(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start': new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0], j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src= 'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f); })(window,document,'script','dataLayer','GTM-WRBNM36X'); (function(ss,ex){ window.ldfdr=window.ldfdr||function(){(ldfdr._q=ldfdr._q||[]).push([].slice.call(arguments));}; (function(d,s){ fs=d.getElementsByTagName(s)[0]; function ce(src){ var cs=d.createElement(s); cs.src=src; cs.async=1; fs.parentNode.insertBefore(cs,fs); }; ce('https://sc.lfeeder.com/lftracker_v1_'+ss+(ex?'_'+ex:'')+'.js'); })(document,'script'); })('bElvO7322MM8ZMqj');
TheHive enters a new era with TheHive Flow, its native orchestration and automation layer! 
TheHive enters a new era with TheHive Flow, its native orchestration and automation layer! 
Learn more
Learn more
EN
English
Request a demo
EN
English
Products
Pricing
Company
Resources
Events
Request a demo
See all integrations

HarfangLab

European endpoint security platform (EDR/EPP) certified by ANSSI and BSI, providing real-time threat detection, protection, and investigation capabilities
EDR
TheHive Flow Node
31 Responders
1 External integration
harfanglab.io GitHub

Responders (31)

Trigger automated responses

HarfangLab-UnisolateHost v1.0

Isolate machine with HarfangLab EDR

  • Author: HarfangLab Product Team
  • License: AGPL-V3
  • Data Types: thehive:case, thehive:alert

HarfangLab-KillProcess v1.0

Kill a process

  • Author: HarfangLab Product Team
  • License: AGPL-V3
  • Data Types: thehive:case, thehive:alert

HarfangLab-GetArtifactLogs v1.0

Get Linux logs artifact

  • Author: HarfangLab Product Team
  • License: AGPL-V3
  • Data Types: thehive:case

HarfangLab-GetPersistence v1.0

Get persistence items on a Linux host

  • Author: HarfangLab Product Team
  • License: AGPL-V3
  • Data Types: thehive:case

HarfangLab-GetArtifactHives v1.0

Get Hives artifact

  • Author: HarfangLab Product Team
  • License: AGPL-V3
  • Data Types: thehive:case

HarfangLab-GetDrivers v1.0

Get drivers loaded on a host

  • Author: HarfangLab Product Team
  • License: AGPL-V3
  • Data Types: thehive:case

HarfangLab-GetSessions v1.0

Get sessions on a host

  • Author: HarfangLab Product Team
  • License: AGPL-V3
  • Data Types: thehive:case

HarfangLab-GetPipes v1.0

Get pipes on a host

  • Author: HarfangLab Product Team
  • License: AGPL-V3
  • Data Types: thehive:case

HarfangLab-GetScheduledTasks v1.0

Get scheduled tasks on a host

  • Author: HarfangLab Product Team
  • License: AGPL-V3
  • Data Types: thehive:case

HarfangLab-SearchDestinationIP v1.0

Search an IP in HarfangLab EDR's telemetry

  • Author: HarfangLab Product Team
  • License: AGPL-V3
  • Data Types: thehive:case_artifact

HarfangLab-GetNetworkShares v1.0

Get network shares on a host

  • Author: HarfangLab Product Team
  • License: AGPL-V3
  • Data Types: thehive:case

HarfangLab-DumpProcess v1.0

Dump process memory

  • Author: HarfangLab Product Team
  • License: AGPL-V3
  • Data Types: thehive:case

HarfangLab-GetPrefetches v1.0

Get prefetches on a host

  • Author: HarfangLab Product Team
  • License: AGPL-V3
  • Data Types: thehive:case

HarfangLab-GetRunKeys v1.0

Get RUN keys on a host

  • Author: HarfangLab Product Team
  • License: AGPL-V3
  • Data Types: thehive:case

HarfangLab-GetArtifactMFT v1.0

Get MFT artifact

  • Author: HarfangLab Product Team
  • License: AGPL-V3
  • Data Types: thehive:case

