HarfangLab
Configure the Harfanglab connector to set up API access and retrieve information
Objective
The HarfangLab connector allows you to retrieve endpoint detection and response (EDR) data from your HarfangLab instance into OverView.
Information to provide in OverView
| Field | Description |
|---|---|
| API Token | API token generated from the HarfangLab console |
| Server URL | Your HarfangLab instance URL, including the port (usually :8443) — e.g. https://your-instance.hurukai.io:8443 |
| Domain Name | Domain name filter |
Parameters
These parameters are optional. Leave them at their default value unless you have a specific reason to change them.
| Parameter | Description | Default |
|---|---|---|
| Alert Retrieval Days | Number of days to retrieve alerts | 30 |
| Collect Processes | Collect process hunting data. Requires the Threat Hunting license option | Enabled |
| Collect Network Discovery | Collect network discovery data. Requires the Threat Hunting license option | Enabled |
Procedure
To generate an API token, refer to your HarfangLab administration console. The token management is typically found under Administration > Users in the EDR Manager interface.
HarfangLab's API documentation is not publicly available. Please refer to the documentation provided by HarfangLab with your license, or contact HarfangLab support for the exact procedure to generate API tokens for your version.
The Tenant URL must point to the root of your instance and include the port (usually :8443). If you copy the URL from your browser, it may contain a suffix such as /auth/login?next=...: remove it so only https://your-instance.hurukai.io:8443 remains. Otherwise no data is retrieved.
When you copy the API key from the HarfangLab interface, the clipboard includes a Token prefix before the key (for example Token YOUR_API_KEY). Because the field is masked, this prefix is easy to miss. Before pasting the value into OverView's API Token field, remove Token so that only the API key remains.
Configure the Connector in OverView
- In OverView, go to Data Sources Settings > Sources.
- Select HarfangLab and click Configure.
- Enter the Tenant URL and API Token.
- Click Save Configuration.
Required Permissions
For the connector to retrieve all data, the role attached to the API key must have the View right on the following categories of the HarfangLab console. If a permission is missing, the corresponding data is not retrieved.
| Retrieved data | Category (HarfangLab console) | Right |
|---|---|---|
| Agents / endpoint inventory | Endpoint → Endpoint data and configuration | View |
| Local users (Windows) | Endpoint → Endpoint data and configuration | View |
| Alerts | Detection → Alert & threats | View |
| Aggregated alerts | Detection → Alert & threats (+ Security events) | View |
| Processes | Data exploration → Telemetry data | View |
| Network discovery | Data exploration → Telemetry data | View + enable the feature (see below) |
Retrieving network data (Network Discovery) requires, in addition to the View right on Telemetry data, enabling the corresponding feature in the HarfangLab console, under Data exploration. Without this, network data is not collected.
Security Best Practices
- Use a dedicated service account for API access.
- Regularly rotate API tokens.
- Restrict API token scope to read-only permissions.
Alternative: file import through DropPoint
The API access described above is the recommended method for this connector. Where it is not available (a segregated network, a version or licence without API, an export you already produce), OverView accepts file exports, to be uploaded to the bucket dedicated to HarfangLab.
Bucket : s3://harfanglab/
Example : s3://harfanglab/export.csv
The procedure is described in the OverView DropPoint guide: generating credentials, configuring the client, then sending files from the OverView web interface, the AWS CLI or an SDK. Its examples come pre-filled with this bucket when you follow this link.