This guide provides step-by-step instructions for integrating HarfangLab EDR with Logsign USO. The integration works over the HarfangLab EDR REST API and provides two capabilities:
Data Collection: Logsign periodically polls HarfangLab alerts. Each new alert automatically creates an incident in Logsign, and the alert log becomes visible under Search.
Response: Logsign can trigger response actions on HarfangLab directly from an incident: Close Alert, Isolate Endpoint, De-isolate Endpoint and Kill Process.
Both capabilities use the same two values: the Base URL of your HarfangLab EDR Manager and an API Token.
HarfangLab Configuration
Access the HarfangLab EDR Manager
Open a web browser, navigate to your HarfangLab EDR Manager console (for example https://edr-manager.example.com:8443) and log in with an account that has administrative privileges.
Generate an API Token
- Navigate to the user / API key management section of the HarfangLab EDR Manager.
- Create a new API Token for the Logsign integration. It is recommended to create a dedicated service account (e.g., "Logsign Integration") instead of using a personal account.
- Make sure the token's account has permission to:
- Read alerts (required for data collection)
- Update alert status (required for the Close Alert action)
- Trigger endpoint isolation and process termination (required for the response actions)
- Copy and securely store the API Token, as it cannot be retrieved later.
Note the Base URL
The Base URL is the address of the HarfangLab EDR Manager that Logsign will connect to, including the port if a non-default port is used:
https://<edr-manager-address>:8443
Network requirement: The Logsign server must be able to reach the HarfangLab EDR Manager over HTTPS (TCP 8443 by default). If there is a firewall between them, allow this traffic before continuing.
Data Collection
Add Device
To integrate HarfangLab EDR, it is enough to know the Base URL and the API Token of the product.
- Log in to your Logsign USO platform.
- Go to Settings > Data Collection and open the source addition screen (Add Device).
- Select the API source type and choose HarfangLab EDR from the provider list.
- Fill in the required fields:
Host: The Base URL of the HarfangLab EDR Manager (e.g., https://edr-manager.example.com:8443)
API Key: The API Token generated in the HarfangLab Configuration step
- Fill in the remaining default source fields (description, etc.) and click Save.
When you save, the integration is completed and log flow starts automatically.
How Data Is Collected
Logsign polls the HarfangLab Alert endpoint periodically. Collection is incremental: only alerts newer than the last collected alert are fetched, so no data is duplicated or missed between polling cycles.
Every new HarfangLab alert creates an incident in Logsign and the corresponding alert log appears under Search.
MITRE ATT&CK tags on the alert (e.g., attack.execution) are carried into the incident.
Alert severity is mapped to Logsign incident risk as follows:
HarfangLab Alert Level: low --> Logsign Risk Level: Low
HarfangLab Alert Level: medium --> Logsign Risk Level: Medium
HarfangLab Alert Level: high --> Logsign Risk Level: High
HarfangLab Alert Level: critical --> Logsign Risk Level: Urgent
RESPONSE CONFIGURATION
Once data collection is working, you can configure HarfangLab EDR as a response provider so that analysts can take action on endpoints directly from Logsign.
Configure HarfangLab EDR in Logsign USO
- Log in to your Logsign USO platform.
- Go to Settings > Response.
- Select HarfangLab EDR as the provider.
- Fill in the required fields:
Base URL: The Base URL of the HarfangLab EDR Manager (e.g., https://edr-manager.example.com:8443)
API Token: The API Token generated in the HarfangLab Configuration step
- Save the settings.
Available Response Actions
The following actions can be triggered from the incident details page. The required parameters are carried automatically inside the incident, so no manual lookup is needed:
Close Alert
Description: Closes the related alert on HarfangLab with the comment "Closed by Logsign."
Parameter Source: Alert id field of the incident
Isolate Endpoint
Description: Isolates the affected endpoint from the network
Parameter Source: threat_key (Threat ID) field of the incident
De-isolate Endpoint
Description: Removes the network isolation from the endpoint
Parameter Source: threat_key (Threat ID) field of the incident
Kill Process
Description: Terminates a running process on the endpoint
Parameter Source: process_unique_id (HarfangLab internal process ID) and pid (operating system process ID) fields of the incident, both are required
These actions can also be used as playbook action blocks to automate the response (for example: automatically isolating an endpoint when a critical ransomware alert creates an incident).
Verification
- After adding the device, confirm that new HarfangLab alerts appear as incidents in Logsign and that the alert logs are visible under Search.
- Trigger a test detection on a monitored endpoint (or wait for a real alert) and verify the incident is created with the expected risk level.
- From an incident created by HarfangLab EDR, run the Close Alert action and confirm the alert status changes to closed on the HarfangLab EDR Manager.
Troubleshooting
HTTP Code 401
Meaning: The API Token is invalid or missing
What to Check: Regenerate the token in HarfangLab and update it in Logsign
HTTP Code 403
Meaning: The token's account is not authorized for this endpoint
What to Check: Grant the required alert/response permissions to the integration account
HTTP Code 404
Meaning: The given ID was not found
What to Check: The alert/threat/process may have been removed on HarfangLab; verify the incident is current
If no logs are flowing at all, verify that the Logsign server can reach the HarfangLab EDR Manager over HTTPS (TCP 8443) and that the Base URL is entered without a trailing path.