HarfangLab-GetBinary v1.0

Get binary information and download link

  • Author: HarfangLab Product Team
  • License: AGPL-V3
  • Data Types: thehive:case_artifact

HarfangLab-SearchHash v1.0

Search a hash in HarfangLab EDR's telemetry

  • Author: HarfangLab Product Team
  • License: AGPL-V3
  • Data Types: thehive:case_artifact

HarfangLab-GetArtifactFilesystem v1.0

Get Linux filesystem artifact

  • Author: HarfangLab Product Team
  • License: AGPL-V3
  • Data Types: thehive:case

HarfangLab SearchDriverByHash v1.0

Search a driver load in HarfangLab EDR's telemetry per hash

  • Author: HarfangLab Product Team
  • License: AGPL-V3
  • Data Types: thehive:case_artifact

HarfangLab-GetServices v1.0

Get services on a host

  • Author: HarfangLab Product Team
  • License: AGPL-V3
  • Data Types: thehive:case

HarfangLab SearchDriverByFileName v1.0

Search a driver load in HarfangLab EDR's telemetry per filename

  • Author: HarfangLab Product Team
  • License: AGPL-V3
  • Data Types: thehive:case_artifact

HarfangLab-GetWMI v1.0

Get WMI items on a host

  • Author: HarfangLab Product Team
  • License: AGPL-V3
  • Data Types: thehive:case

HarfangLab-GetArtifactRamdump v1.0

Get RAM dump artifact

  • Author: HarfangLab Product Team
  • License: AGPL-V3
  • Data Types: thehive:case

HarfangLab-GetStartupFiles v1.0

Get startup files on a host

  • Author: HarfangLab Product Team
  • License: AGPL-V3
  • Data Types: thehive:case

HarfangLab-SearchSourceIP v1.0

Search an IP in HarfangLab EDR's telemetry

  • Author: HarfangLab Product Team
  • License: AGPL-V3
  • Data Types: thehive:case_artifact

HarfangLab-GetArtifactEvtx v1.0

Get Windows event logs artifact

  • Author: HarfangLab Product Team
  • License: AGPL-V3
  • Data Types: thehive:case

HarfangLab-GetArtifactPrefetch v1.0

Get prefetches artifact

  • Author: HarfangLab Product Team
  • License: AGPL-V3
  • Data Types: thehive:case

HarfangLab-IsolateHost v1.0

Isolate machine with HarfangLab EDR

  • Author: HarfangLab Product Team
  • License: AGPL-V3
  • Data Types: thehive:case, thehive:alert

HarfangLab-GetArtifactUSN v1.0

Get USN logs artifact

  • Author: HarfangLab Product Team
  • License: AGPL-V3
  • Data Types: thehive:case

HarfangLab-GetArtifactAll v1.0

Get all artifacts

  • Author: HarfangLab Product Team
  • License: AGPL-V3
  • Data Types: thehive:case

HarfangLab-GetProcesses v1.0

Get processes running on a host

  • Author: HarfangLab Product Team
  • License: AGPL-V3
  • Data Types: thehive:case

TheHive Flow node

Orchestrate this vendor from TheHive Flow workflows

Investigate and respond on HarfangLab-protected endpoints, including telemetry hunting and remote jobs.

Example use cases:

  • Isolate an endpoint and launch a forensic collection job
  • Hunt for an IOC across process, network and DNS telemetry of the whole fleet
  • Download a suspicious binary and send it to VirusTotal or a sandbox

TheHive Flow is TheHive's native automation and orchestration engine, available exclusively with the TheHive ONE plan.

External Integration

External integrations that connect HarfangLab with TheHive

TheHive Connector

Native connector provided by HarfangLab to send security events (SecEvents) from the HarfangLab EDR Manager to TheHive.

