature_hosts":true,"self_protection_feature_safe_mode":true,"self_protection_firewall":true,"sidewatch_mode":3,"sigma_mode":3,"sigma_ruleset":0,"sleepjitter":2147483647,"sleeptime":2147483647,"synchronization_status":"3fa85f64-5717-4562-b3fc-2c963f66afa6","telemetry_alerts_limit":true,"telemetry_alerts_limit_value":2147483647,"telemetry_amsi_dynamic_scripts_limit":true,"telemetry_amsi_dynamic_scripts_limit_value":2147483647,"telemetry_amsi_dynamic_scripts_state":"disabled","telemetry_amsi_other_scans_limit":true,"telemetry_amsi_other_scans_limit_value":2147483647,"telemetry_amsi_other_scans_state":"disabled","telemetry_authentication":true,"telemetry_authentication_limit":true,"telemetry_authentication_limit_value":2147483647,"telemetry_authentication_state":"disabled","telemetry_dns_resolution":true,"telemetry_dns_resolution_limit":true,"telemetry_dns_resolution_limit_value":2147483647,"telemetry_dns_resolution_state":"disabled","telemetry_dotnet_library_state":"disabled","telemetry_driverload":true,"telemetry_driverload_limit":true,"telemetry_driverload_limit_value":2147483647,"telemetry_driverload_state":"disabled","telemetry_file_download_limit":true,"telemetry_file_download_limit_value":2147483647,"telemetry_file_download_state":"disabled","telemetry_file_limit":true,"telemetry_file_limit_value":2147483647,"telemetry_file_state":"disabled","telemetry_library_load_limit":true,"telemetry_library_load_limit_value":2147483647,"telemetry_library_load_state":"disabled","telemetry_log":true,"telemetry_log_limit":true,"telemetry_log_limit_value":2147483647,"telemetry_log_state":"disabled","telemetry_named_pipe_limit":true,"telemetry_named_pipe_limit_value":2147483647,"telemetry_named_pipe_state":"disabled","telemetry_network":true,"telemetry_network_limit":true,"telemetry_network_limit_value":2147483647,"telemetry_network_listen_limit":true,"telemetry_network_listen_limit_value":2147483647,"telemetry_network_listen_state":"disabled","telemetry_network_state":"disabled","telemetry_on_alert_enabled":true,"telemetry_on_alert_post_alert_max_duration_secs":2147483647,"telemetry_on_alert_post_alert_max_event_count":2147483647,"telemetry_on_alert_pre_alert_event_count":2147483647,"telemetry_powershell":true,"telemetry_powershell_limit":true,"telemetry_powershell_limit_value":2147483647,"telemetry_powershell_state":"disabled","telemetry_process":true,"telemetry_process_access_limit":true,"telemetry_process_access_limit_value":2147483647,"telemetry_process_access_state":"disabled","telemetry_process_limit":true,"telemetry_process_limit_value":2147483647,"telemetry_process_state":"disabled","telemetry_process_tamper_limit":true,"telemetry_process_tamper_limit_value":2147483647,"telemetry_process_tamper_state":"disabled","telemetry_raw_device_access_limit":true,"telemetry_raw_device_access_limit_value":2147483647,"telemetry_raw_device_access_state":"disabled","telemetry_raw_socket_creation_limit":true,"telemetry_raw_socket_creation_limit_value":2147483647,"telemetry_raw_socket_creation_state":"disabled","telemetry_registry_limit":true,"telemetry_registry_limit_value":2147483647,"telemetry_registry_state":"disabled","telemetry_remotethread":true,"telemetry_remotethread_limit":true,"telemetry_remotethread_limit_value":2147483647,"telemetry_remotethread_state":"disabled","telemetry_service_limit":true,"telemetry_service_limit_value":2147483647,"telemetry_service_state":"disabled","telemetry_url_request_limit":true,"telemetry_url_request_limit_value":2147483647,"telemetry_url_request_state":"disabled","telemetry_usb_activity_limit":true,"telemetry_usb_activity_limit_value":2147483647,"telemetry_usb_activity_state":"disabled","telemetry_user_group_limit":true,"telemetry_user_group_limit_value":2147483647,"telemetry_user_group_state":"disabled","telemetry_wmi_event_limit":true,"telemetry_wmi_event_limit_value":2147483647,"telemetry_wmi_event_state":"disabled","thread_download_enabled":true,"use_isolation":true,"vulnerability_policy":"3fa85f64-5717-4562-b3fc-2c963f66afa6","windows_eventlog_config":{"detection_events":{},"telemetry_events":{}},"windows_read_watched_paths":["*\\PROGRAM FILES*","*\\\\USERS\\*"],"windows_registry_read_blacklist":[],"windows_registry_read_whitelist":["HKLM\\SAM\\SAM\\DOMAINS\\ACCOUNT\\USERS\\*\\*","HKLM\\SECURITY\\CACHE\\*","HKU\\*\\SOFTWARE\\SIMONTATHAM\\*"],"windows_self_protection":true,"windows_self_protection_feature_firewall":true,"windows_self_protection_feature_hosts":true,"windows_self_protection_feature_safe_mode":true,"windows_write_watched_paths":["*\\PROGRAM FILES*","*\\WINDOWS\\SYSTEM32\\TASKS\\*"],"yara_mode":3,"yara_ruleset":0,"yara_scan_libraries_load":true,"yara_scan_written_executable":true,"yara_skip_signed_ms":true,"yara_skip_signed_others":true},"subnet":{}},"path_parameters":{"id":"3fa85f64-5717-4562-b3fc-2c963f66afa6"}}

{"status_code":200,"response_headers":{"Content-Type":"text/html; charset=utf-8","x-hsci-cache-time":"2024-12-18T12:01:22.328Z"},"reason":"OK","json_body":{"policy_not_allowed":[{}],"requested":[{}],"unrequested":[{}],"unsupported":[{}]}}