Harfanglab

What is Harfanglab?

HarfangLab is a European endpoint detection and response platform developed in France and ANSSI-certified since 2020, making it one of the few EDR solutions to hold that certification. It is designed for SOC and CERT teams that need deep forensic capabilities alongside real-time threat detection, with a particular focus on transparency: analysts can see exactly what data the agent collects and why a detection was triggered. The platform supports both on-premise and cloud deployment with full feature parity, addressing the needs of organizations with strict data sovereignty requirements. HarfangLab's detection engine combines AI-driven behavioral analysis with a library of curated detection rules, and its forensic capabilities allow analysts to conduct detailed post-incident investigations including memory analysis, process tree reconstruction, and timeline correlation.

How does Harfanglab work with Qevlar?

Qevlar integrates with HarfangLab to retrieve endpoint alerts and forensic data during automated investigations. This is particularly relevant for European organizations that need to maintain data sovereignty while benefiting from autonomous investigation capabilities, as HarfangLab's on-premise deployment model keeps endpoint data within the organization's own infrastructure.