This is a draft version of Sekoia.com documentation. Please use the official Sekoia.com documentation to have an up-to-date information.
logo
Sekoia Documentation
Harven
Initializing search
    GitHub
    • Getting started
    • Sekoia Solutions
    • Usecases
    • FAQ and troubleshooting
    • Integrations
    • API Documentation
    GitHub
      • Overview
      • Where to start
        • Training offer overview
        • Register for a training course
        • Join workspace
        • Create and manage communities
        • Create account
        • Setup account
          • Two-Factor Authentication
          • Security tokens
          • Password Management Policy
          • Session duration
          • Two-Factor Authentication
          • SSO with OpenID Connect
          • SSO with Microsoft Entra ID (Azure AD)
          • SSO with Okta
        • Invite users
        • Manage users
        • Deactivate inactive users
          • Built-in roles
          • Custom roles
          • Intake Restricted roles
        • Notification system
        • Create notifications
        • Manage notifications
        • Notification examples
      • API Keys
      • Subscriptions
      • Usage
      • Sekoia regions
      • Roy AI Assistant
      • Best practices
      • Troubleshooting tips
        • Intelligence overview
        • Data Models
          • Intelligence
          • Observables
          • Telemetry
            • Understand the feeds
            • Create feeds
            • Manage feeds
            • Create a detection rule from a feed
          • Graph Explorations
            • FLINT Reports
            • External Reports
          • Export
          • IOCs Collections
          • Dashboards
          • Threat Landscape
          • Overview
          • API
          • TAXII
          • Cortex Analyzer
          • MISP Feed
          • MISP - Import to IOC Collection
          • Microsoft Sentinel
          • OpenCTI Import Connector
          • OpenCTI Stream Connector
          • Splunk
          • Splunk SOAR
          • Swimlane Turbine
          • Harven
          • Anomali ThreatStream
          • PaloAlto Cortex XSOAR
          • PaloAlto Cortex XSIAM
          • ThreatQuotient
        • Defend overview
        • Quick start guide
          • Integrations
          • Update a custom integration
          • Intakes
          • Entities
          • Assets
            • Optimization rules overview
            • Create an optimization rule
            • Optimization rules technical references
          • IOCs Detection
          • Rules Catalog
          • Built-in Rules
          • Sigma
          • Anomaly Detection
          • IOCs Collections
            • SOL detection rules overview
            • Create a SOL detection rule
            • Create an Event Drop rule
            • Alert similarity
            • Lag management
          • Alerts
          • Events page
          • Eternal events
            • Understand massive event export
            • Export events with CLI
            • Export events with API
            • Massive export technical specifications
            • Massive event export troubleshooting
            • Cases overview
              • Create a case
              • Manage cases
              • Investigate case details
              • Graph investigation
              • AI Cases
            • Custom fields overview
            • Use custom fields
            • Manage custom field definitions
            • Query custom fields
          • Asset Context Panel
          • Events Query Language
          • Querying Events
            • Discover the query builder
            • Create and manage queries
            • Share and duplicate queries
            • Data visualization guide
            • Query builder form mode reference
            • SOL overview
            • Getting started
            • Understand SOL performance
            • How-to guides
            • SOL Datasets
            • Query examples
            • Reference: Datasources
            • Reference: Operators
            • Reference: Functions
          • Notebooks
            • Understanding dashboards
            • Create and manage dashboards
            • Configure widgets and layout
            • Filter data in dashboards
            • Share dashboards
            • Built-in widgets reference
          • Threat Landscape
          • Playbooks
          • Playbooks On-premises
          • Manage accounts
          • Navigate playbooks
          • Build playbooks
          • Triggers
          • Operators
          • Actions
          • Debug playbooks
          • Playbooks JSON Schema
          • FortiSOAR
          • Palo Alto Cortex XSOAR
          • Qevlar
          • Swimlane Turbine
        • Elevate overview
        • The investigation method
          • Activate Elevate
          • Elevate analysis states
          • Investigate an alert
          • Investigate a case
          • Audit with Traces
          • Override a verdict
          • Trigger an analysis
          • Add custom instructions
          • Customize a detection rule's runbook
          • Write effective instructions
          • Override community settings
          • Limit auto-analysis to specific rules
          • Manage Elevate runs
        • Reveal overview
        • Get started with Reveal
        • Explore assets context
        • Visualize attack paths
        • Discover Points of Interest
        • Check asset connector health
        • Reveal enablement matrix
      • Export large volumes of events
      • Implement a blocklist in Sekoia.io
      • Synchronize Alerts with an external tool
      • Synchronize Assets with an Active Directory
