--- title: Harfanglab slug: connectors/harfanglab docTags: createdAt: 2026-06-09T16:29:44.819Z --- The HarfangLab connector facilitates seamless integration with the HarfangLab EDR platform, enabling automated security monitoring and response actions. HarfangLab is a cutting-edge endpoint security solution that provides comprehensive telemetry and actionable insights for threat detection and response. This connector enables Swimlane Turbine users to integrate HarfangLab's advanced endpoint isolation and incident management capabilities directly into their security workflows. By leveraging this integration, security teams can automate the containment of threats, streamline incident analysis, and enhance their overall security posture with minimal manual intervention. ## Prerequisites To effectively utilize the HarfangLab connector within the Swimlane Turbine platform, ensure you have the following: - HTTP Bearer Token Authentication with these parameters: - URL: The base URL for the HarfangLab API endpoint. - Token: A valid bearer token to authenticate API requests. The HarfangLab Connector integrates with Swimlane Turbine to retrieve the incidents, endpoint info , isolate and deisolate the endpoints. ## Capabilities This connector provides the following capabilities: - Deisolate Endpoint - Endpoint Search - Fetch Incidents - Get Endpoint Info - Isolate Endpoint ## Asset Setup This connector requires the below parameters for authentication: - URL - Token ## Additional Documentation - [Harfanglab Connector Documentation](https://docs.swimlane.com/connectors/harfanglab) - [Harfanglab API Documentation](https://api.harfanglab.io/) # Configurations ## HTTP Bearer Authentication Authenticates using bearer token such as a JWT, etc. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | token | Token | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Deisolate Endpoint Reconnect a previously isolated endpoint to the network in HarfangLab by specifying the endpoint's ID. ### Endpoint - **URL:** `/api/data/endpoint/Agent/{{id}}/deisolate/` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------ | -------- | ------------ | ------------------------------------------------------------------------------------------ | | `path_parameters.id` | string | Required | Parameters for the Deisolate Endpoint action | | `additional_info` | object | Optional | Parameter for Deisolate Endpoint | | `additional_info.additional_info1` | string | Optional | Parameter for Deisolate Endpoint | | `additional_info.additional_info2` | string | Optional | Parameter for Deisolate Endpoint | | `additional_info.additional_info3` | string | Optional | Parameter for Deisolate Endpoint | | `additional_info.additional_info4` | string | Optional | Parameter for Deisolate Endpoint | | `description` | string | Optional | Parameter for Deisolate Endpoint | | `group_count` | number | Optional | Count value | | `id` | string | Optional | Unique identifier | | `policy` | object | Optional | Parameter for Deisolate Endpoint | | `policy.agent_auto_forget` | boolean | Optional | Parameter for Deisolate Endpoint | | `policy.agent_auto_forget_max_days` | number | Optional | Agent Auto Forget Max Days. Minimum value is 1. | | `policy.agent_auto_update` | boolean | Optional | Date value | | `policy.agent_ui_admin_message` | string | Optional | Response message | | `policy.agent_ui_enabled` | boolean | Optional | Parameter for Deisolate Endpoint | | `policy.agent_ui_notification_level` | number | Optional | Agent UI Notification Level. Maximum value is 2147483647 and Minimum value is -2147483648. | | `policy.agent_ui_notification_scope` | number | Optional | Agent UI Notification Scope. Maximum value is 2147483647 and Minimum value is -2147483648. | | `policy.agent_upgrade_strategy` | string | Optional | Parameter for Deisolate Endpoint | | `policy.audit_killswitch` | boolean | Optional | Parameter for Deisolate Endpoint | | `policy.binary_download_enabled` | boolean | Optional | Parameter for Deisolate Endpoint | | `policy.description` | string | Optional | Parameter for Deisolate Endpoint | | `policy.driverblock_mode` | number | Optional | Driverblock Mode. Maximum is 3 and minimum is 0. | | `policy.feature_callback_tampering` | boolean | Optional | Parameter for Deisolate Endpoint | | `policy.feature_dse_tampering_mode` | number | Optional | Feature Dse Tampering Mode. Maximum value is 2147483647 and Minimum value is -2147483648. | | `policy.feature_event_stacktrace` | boolean | Optional | Parameter for Deisolate Endpoint | ### Input Example `{"json_body":{"additional_info":{"additional_info1":"","additional_info2":"","additional_info3":"","additional_info4":""},"description":"","group_count":0,"id":"3fa85f64-5717-4562-b3fc-2c963f66afa6","policy":{"agent_auto_forget":false,"agent_auto_forget_max_days":1,"agent_auto_update":false,"agent_ui_admin_message":"","agent_ui_enabled":true,"agent_ui_notification_level":2147483647,"agent_ui_notification_scope":2147483647,"agent_upgrade_strategy":"latest","audit_killswitch":true,"binary_download_enabled":true,"description":"","driverblock_mode":3,"feature_callback_tampering":true,"feature_dse_tampering_mode":2147483647,"feature_event_stacktrace":true,"feature_live_process_heuristics":true,"feature_ppl_antimalware":true,"feature_process_tampering":true,"feature_windows_filesystem_events":true,"fim_policy":"3fa85f64-5717-4562-b3fc-2c963f66afa6","hibou_minimum_level":"","hibou_mode":3,"hibou_skip_signed_ms":true,"hibou_skip_signed_others":true,"hlai_minimum_level":"","hlai_mode":3,"hlai_pdf":true,"hlai_scan_libraries":true,"hlai_scripts_minimum_level":"","hlai_scripts_mode":3,"hlai_skip_signed_ms":true,"hlai_skip_signed_others":true,"hlai_written_executable":true,"ioc_mode":3,"ioc_ruleset":0,"ioc_scan_libraries":true,"ioc_scan_written_executable":true,"isolation_exclusions_revision":2147483647,"library_download_enabled":true,"linux_paths_other_watched_globs":["/dev/shm/**","/home/*/*","/tmp/**"],"linux_self_protection":true,"linux_self_protection_feature_hosts":true,"linux_startup_block":true,"linux_use_isolation":true,"local_endpoint_cache_size":10240,"loglevel":"","macos_paths_muted_exact":["/Library/Bluetooth/com.apple.MobileBluetooth.ledevices.paired.db-wal","/private/var/root/Library/Logs/Bluetooth/bluetoothd-hci-latest.pklg"],"macos_paths_muted_globs":[],"macos_paths_muted_prefixes":["/System/Volumes/Data/.Spotlight-V100/","/usr/sbin/"],"macos_paths_other_watched_exact":["/.ssh/authorized_keys","/etc/resolv.conf","/private/var/at/cron.deny","/var/run/utmpx"],"macos_paths_other_watched_globs":["/Users/*/*","/etc/ssl/*"],"macos_paths_other_watched_prefixes":["/Library/LaunchAgents/","/private/var/at/tabs/"],"macos_paths_read_watched_exact":["/.ssh/authorized_keys","/var/run/utmpx"],"macos_paths_read_watched_globs":["/Users/*/*","/etc/ssl/*"],"macos_paths_read_watched_prefixes":["/Library/LaunchAgents/","/private/var/at/tabs/"],"macos_paths_write_watched_exact":["/private/var/at/cron.allow","/var/run/utmpx"],"macos_paths_write_watched_globs":["/Users/*/*","/etc/ssl/*"],"macos_paths_write_watched_prefixes":["/Library/LaunchAgents/","/private/var/at/tabs/"],"name":"","origin_stack":{"id":"","is_current":true,"is_supervisor":true,"is_tenant":true,"name":""},"ransomguard_heuristic_mode":2147483647,"ransomguard_mode":3,"self_protection":true,"self_protection_feature_hosts":true,"self_protection_feature_safe_mode":true,"self_protection_firewall":true,"sidewatch_mode":3,"sigma_mode":3,"sigma_ruleset":0,"sleepjitter":2147483647,"sleeptime":2147483647,"synchronization_status":"3fa85f64-5717-4562-b3fc-2c963f66afa6","telemetry_alerts_limit":true,"telemetry_alerts_limit_value":2147483647,"telemetry_amsi_dynamic_scripts_limit":true,"telemetry_amsi_dynamic_scripts_limit_value":2147483647,"telemetry_amsi_dynamic_scripts_state":"disabled","telemetry_amsi_other_scans_limit":true,"telemetry_amsi_other_scans_limit_value":2147483647,"telemetry_amsi_other_scans_state":"disabled","telemetry_authentication":true,"telemetry_authentication_limit":true,"telemetry_authentication_limit_value":2147483647,"telemetry_authentication_state":"disabled","telemetry_dns_resolution":true,"telemetry_dns_resolution_limit":true,"telemetry_dns_resolution_limit_value":2147483647,"telemetry_dns_resolution_state":"disabled","telemetry_dotnet_library_state":"disabled","telemetry_driverload":true,"telemetry_driverload_limit":true,"telemetry_driverload_limit_value":2147483647,"telemetry_driverload_state":"disabled","telemetry_file_download_limit":true,"telemetry_file_download_limit_value":2147483647,"telemetry_file_download_state":"disabled","telemetry_file_limit":true,"telemetry_file_limit_value":2147483647,"telemetry_file_state":"disabled","telemetry_library_load_limit":true,"telemetry_library_load_limit_value":2147483647,"telemetry_library_load_state":"disabled","telemetry_log":true,"telemetry_log_limit":true,"telemetry_log_limit_value":2147483647,"telemetry_log_state":"disabled","telemetry_named_pipe_limit":true,"telemetry_named_pipe_limit_value":2147483647,"telemetry_named_pipe_state":"disabled","telemetry_network":true,"telemetry_network_limit":true,"telemetry_network_limit_value":2147483647,"telemetry_network_listen_limit":true,"telemetry_network_listen_limit_value":2147483647,"telemetry_network_listen_state":"disabled","telemetry_network_state":"disabled","telemetry_on_alert_enabled":true,"telemetry_on_alert_post_alert_max_duration_secs":2147483647,"telemetry_on_alert_post_alert_max_event_count":2147483647,"telemetry_on_alert_pre_alert_event_count":2147483647,"telemetry_powershell":true,"telemetry_powershell_limit":true,"telemetry_powershell_limit_value":2147483647,"telemetry_powershell_state":"disabled","telemetry_process":true,"telemetry_process_access_limit":true,"telemetry_process_access_limit_value":2147483647,"telemetry_process_access_state":"disabled","telemetry_process_limit":true,"telemetry_process_limit_value":2147483647,"telemetry_process_state":"disabled","telemetry_process_tamper_limit":true,"telemetry_process_tamper_limit_value":2147483647,"telemetry_process_tamper_state":"disabled","telemetry_raw_device_access_limit":true,"telemetry_raw_device_access_limit_value":2147483647,"telemetry_raw_device_access_state":"disabled","telemetry_raw_socket_creation_limit":true,"telemetry_raw_socket_creation_limit_value":2147483647,"telemetry_raw_socket_creation_state":"disabled","telemetry_registry_limit":true,"telemetry_registry_limit_value":2147483647,"telemetry_registry_state":"disabled","telemetry_remotethread":true,"telemetry_remotethread_limit":true,"telemetry_remotethread_limit_value":2147483647,"telemetry_remotethread_state":"disabled","telemetry_service_limit":true,"telemetry_service_limit_value":2147483647,"telemetry_service_state":"disabled","telemetry_url_request_limit":true,"telemetry_url_request_limit_value":2147483647,"telemetry_url_request_state":"disabled","telemetry_usb_activity_limit":true,"telemetry_usb_activity_limit_value":2147483647,"telemetry_usb_activity_state":"disabled","telemetry_user_group_limit":true,"telemetry_user_group_limit_value":2147483647,"telemetry_user_group_state":"disabled","telemetry_wmi_event_limit":true,"telemetry_wmi_event_limit_value":2147483647,"telemetry_wmi_event_state":"disabled","thread_download_enabled":true,"use_isolation":true,"vulnerability_policy":"3fa85f64-5717-4562-b3fc-2c963f66afa6","windows_eventlog_config":{"detection_events":{},"telemetry_events":{}},"windows_read_watched_paths":["*\\PROGRAM FILES*","*\\\\USERS\\*"],"windows_registry_read_blacklist":[],"windows_registry_read_whitelist":["HKLM\\SAM\\SAM\\DOMAINS\\ACCOUNT\\USERS\\*\\*","HKLM\\SECURITY\\CACHE\\*","HKU\\*\\SOFTWARE\\SIMONTATHAM\\*"],"windows_self_protection":true,"windows_self_protection_feature_firewall":true,"windows_self_protection_feature_hosts":true,"windows_self_protection_feature_safe_mode":true,"windows_write_watched_paths":["*\\PROGRAM FILES*","*\\WINDOWS\\SYSTEM32\\TASKS\\*"],"yara_mode":3,"yara_ruleset":0,"yara_scan_libraries_load":true,"yara_scan_written_executable":true,"yara_skip_signed_ms":true,"yara_skip_signed_others":true},"subnet":{}},"path_parameters":{"id":"3fa85f64-5717-4562-b3fc-2c963f66afa6"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------- | -------- | ---------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `policy_not_allowed` | array | Output field: policy\_not\_allowed | | `policy_not_allowed.hostname` | string | Name of the resource | | `policy_not_allowed.id` | string | Unique identifier | | `requested` | array | Output field: requested | | `requested.hostname` | string | Name of the resource | | `requested.id` | string | Unique identifier | | `unrequested` | array | Output field: unrequested | | `unrequested.hostname` | string | Name of the resource | | `unrequested.id` | string | Unique identifier | | `unsupported` | array | Output field: unsupported | | `unsupported.hostname` | string | Name of the resource | | `unsupported.id` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{"Content-Type":"text/html; charset=utf-8","x-hsci-cache-time":"2024-12-18T12:01:22.328Z"},"reason":"OK","json_body":{"policy_not_allowed":[{}],"requested":[{}],"unrequested":[{}],"unsupported":[{}]}}` ## Endpoint Search Retrieve endpoint information from HarfangLab by conducting a targeted search. ### Endpoint - **URL:** `/api/data/endpoint/Agent` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------- | -------- | ------------ | ----------------------------------------- | | `parameters.search` | string | Optional | Parameters for the Endpoint Search action | | `parameters.ordering` | string | Optional | Parameters for the Endpoint Search action | | `parameters.id` | string | Optional | Parameters for the Endpoint Search action | | `parameters.domainname` | string | Optional | Parameters for the Endpoint Search action | | `parameters.dnsdomainname` | string | Optional | Parameters for the Endpoint Search action | | `parameters.hostname` | string | Optional | Parameters for the Endpoint Search action | | `parameters.osmajor` | number | Optional | Parameters for the Endpoint Search action | | `parameters.osminor` | number | Optional | Parameters for the Endpoint Search action | | `parameters.osproducttype` | string | Optional | Parameters for the Endpoint Search action | | `parameters.firstseen` | string | Optional | Parameters for the Endpoint Search action | | `parameters.lastseen` | string | Optional | Parameters for the Endpoint Search action | | `parameters.version` | string | Optional | Parameters for the Endpoint Search action | | `parameters.bitness` | string | Optional | Parameters for the Endpoint Search action | | `parameters.domain` | string | Optional | Parameters for the Endpoint Search action | | `parameters.installdate` | string | Optional | Parameters for the Endpoint Search action | | `parameters.ipaddress` | string | Optional | Parameters for the Endpoint Search action | | `parameters.external_ipaddress` | string | Optional | Parameters for the Endpoint Search action | | `parameters.osbuild` | number | Optional | Parameters for the Endpoint Search action | | `parameters.osid` | string | Optional | Parameters for the Endpoint Search action | | `parameters.osversion` | string | Optional | Parameters for the Endpoint Search action | | `parameters.producttype` | string | Optional | Parameters for the Endpoint Search action | | `parameters.servicepack` | string | Optional | Parameters for the Endpoint Search action | | `parameters.total_memory` | number | Optional | Parameters for the Endpoint Search action | | `parameters.cpu_count` | number | Optional | Parameters for the Endpoint Search action | | `parameters.cpu_frequency` | number | Optional | Parameters for the Endpoint Search action | ### Input Example `{"parameters":{"search":"string","ordering":"string","id":"12345678-1234-1234-1234-123456789abc","domainname":"Example Name","dnsdomainname":"Example Name","hostname":"Example Name","osmajor":123,"osminor":123,"osproducttype":"string","firstseen":"string","lastseen":"string","version":"string","bitness":"string","domain":"string","installdate":"string","ipaddress":"string","external_ipaddress":"string","osbuild":123,"osid":"string","osversion":"string","producttype":"string","servicepack":"string","total_memory":123,"cpu_count":123,"cpu_frequency":123,"avg_cpu":123,"avg_memory":123,"avg_system_cpu":123,"avg_system_memory":123,"starttime":"string","machine_boottime":"string","subnet__gateway_ipaddress":"string","subnet__gateway_macaddress":"string","subnet__name":"Example Name","isolation_state":"string","antivirus_name":"Example Name","antivirus_version":"string","antivirus_rules_version":"string","antivirus_last_update_date":"string","antivirus_rules_last_update_date":"string","additional_info":"string","additional_info__additional_info1":"string","additional_info__additional_info2":"string","additional_info__additional_info3":"string"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `count` | number | Count value | | `next` | string | Output field: next | | `previous` | string | Output field: previous | | `results` | array | Result of the operation | | `results.additional_info` | object | Result of the operation | | `results.additional_info.additional_info1` | string | Result of the operation | | `results.antivirus_last_update_date` | string | Result of the operation | | `results.antivirus_name` | string | Name of the resource | | `results.antivirus_profile` | object | Result of the operation | | `results.antivirus_profile.agent_count` | number | Result of the operation | | `results.antivirus_profile.antivirus_object` | object | Result of the operation | | `results.antivirus_profile.antivirus_slug` | string | Result of the operation | | `results.antivirus_profile.creation_date` | string | Result of the operation | | `results.antivirus_profile.description` | string | Result of the operation | | `results.antivirus_profile.id` | string | Unique identifier | | `results.antivirus_profile.last_modifier` | object | Result of the operation | | `results.antivirus_profile.last_modifier.id` | number | Unique identifier | | `results.antivirus_profile.last_modifier.username` | string | Name of the resource | | `results.antivirus_profile.last_update` | string | Result of the operation | | `results.antivirus_profile.name` | string | Name of the resource | | `results.antivirus_profile.revision` | number | Result of the operation | | `results.antivirus_profile_status` | string | Status value | | `results.antivirus_rules_last_update_date` | string | Result of the operation | ### Output Example `{"count":123,"next":"string","previous":"string","results":[{"additional_info":{},"antivirus_last_update_date":"string","antivirus_name":"Example Name","antivirus_profile":{},"antivirus_profile_status":"active","antivirus_rules_last_update_date":"string","antivirus_rules_version":"string","antivirus_version":"string","application_count":123,"avg_cpu":123,"avg_memory":123,"avg_system_cpu":123,"avg_system_memory":123,"bitness":"string","cpu_count":123}]}` ## Fetch Incidents Fetches a list of incidents from HarfangLab, providing an overview of security alerts and breaches. ### Endpoint - **URL:** `/api/data/alert/alert/Alert` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | ----------------------------------------- | | `parameters.limit` | number | Optional | Parameters for the Fetch Incidents action | | `parameters.offset` | number | Optional | Parameters for the Fetch Incidents action | ### Input Example `{"parameters":{"limit":3,"offset":1}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `count` | number | Count value | | `next` | string | Output field: next | | `previous` | string | Output field: previous | | `results` | array | Result of the operation | | `filters` | object | Output field: filters | | `filters.wildcard` | array | Output field: filters.wildcard | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"count":0,"next":"","previous":"/api/data/alert/alert/Alert/?limit=3","results":[""],"filters":{"wildcard":[]}}}` ## Get Endpoint Info Retrieve detailed information for a specific Agent in HarfangLab using the provided unique identifier (ID). ### Endpoint - **URL:** `/api/data/endpoint/Agent/{{id}}` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------- | -------- | ------------ | ------------------------------------------- | | `path_parameters.id` | string | Required | Parameters for the Get Endpoint Info action | ### Input Example `{"path_parameters":{"id":"12345678-1234-1234-1234-123456789abc"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------------ | -------- | -------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `additional_info` | object | Output field: additional\_info | | `additional_info.additional_info1` | string | Output field: additional\_info.additional\_info1 | | `additional_info.additional_info2` | string | Output field: additional\_info.additional\_info2 | | `additional_info.additional_info3` | string | Output field: additional\_info.additional\_info3 | | `additional_info.additional_info4` | string | Output field: additional\_info.additional\_info4 | | `antivirus_last_update_date` | string | Date value | | `antivirus_name` | string | Name of the resource | | `antivirus_profile` | object | Output field: antivirus\_profile | | `antivirus_profile.agent_count` | number | Count value | | `antivirus_profile.antivirus_object` | object | Output field: antivirus\_profile.antivirus\_object | | `antivirus_profile.antivirus_slug` | string | Output field: antivirus\_profile.antivirus\_slug | | `antivirus_profile.creation_date` | string | Date value | | `antivirus_profile.description` | string | Output field: antivirus\_profile.description | | `antivirus_profile.id` | string | Unique identifier | | `antivirus_profile.last_modifier` | object | Output field: antivirus\_profile.last\_modifier | | `antivirus_profile.last_modifier.id` | number | Unique identifier | | `antivirus_profile.last_modifier.username` | string | Name of the resource | | `antivirus_profile.last_update` | string | Date value | | `antivirus_profile.name` | string | Name of the resource | | `antivirus_profile.revision` | number | Output field: antivirus\_profile.revision | | `antivirus_profile_status` | string | Status value | | `antivirus_rules_last_update_date` | string | Date value | | `antivirus_rules_version` | string | Output field: antivirus\_rules\_version | ### Output Example `{"additional_info":{"additional_info1":"string","additional_info2":"string","additional_info3":"string","additional_info4":"string"},"antivirus_last_update_date":"string","antivirus_name":"Example Name","antivirus_profile":{"agent_count":123,"antivirus_object":{},"antivirus_slug":"string","creation_date":"string","description":"string","id":"12345678-1234-1234-1234-123456789abc","last_modifier":{"id":123,"username":"Example Name"},"last_update":"string","name":"Example Name","revision":123},"ant...` ## Isolate Endpoint Initiates network isolation on a specified agent using its ID in HarfangLab, to contain potential threats. ### Endpoint - **URL:** `/api/data/endpoint/Agent/{{id}}/isolate/` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------ | -------- | ------------ | ------------------------------------------------------------------------------------------ | | `path_parameters.id` | string | Required | Parameters for the Isolate Endpoint action | | `additional_info` | object | Optional | Parameter for Isolate Endpoint | | `additional_info.additional_info1` | string | Optional | Parameter for Isolate Endpoint | | `additional_info.additional_info2` | string | Optional | Parameter for Isolate Endpoint | | `additional_info.additional_info3` | string | Optional | Parameter for Isolate Endpoint | | `additional_info.additional_info4` | string | Optional | Parameter for Isolate Endpoint | | `description` | string | Optional | Parameter for Isolate Endpoint | | `group_count` | number | Optional | Count value | | `id` | string | Optional | Unique identifier | | `policy` | object | Optional | Parameter for Isolate Endpoint | | `policy.agent_auto_forget` | boolean | Optional | Parameter for Isolate Endpoint | | `policy.agent_auto_forget_max_days` | number | Optional | Agent Auto Forget Max Days. Minimum value is 1. | | `policy.agent_auto_update` | boolean | Optional | Date value | | `policy.agent_ui_admin_message` | string | Optional | Response message | | `policy.agent_ui_enabled` | boolean | Optional | Parameter for Isolate Endpoint | | `policy.agent_ui_notification_level` | number | Optional | Agent UI Notification Level. Maximum value is 2147483647 and Minimum value is -2147483648. | | `policy.agent_ui_notification_scope` | number | Optional | Agent UI Notification Scope. Maximum value is 2147483647 and Minimum value is -2147483648. | | `policy.agent_upgrade_strategy` | string | Optional | Parameter for Isolate Endpoint | | `policy.audit_killswitch` | boolean | Optional | Parameter for Isolate Endpoint | | `policy.binary_download_enabled` | boolean | Optional | Parameter for Isolate Endpoint | | `policy.description` | string | Optional | Parameter for Isolate Endpoint | | `policy.driverblock_mode` | number | Optional | Driverblock Mode. Maximum is 3 and minimum is 0. | | `policy.feature_callback_tampering` | boolean | Optional | Parameter for Isolate Endpoint | | `policy.feature_dse_tampering_mode` | number | Optional | Feature Dse Tampering Mode. Maximum value is 2147483647 and Minimum value is -2147483648. | | `policy.feature_event_stacktrace` | boolean | Optional | Parameter for Isolate Endpoint | ### Input Example `{"json_body":{"additional_info":{"additional_info1":"","additional_info2":"","additional_info3":"","additional_info4":""},"description":"","group_count":0,"id":"3fa85f64-5717-4562-b3fc-2c963f66afa6","policy":{"agent_auto_forget":false,"agent_auto_forget_max_days":1,"agent_auto_update":false,"agent_ui_admin_message":"","agent_ui_enabled":true,"agent_ui_notification_level":2147483647,"agent_ui_notification_scope":2147483647,"agent_upgrade_strategy":"latest","audit_killswitch":true,"binary_download_enabled":true,"description":"","driverblock_mode":3,"feature_callback_tampering":true,"feature_dse_tampering_mode":2147483647,"feature_event_stacktrace":true,"feature_live_process_heuristics":true,"feature_ppl_antimalware":true,"feature_process_tampering":true,"feature_windows_filesystem_events":true,"fim_policy":"3fa85f64-5717-4562-b3fc-2c963f66afa6","hibou_minimum_level":"","hibou_mode":3,"hibou_skip_signed_ms":true,"hibou_skip_signed_others":true,"hlai_minimum_level":"","hlai_mode":3,"hlai_pdf":true,"hlai_scan_libraries":true,"hlai_scripts_minimum_level":"","hlai_scripts_mode":3,"hlai_skip_signed_ms":true,"hlai_skip_signed_others":true,"hlai_written_executable":true,"ioc_mode":3,"ioc_ruleset":0,"ioc_scan_libraries":true,"ioc_scan_written_executable":true,"isolation_exclusions_revision":2147483647,"library_download_enabled":true,"linux_paths_other_watched_globs":["/dev/shm/**","/home/*/*","/tmp/**"],"linux_self_protection":true,"linux_self_protection_feature_hosts":true,"linux_startup_block":true,"linux_use_isolation":true,"local_endpoint_cache_size":10240,"loglevel":"","macos_paths_muted_exact":["/Library/Bluetooth/com.apple.MobileBluetooth.ledevices.paired.db-wal","/private/var/root/Library/Logs/Bluetooth/bluetoothd-hci-latest.pklg"],"macos_paths_muted_globs":[],"macos_paths_muted_prefixes":["/System/Volumes/Data/.Spotlight-V100/","/usr/sbin/"],"macos_paths_other_watched_exact":["/.ssh/authorized_keys","/etc/resolv.conf","/private/var/at/cron.deny","/var/run/utmpx"],"macos_paths_other_watched_globs":["/Users/*/*","/etc/ssl/*"],"macos_paths_other_watched_prefixes":["/Library/LaunchAgents/","/private/var/at/tabs/"],"macos_paths_read_watched_exact":["/.ssh/authorized_keys","/var/run/utmpx"],"macos_paths_read_watched_globs":["/Users/*/*","/etc/ssl/*"],"macos_paths_read_watched_prefixes":["/Library/LaunchAgents/","/private/var/at/tabs/"],"macos_paths_write_watched_exact":["/private/var/at/cron.allow","/var/run/utmpx"],"macos_paths_write_watched_globs":["/Users/*/*","/etc/ssl/*"],"macos_paths_write_watched_prefixes":["/Library/LaunchAgents/","/private/var/at/tabs/"],"name":"","origin_stack":{"id":"","is_current":true,"is_supervisor":true,"is_tenant":true,"name":""},"ransomguard_heuristic_mode":2147483647,"ransomguard_mode":3,"self_protection":true,"self_protection_feature_hosts":true,"self_protection_feature_safe_mode":true,"self_protection_firewall":true,"sidewatch_mode":3,"sigma_mode":3,"sigma_ruleset":0,"sleepjitter":2147483647,"sleeptime":2147483647,"synchronization_status":"3fa85f64-5717-4562-b3fc-2c963f66afa6","telemetry_alerts_limit":true,"telemetry_alerts_limit_value":2147483647,"telemetry_amsi_dynamic_scripts_limit":true,"telemetry_amsi_dynamic_scripts_limit_value":2147483647,"telemetry_amsi_dynamic_scripts_state":"disabled","telemetry_amsi_other_scans_limit":true,"telemetry_amsi_other_scans_limit_value":2147483647,"telemetry_amsi_other_scans_state":"disabled","telemetry_authentication":true,"telemetry_authentication_limit":true,"telemetry_authentication_limit_value":2147483647,"telemetry_authentication_state":"disabled","telemetry_dns_resolution":true,"telemetry_dns_resolution_limit":true,"telemetry_dns_resolution_limit_value":2147483647,"telemetry_dns_resolution_state":"disabled","telemetry_dotnet_library_state":"disabled","telemetry_driverload":true,"telemetry_driverload_limit":true,"telemetry_driverload_limit_value":2147483647,"telemetry_driverload_state":"disabled","telemetry_file_download_limit":true,"telemetry_file_download_limit_value":2147483647,"telemetry_file_download_state":"disabled","telemetry_file_limit":true,"telemetry_file_limit_value":2147483647,"telemetry_file_state":"disabled","telemetry_library_load_limit":true,"telemetry_library_load_limit_value":2147483647,"telemetry_library_load_state":"disabled","telemetry_log":true,"telemetry_log_limit":true,"telemetry_log_limit_value":2147483647,"telemetry_log_state":"disabled","telemetry_named_pipe_limit":true,"telemetry_named_pipe_limit_value":2147483647,"telemetry_named_pipe_state":"disabled","telemetry_network":true,"telemetry_network_limit":true,"telemetry_network_limit_value":2147483647,"telemetry_network_listen_limit":true,"telemetry_network_listen_limit_value":2147483647,"telemetry_network_listen_state":"disabled","telemetry_network_state":"disabled","telemetry_on_alert_enabled":true,"telemetry_on_alert_post_alert_max_duration_secs":2147483647,"telemetry_on_alert_post_alert_max_event_count":2147483647,"telemetry_on_alert_pre_alert_event_count":2147483647,"telemetry_powershell":true,"telemetry_powershell_limit":true,"telemetry_powershell_limit_value":2147483647,"telemetry_powershell_state":"disabled","telemetry_process":true,"telemetry_process_access_limit":true,"telemetry_process_access_limit_value":2147483647,"telemetry_process_access_state":"disabled","telemetry_process_limit":true,"telemetry_process_limit_value":2147483647,"telemetry_process_state":"disabled","telemetry_process_tamper_limit":true,"telemetry_process_tamper_limit_value":2147483647,"telemetry_process_tamper_state":"disabled","telemetry_raw_device_access_limit":true,"telemetry_raw_device_access_limit_value":2147483647,"telemetry_raw_device_access_state":"disabled","telemetry_raw_socket_creation_limit":true,"telemetry_raw_socket_creation_limit_value":2147483647,"telemetry_raw_socket_creation_state":"disabled","telemetry_registry_limit":true,"telemetry_registry_limit_value":2147483647,"telemetry_registry_state":"disabled","telemetry_remotethread":true,"telemetry_remotethread_limit":true,"telemetry_remotethread_limit_value":2147483647,"telemetry_remotethread_state":"disabled","telemetry_service_limit":true,"telemetry_service_limit_value":2147483647,"telemetry_service_state":"disabled","telemetry_url_request_limit":true,"telemetry_url_request_limit_value":2147483647,"telemetry_url_request_state":"disabled","telemetry_usb_activity_limit":true,"telemetry_usb_activity_limit_value":2147483647,"telemetry_usb_activity_state":"disabled","telemetry_user_group_limit":true,"telemetry_user_group_limit_value":2147483647,"telemetry_user_group_state":"disabled","telemetry_wmi_event_limit":true,"telemetry_wmi_event_limit_value":2147483647,"telemetry_wmi_event_state":"disabled","thread_download_enabled":true,"use_isolation":true,"vulnerability_policy":"3fa85f64-5717-4562-b3fc-2c963f66afa6","windows_eventlog_config":{"detection_events":{},"telemetry_events":{}},"windows_read_watched_paths":["*\\PROGRAM FILES*","*\\\\USERS\\*"],"windows_registry_read_blacklist":[],"windows_registry_read_whitelist":["HKLM\\SAM\\SAM\\DOMAINS\\ACCOUNT\\USERS\\*\\*","HKLM\\SECURITY\\CACHE\\*","HKU\\*\\SOFTWARE\\SIMONTATHAM\\*"],"windows_self_protection":true,"windows_self_protection_feature_firewall":true,"windows_self_protection_feature_hosts":true,"windows_self_protection_feature_safe_mode":true,"windows_write_watched_paths":["*\\PROGRAM FILES*","*\\WINDOWS\\SYSTEM32\\TASKS\\*"],"yara_mode":3,"yara_ruleset":0,"yara_scan_libraries_load":true,"yara_scan_written_executable":true,"yara_skip_signed_ms":true,"yara_skip_signed_others":true},"subnet":{}},"path_parameters":{"id":"3fa85f64-5717-4562-b3fc-2c963f66afa6"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------- | -------- | ---------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `policy_not_allowed` | array | Output field: policy\_not\_allowed | | `policy_not_allowed.hostname` | string | Name of the resource | | `policy_not_allowed.id` | string | Unique identifier | | `requested` | array | Output field: requested | | `requested.hostname` | string | Name of the resource | | `requested.id` | string | Unique identifier | | `unrequested` | array | Output field: unrequested | | `unrequested.hostname` | string | Name of the resource | | `unrequested.id` | string | Unique identifier | | `unsupported` | array | Output field: unsupported | | `unsupported.hostname` | string | Name of the resource | | `unsupported.id` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{"Content-Type":"text/html; charset=utf-8","x-hsci-cache-time":"2024-12-18T12:01:22.328Z"},"reason":"OK","json_body":{"policy_not_allowed":[{}],"requested":[{}],"unrequested":[{}],"unsupported":[{}]}}` # Response Headers | **Header** | **Description** | **Example** | | ----------------- | ----------------------------------------------------- | ----------------------------- | | Content-Type | The media type of the resource | text/html; charset=utf-8 | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT | | x-hsci-cache-time | HTTP response header: x-hsci-cache-time | 2024-12-18T12:01:22.328Z |