HarfangLab

HarfangLab

1) Connector overview

Field
Value
Type
EDR
Vendor platform
 https://harfanglab.io 
Vendor documentation
Available from your HarfangLab console, once signed in.
Pre-filtered link
Yes. Opens the Security Events page of the HarfangLab agent installed on the target, filtered on the detection date over the execution window of the event. BlackNoise finds this agent from the IP address of the target, through an API call to HarfangLab.
API data retrieval
Yes. For each security event: rule name, level, confidence, execution, detection date and detected command. The execution field tells you whether HarfangLab only detected the action or also blocked it. The name of the alert links to its details in the HarfangLab console.
Qualification modes
Automatic & Semi-automatic
Automatic behavior
Sets the Alerted detection status when at least one command reported by a HarfangLab security event matches an IOC command of the BlackNoise event.
See  Connectors  for how the pre-filtered link, data collection and qualification modes work, and  Event statuses & severity  for the meaning of the detection statuses.

2) Configuration

Before you start

You need:
  • an HarfangLab account allowed to create users and enable API tokens;
  • the API URL of your HarfangLab instance;
  • HTTPS access from BlackNoise to your HarfangLab API URL. For on-premises instances, allow inbound HTTPS traffic from BlackNoise to the API URL on the configured port. BlackNoise initiates all connections. Contact your BlackNoise administrator for the source IP address.

Prepare HarfangLab

BlackNoise reads your HarfangLab data through a dedicated user that holds an API token.
Step 1 - Create a user for BlackNoise. In the HarfangLab console, create a user dedicated to BlackNoise. Grant it at least the View permission on Security Events, Threats and Endpoints. A dedicated user makes the access easy to identify and to revoke.
Step 2 - Enable an API token. Enable an API token for this user and copy it. The token gives access to your HarfangLab data: store it in your password manager, and never paste it into a ticket or a chat.

Fill in the connector in BlackNoise

In BlackNoise, open Resources > Connectors and click Configure on the HarfangLab card.
Field
What it is
Where to find it
API URL
Address of the API of your HarfangLab instance
The address of your HarfangLab console, for example https://your-instance.hurukai.io:8443
API key
API token of the user created for BlackNoise
Enabled in step 2
The same window offers an option to disable verification of the TLS certificate of your HarfangLab instance. See  Connectors  for when to use it.
Click Save and connect. BlackNoise runs connection tests, and the connector becomes operational if they pass.