CrowdStrike Falcon
Splunk
VirusTotal
Microsoft Defender for Endpoint
Microsoft Entra ID
Microsoft Sentinel
MISP
Google Threat Intelligence
Recorded Future
Microsoft Defender for Office 365
Proofpoint
Shodan
Slack
AbuseIPDB
Cloudflare
URLScan.io
URLhaus
ONYPHE
YARA
CAPA
Telegram
Apache Kafka
Mattermost
Microsoft Teams
Redis
Abuse Finder
AIL Onion-Lookup
Airtable
AlienVault OTX
Ansible AWX
ANY.RUN
AWS Lambda
Axur
BackscatterIO
BinalyzeAIR
Censys
CERT.AT pDNS
ChainAbuse
CheckPhish
CheckPoint
Check Point Harmony Email & Collaboration
CIRCL Hash Lookup
CIRCL Passive DNS
CIRCL Passive SSL
CIRCL Vulnerability-Lookup
Cisco Duo
Cisco Secure Endpoint (Formerly AMP for Endpoints)
CiscoThreatGrid
CiscoThreatResponse
Cisco Umbrella
Cisco Umbrella Investigate
CISMCAP
ClamAV
Cluster25
ClusterHawk
CrowdSec
Crtsh
Cuckoo Sandbox
CyberChef
Cyberprotect
Cylance
DNS-RPZ
DNSDB
DNSdumpster
DNSLookingglass
DNSSinkhole
Domain Mail SPF DMARC
DomainTools
DomainTools Iris
DShield
EchoTrail
EclecticIQ
Elasticsearch
EmailRep
EmergingThreats
EmlParser
FileInfo
FireEye iSIGHT
FireHOL
Forcepoint WebsensePing
FoxIO
Gatewatcher CTI
Gmail
GoogleDNS
Google Safe Browsing
Google Vision API
GreyNoise
GRR Rapid Response
Hashdd
Have I Been Pwned
Hunter.io
Hybrid Analysis
IBM QRadar
IBM X-Force
Inoitsu
IntezerCommunity
IP-API
IPinfo
IPVoid
isMalicious
IVRE
JAMFProtect
Jira Cloud
Joe Sandbox
Jupyter
Kaspersky TIP
KnowBe4
LdapQuery
Lookyloo
LupovisProwl
Macadress
Mailer
MailIncidentStatus
Malpedia
Maltiverse
MalwareBazaar
MalwareClustering
Malware Hash Registry (MHR)
Malwares
MaxMind
MetaDefender
Microsoft Exchange Online
MISP Warning Lists
Mnemonic Passive DNS
MsgParser
MSRiskIQPassiveTotal
n8n
NERD
Nessus
Netcraft
NSRL
Okta
ONYPHEActiveScan
OpenCTI
OpenCVE
OrionMalware
OVHcloud
Palo Alto AutoFocus
PAN Cortex XDR
PAN Cortex XSOAR
PAN Next Generation Firewall
PAN WildFire
Patrowl
PDFPreview
PhishingInitiative
PhishTank
Pulsedive
QrDecode
Rapid7 InsightConnect
RDAP
Redmine
Request Tracker (RT4)
Robtex
ScanMalware
SecurityTrails
SEKOIA Intelligence Center
SendGrid
SentinelOne
ServiceNow
Shuffle
SinkDB
SophosIntelix
SpamAssassin
SpamhausDBL
StamusNetworks
StopForumSpam
Suspicious
ThreatConnect
ThreatFox
ThreatMiner
ThreatQ
Thunderstorm
Tines
TorBlutmagie
TorProject
Triage
UnshortenLink
urlDNA.io
Valhalla
ValidateObservable
Velociraptor
Verifalia
VirusShare
VMRay
Vulners
Watcher
Wazuh
WOT
XposedOrNot
Yeti
ZEROFOX
Zscaler
Back to all integrations
Explore similar integrations
CrowdStrike Falcon
EDR
1 TheHive Flow Node
11 Analyzers
9 Responders
2 Use cases
1 External integration
Microsoft Defender for Endpoint
EDR
1 TheHive Flow Node
2 Analyzers
12 Responders
Cisco Secure Endpoint (Formerly AMP for Endpoints)
EDR
5 Responders
See how TheHive can help your team
Thousands of analysts worldwide rely on our platform to manage security incidents more efficiently than ever.
See what the buzz is about:
Request a demo