HarfangLab Support

[behemothsecurity]

OpenTide now supports the HarfangLab platform, extending detection-as-code capabilities for more Detection Engineering team.

Sigma and YARA

Harfanglab is the first detection platform we support with multi-rule type addressing. This is done fairly easily, allowing users to onboard different YARA or Sigma Sources as "tenants" in the new harfanglab.toml configuration file. When deploying, the algorithms smartly filter out if a currently scoped tenant is not compatible with the ongoing deployment type.

In OpenTide fashion, we rely on strong schema based tooling. This was a challenge with the flavour of Sigma that Harfanglab uses, due to the amount of combinations between hundreds of possible fields, across 40 log categories. We've re-engineered a version of sigma that allows JSON Schema analysis and autocompletion, especially when using modifiers. This was still a huge task - the final schema is more than 3000 lines long ! But well worth it - provider Detection Engineers with a more comfortable sigma experience, and increasing productivity by allowing to remain in the IDE instead of going back and forth with documentation to learn more about allowed fields.

The YARA exposes all nitty-gritty details specific to HarfangLab, including module imports, context, os and architecture.

---

This discussion was created from the release HarfangLab Support.