HarfangLab
Configure the Harfanglab connector to set up API access and retrieve information
Objective
The HarfangLab connector allows you to retrieve endpoint detection and response (EDR) data from your HarfangLab instance into OverSOC.
Information to Provide in OverSOC
| Field | Description |
|---|---|
| Tenant URL | Your HarfangLab instance URL (e.g., https://your-instance.harfanglab.io) |
| API Token | API token generated from the HarfangLab console |
Procedure
To generate an API token, refer to your HarfangLab administration console. The token management is typically found under Administration > Users in the EDR Manager interface.
Caution
HarfangLab's API documentation is not publicly available. Please refer to the documentation provided by HarfangLab with your license, or contact HarfangLab support for the exact procedure to generate API tokens for your version.
Configure the Connector in OverSOC
- In OverSOC, go to Data Sources Settings > Sources.
- Select HarfangLab and click Configure.
- Enter the Tenant URL and API Token.
- Click Save Configuration.
Security Best Practices
- Use a dedicated service account for API access.
- Regularly rotate API tokens.
- Restrict API token scope to read-only permissions.