harfanglab
Installation
SKILL.md
HarfangLab orb (EDR) — content authoring
This skill encodes operational context for content authoring against HarfangLab's EDR product (orb). HarfangLab is a French EDR vendor with strong Sigma support; rule authoring blends Sigma packs (vendor-curated and customer-authored) with the platform's native query language (RHQL — Realtime Hunting Query Language) for hunting.
1. Surface identification
| Surface | Purpose | Authoring expression |
|---|---|---|
| Sigma rules | Behavioural detection rule packs | Sigma YAML (HarfangLab tooling translates internally) |
| Custom detection rules | Customer-authored behavioural rules | Sigma YAML, optionally with RHQL extensions |
| RHQL hunting | Ad-hoc hunting queries | RHQL |
| YARA rules | File / memory pattern matching | Standard YARA |
| Whitelists | Exclusions for known-good behaviour | Path / hash / signer / process |
| Threat Intel | IOC ingestion | STIX / CSV / API |
The primary detection-authoring surface is Sigma. HarfangLab's posture leans heavily on the open Sigma standard, which is a significant differentiator from most other EDR vendors.