# HarfangLab ## Overview HarfangLab is a French EDR (Endpoint Detection and Response) solution built for security operations teams. It provides real-time endpoint monitoring, multi-engine threat detection, and investigation capabilities — enabling analysts to track IOCs, spot abnormal behaviours, and respond to incidents directly from a centralised console. Key characteristics of HarfangLab EDR: - **Open and API-first**: every action available in the UI is exposed via REST API, making full automation possible. - **Flexible deployment**: available as SaaS, private cloud, or on-premises (including air-gapped environments). - **ANSSI-certified**: the only EDR to hold French national cybersecurity agency certification. - **Primary users**: SOC analysts, IT administrators, and MSSPs managing endpoint protection at scale. The Mindflow integration is built on the [HarfangLab REST API](https://harfanglab.io/). It is available to all Mindflow users who are also HarfangLab customers. --- ## Prerequisites Before configuring the integration in Mindflow, you need the following: | Parameter | Where to find it | | --------------------------- | ---------------------------------------------------------------------------------- | | **HarfangLab instance URL** | The base URL of your HarfangLab manager (e.g. `https://your-tenant.harfanglab.io`) | | **API token** | Generated from your HarfangLab web interface (see below) | ### Generating an API token in HarfangLab 1. Log in to your HarfangLab manager interface. 2. Navigate to **Personal settings**
![Navigate personal settings](./assets/navigate-personal-settings.png)
3. In the **API Token** section, click **Generate token**.
![Api token section click generate token](./assets/api-token-section-click-generate-token.png)
4. Copy the token value immediately. :::note **Tip**: For production automation, it is recommended to create a dedicated service account with the minimum required permissions rather than using a personal user token. ::: --- ## Configuration in Mindflow Once you have your instance URL and API token, open the Mindflow platform and follow these steps. ### Step 1 — Add the HarfangLab integration 1. Go to **Integrations** in the left-hand navigation. 2. Search for **HarfangLab** and click on it.
![Search harfanglab click it](./assets/search-harfanglab-click-it.png)
3. Click **Add integration**.
![Click add integration](./assets/click-add-integration.png)
### Step 2 — Add the HarfangLab credential 1. Go to **Environment** in the left-hand navigation 2. Find the Environment were the credential will be used and click on **Create a credential**
![Find environment were credential will used](./assets/find-environment-were-credential-will-used.png)
3. Configure the credential as follow : 1. **Service:** HarfangLab 2. **Credential Type:** HTTP API Key 3. **Adress:** Your HarfangLab instance base URL — e.g. `https://your-tenant.harfanglab.io` 4. **Headers:** Add an item named Authorization with your API token prefixed with `Token` — e.g. `Token abc123xyz`
![Headers](./assets/headers.png)
:::note **Important**: The `Authorization` field must include the `Token` prefix followed by a space and your token value. This matches the authentication scheme defined in the HarfangLab API (`Authorization: Token```). ::: --- ## Using the integration in a flow Once configured, the HarfangLab integration becomes available as an action block in the Mindflow flow editor. You can drag and drop any HarfangLab operation into your flow and connect it to triggers or other actions. Common operations include: - **List security alerts** — retrieve active alerts filtered by severity, status, or time range. - **Get threat details** — fetch full context on a specific threat or IOC. - **Isolate endpoint** — disconnect a compromised host from the network to contain a threat. - **Kill process** — terminate a suspicious process running on an endpoint. - **Run YARA rule** — trigger a threat intelligence scan using a custom YARA rule. - **Collect endpoint artefacts** — gather memory dumps or files from an endpoint for forensic analysis. All operations support dynamic input — you can pass values from previous steps in your flow (e.g. an alert ID retrieved from a SIEM trigger) directly into HarfangLab action fields. --- ## Example use cases ### Automated alert triage A webhook trigger receives a HarfangLab alert. Mindflow automatically enriches it with VirusTotal data, scores its severity, and either creates a Jira ticket or closes it — without analyst intervention. ### Endpoint isolation on critical alerts When HarfangLab detects a high-severity threat, Mindflow isolates the affected endpoint, notifies the SOC team on Slack, and opens an incident in your ticketing system — all in a single automated flow. ### Threat intelligence correlation Mindflow periodically fetches new IOCs from an external threat intelligence feed and pushes them as YARA rules or detection rules into HarfangLab to keep detection coverage up to date. --- ## Troubleshooting | Issue | Likely cause | Fix | | ----------------------------------- | ----------------------------------------------- | ------------------------------------------------------------------------------------------ | | `401 Unauthorized` | Invalid or expired token | Regenerate the token in HarfangLab and update the integration in Mindflow | | `404 Not Found` on all requests | Incorrect instance URL | Verify the URL does not include a trailing `/api` path — Mindflow appends it automatically | | Token accepted but no data returned | Insufficient permissions on the service account | Ensure the account has at least read access to alerts and endpoints | --- ## Additional resources - [HarfangLab API documentation](https://harfanglab.io/) - [HarfangLab connectors overview](https://harfanglab.io/connectors/) - [Mindflow — Endpoint Protection use cases](https://mindflow.io/use_cases/endpoint-protection/)