European EDR platform (ANSSI-certified since 2020) built for SOC and CERT teams. It provides AI-driven threat detection, forensic analysis, and real-time endpoint response, deployable both on-premise and in the cloud with full feature parity.
What is Harfanglab?
HarfangLab is a European endpoint detection and response platform developed in France and ANSSI-certified since 2020, making it one of the few EDR solutions to hold that certification. It is designed for SOC and CERT teams that need deep forensic capabilities alongside real-time threat detection, with a particular focus on transparency: analysts can see exactly what data the agent collects and why a detection was triggered. The platform supports both on-premise and cloud deployment with full feature parity, addressing the needs of organizations with strict data sovereignty requirements. HarfangLab's detection engine combines AI-driven behavioral analysis with a library of curated detection rules, and its forensic capabilities allow analysts to conduct detailed post-incident investigations including memory analysis, process tree reconstruction, and timeline correlation.
How does Harfanglab work with Qevlar?
Qevlar integrates with HarfangLab to retrieve endpoint alerts and forensic data during automated investigations. This is particularly relevant for European organizations that need to maintain data sovereignty while benefiting from autonomous investigation capabilities, as HarfangLab's on-premise deployment model keeps endpoint data within the organization's own infrastructure.
Want to help your analysts focus on the most critical alerts?
Frequently asked questions
What is HarfangLab?
HarfangLab is a European EDR platform, ANSSI-certified since 2020, built for SOC and CERT teams. It delivers AI-driven detection, forensic analysis and real-time endpoint response, deployable on-premise or in the cloud with full feature parity.
What can you do with HarfangLab in Qevlar?
Qevlar can ingest HarfangLab alerts and investigate them automatically, correlating endpoint signals with identity, network and threat-intelligence context to reach an evidence-backed verdict.
Is this suitable for organizations with data-sovereignty requirements?
Yes. HarfangLab's on-premise deployment keeps endpoint data within your own infrastructure, and Qevlar adds autonomous investigation on top — a strong fit for European teams with strict sovereignty needs.
Does Qevlar investigate HarfangLab alerts without manual triage?
Yes. When HarfangLab raises a detection, Qevlar gathers the surrounding context and presents the analyst with a complete case rather than a raw alert.
Other integrations
