Skip to main content

HarfangLab EDR

Download With Dependencies

This connector allows to fetch security events from a HarfangLab EDR Manager and manage the incident response.

HarfangLab EDR

This connector allows to fetch security events from a HarfangLab EDR Manager and manage the incident response.

It is shipped with:

  • an integration with 60+ commands/tasks,
  • an alert management playbook including 20+ subplaybooks,
  • several Threat Intelligence Management playbooks that allows to hunt for IOCs in the EDR, manually review the IOC sightings and then put the IOCs into detection in the EDR,
  • an alert type along with its associated incident mapper,
  • a specific alert layout tailored to HarfangLab EDR alerts.

The alert management playbook illustrates several steps of a typical incident response with forensics activities:

  1. Endpoint isolation
  2. Forensics data collection
  3. Raw artifacts collection
  4. Agent reconnection
  5. Case closing

HarfangLab EDR

This connector allows to fetch security events from a HarfangLab EDR Manager and manage the incident response.

It is shipped with:

  • an integration with 60+ commands/tasks,
  • an alert management playbook including 20+ subplaybooks,
  • several Threat Intelligence Management playbooks that allows to hunt for IOCs in the EDR, manually review the IOC sightings and then put the IOCs into detection in the EDR,
  • an alert type along with its associated incident mapper,
  • a specific alert layout tailored to HarfangLab EDR alerts.

The alert management playbook illustrates several steps of a typical incident response with forensics activities:

  1. Endpoint isolation
  2. Forensics data collection
  3. Raw artifacts collection
  4. Agent reconnection
  5. Case closing

PUBLISHER

HarfangLab

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

CertificationRead more
Supported ByPartner
CreatedMay 18, 2022
Last ReleaseSeptember 12, 2023
WORKS WITH THE FOLLOWING INTEGRATIONS:
DISCLAIMER
Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.