An independent tool index
for incident response teams
Detection and monitoring EU-developed
Endpoint detection and response software that monitors workstation and server activity, raises investigation alerts, and supports blocking and response actions.
By HarfangLab · France
The record identifies an EU developer or development origin. The origin note explains the evidence; current ownership and hosting are recorded separately where established.
Created by HarfangLab, whose founders built its EDR; HarfangLab describes its engineering and teams as Europe-based and itself as a French company.
Other HarfangLab ASM, EPP and ITDR capabilities are integrated offerings and are not split here. Vendor hosting claims are not independently audited by this index. Full product license terms were not publicly verified.
identity / origin / capabilities
HarfangLab says its founders created the EDR to detect and neutralize attacks on servers and workstations, and describes its platform development as Europe-based.
Read sourcecountry / deployment
The company calls itself French and lists cloud, private, SecNumCloud and own-infrastructure hosting choices.
Read sourcecapabilities / deployment
Product page describes endpoint agents, console investigation, alert tuning, and equivalent cloud/on-premises deployment.
Read sourcemaintenance
Official newsroom has September 2026 product and company updates.
Read sourcelicense
The reviewed official EDR offer describes a commercial product and demo path, but does not state the customer rights or full license terms for the EDR software.
Read sourceThis profile summarizes source material. It does not include hands-on security testing, procurement review, or an assessment of fit for your environment.
Tags record specific documented functions. They do not establish end-to-end interoperability; check the component, edition and version in the source.
The optional HarfangLab Intel connector sends OpenCTI live-stream indicators to HarfangLab. Documented requirements include OpenCTI 6.4+, HarfangLab Threat Response 2.x+ and Python 3.11; changed patterns require deletion and recreation.
Behavioral detection evaluates endpoint events with configurable Sigma rules. The documented OpenCTI connector can forward Sigma rules, but does not parse or validate them.
Signature detection scans file content, injected threads and process memory with configurable YARA rules. The OpenCTI connector can forward rules without validating them.
The optional OpenCTI HarfangLab Intel connector converts selected STIX indicator patterns into IOC rules for IP addresses, domains, URLs and file hashes. It is not a general STIX object import.
Check telemetry, field mappings, conversion and alert handling before deploying a Sigma rule. A practical detection workflow for CSIRTs and SOC teams.
From Sigma rule to a tested detection