Connect Qevlar to HarfangLab to investigate endpoint alerts using its telemetry to confirm or dismiss threats. This page lists the permissions Qevlar requires and how to grant them.
Overview
Qevlar authenticates to HarfangLab with an API token sent in the Authorization header — no user sign-in per request. The token inherits the role of the user it belongs to, which governs access. The connector is read-only.
| API | Purpose | Auth |
|---|---|---|
| HarfangLab EDR API | Read agents, threats, and threat alerts | API token |
The API base is your HarfangLab tenant URL.
Connection details
Enter these values when configuring the connector in Qevlar:
| Field | Where to find it | Required |
|---|---|---|
| Base URL | Your HarfangLab tenant URL, e.g. https://<tenant>.harfanglab.io | Yes |
| API Token | HarfangLab console → user settings → API tokens | Yes |
Required permissions
Generate an API token owned by a user (or role) with read access to endpoints (agents) and threats/alerts. A read-only role is sufficient — no response or write permissions are required.
Setup
- Create an API token. In the HarfangLab console, generate an API token under the relevant user.
- Confirm read access. Ensure the user's role grants read access to agents and threats/alerts.
- Record the token. Copy it immediately — it is shown only once.
- Get the Base URL. Use your HarfangLab tenant URL.
- Configure the connector. In Qevlar, add the HarfangLab connector and enter the connection details above.
Verify the connection
After saving, Qevlar runs a health check that lists agents. If it fails, check, in order:
- The token's role grants read access to agents and threats/alerts.
- The token is valid and has not been revoked.
- The Base URL is correct.
API reference
| Operation | HTTP | Endpoint |
|---|---|---|
| List agents (health check) | GET | {baseUrl}/api/data/endpoint/Agent/ |
| Read threat by ID | GET | {baseUrl}/api/data/alert/alert/Threat/{threatId}/ |
| List threat alerts | GET | {baseUrl}/api/data/alert/alert/Alert/ |
Auth header: Authorization: Token <apiToken>.