Harfanglab

Description

The Harfanglab's EDR can be deployed within the simulation. It communicates from both Linux and Windows to a pre-configured Hurukai SIEM.

Configuration

Harfanglab EDR is configured to send its logs by proxy to the Hurukai's URL.

How to enable

You need to provide 4 differents inputs:

• hurukai_host: IP address or hostname of the EDR Manager
• hurukai_sig: Public signature of the Hurukai agent
• hurukai_enrollment_token: Enrollment token
• api_token: API token to use. This token is not used within lab's machines

Usage

Once the lab is running, you can inspect the alerts provided by logging in your hurukai_host URL.

img

On the dashboard, you can see different information, including:

• the number of active agents in the lab
• the alerts triggered with their severity level
• the number of potential malwares

Security events can be associated with the MITRE ATT&CK Matrix in order to precise the techniques and tactics of each event.