      • Send notifications to a Webhook using a playbook
      • Use your own CTI in Sekoia.io
      • Investigate overusage
      • Log volume reduction strategies
      • General
      • Alerts
        • Events FAQ
        • Events QA
        • Facing issues with logs collection
        • Data storage and retention
        • Restore Data from cold storage
        • Understand Exalog storage engine
        • Migrate to Exalog
        • Detection
        • Questions about IoC revokation
        • Questions about detection rules
      • Assets
        • Delay with event ingestion or alert creation
        • Allocate trial subscription
        • Subscriptions notifications
      • Sekoia.io Endpoint agent
      • Datetime representation
      • Reveal troubleshooting
      • Introduction
        • Overview
          • Overview
          • AWS S3
          • Azure Event Hub
          • Google Pub/Sub
          • Overview
          • Formatting options
          • Compression
          • Forwarding logs using a third-party application
          • Graylog
          • Logstash
          • Overview
          • Sekoia.io Forwarder
          • Third-party syslog services
          • Rsyslog
          • Syslog NG
          • Secured forwarding
          • Sekoia.io NetFlow Concentrator
        • Overview
          • 1Password EPM
          • Apache HTTP Server
          • Azure Activity Logs
          • Azure Files
          • Azure MySQL
          • Cloudflare Audit Logs
          • Fastly WAF Audit logs
          • Github Audit Logs
          • Google Workspace / ChromeOS
          • Google Cloud Audit Logs
          • LockSelf LockPass/LockTransfer/LockFiles
          • Microsoft IIS
          • Microsoft Sentinel
          • Nutanix
          • New Relic Alerts
          • Salesforce
          • Sekoia.io activity logs
          • Sekoia.io forwarder logs
          • Systancia Cleanroom
          • Veeam Backup
          • Wiz Audit Logs
          • Checkpoint Harmony Email and Collaboration
          • Cisco Email Security Appliance
          • FortiMail
          • Hornetsecurity 365 Total Protection
          • Mimecast Email Security
          • Office 365
          • Office 365 Message Trace (deprecated)
          • Office 365 Message Trace (Graph API)
          • Postfix
          • Proofpoint On Demand
          • Proofpoint Targeted Attack Protection
          • Retarus Email Security
          • SpamAssassin
          • Trend Micro Email Security
          • Vade Cloud
          • Vade M365
          • Azure Windows
          • Bitdefender GravityZone
          • Check Point Harmony Mobile
          • CrowdStrike Falcon
          • CrowdStrike Falcon Telemetry
          • Cybereason MalOp
          • Cybereason MalOp activity
          • Eset Protect
          • Google Kubernetes Engine (GKE)
          • Harfanglab
          • IBM AIX
          • IBM iSeries (AS/400)
          • Kaspersky Endpoint Security
          • Kubernetes Audit Logs
          • Linux AuditBeat
          • Log Insight Windows
          • Lookout Mobile Endpoint Security
          • Microsoft Defender XDR (Microsoft 365 Defender)
          • Microsoft Defender XDR (Graph API)
          • Microsoft Defender XDR Incidents (Graph API)
          • Microsoft Intune
          • Nozomi Central Management Console
          • Nucleon EDR
          • Palo Alto Cortex XDR (EDR)
          • Panda Security Aether
          • Pradeo MTD
          • SentinelOne
          • SentinelOne Cloud Funnel 2.0
          • Sekoia.io Endpoint Agent
          • Sophos EDR
          • Stormshield SES
          • Symantec Endpoint Protection
          • TEHTRIS Endpoint Detection & Reponse
          • Tanium
          • Trellix ATD
          • Trellix EDR
          • Trend Micro Apex One / Vision One Endpoint
          • Trend Micro Vision One Workbench
          • Trend Micro Vision One Observed Attack Techniques
          • WatchGuard EPDR
          • VMWare ESXi
          • VMWare VCenter
          • Windows
          • Winlogbeat
          • WithSecure Elements
          • CEF
          • Raw
          • OCSF
          • Tenable Identity Exposure / Alsid
          • Azure Key Vault
          • BeyondTrust PRA Sessions
          • BeyondTrust PRA Syslog
          • BeyondTrust PRA Team
          • BeyondTrust PRA Vault Account Activity
          • Cisco Duo Security
          • Cyberark Digital Vault
          • CyberArk Identity Audit Logs
          • Delinea Platform Audit Logs
          • FreeRADIUS
          • Jumpcloud Directory Insights
          • Keycloak Events
          • ManageEngine ADAudit Plus
          • Microsoft Entra ID (Azure AD)
          • Microsoft Entra ID (via Graph API)
          • Okta System log
          • One Identity SPS Session logs
          • OpenLDAP
          • PingFederate
          • RSA SecurID
          • Rubycat PROVE IT
          • SentinelOne Singularity Identity
          • Silverfort Universal MFA
          • Wallix
          • Amazon VPC Flow Logs
          • Azure Application Gateway
          • ArubaOS Switch
          • BIND
          • Cato SASE
          • Cisco Catalyst SD-WAN
          • Cisco IOS
          • Cisco Meraki MX
          • Cisco NX-OS
          • Citrix NetScaler / ADC
          • Cloudflare Access Request
          • Cloudflare DNS Gateway
          • Cloudflare DNS logs
          • Cloudflare Gateway HTTP
          • Cloudflare Gateway Network
          • Cloudflare HTTP requests
          • Cloudflare Zero Trust Network Session Logs
          • EfficientIP SOLIDServer DDI
          • Ekinops OneOS
          • F5 BIG-IP
          • Google VPC Flow Logs
          • HAProxy
          • ISC DHCP
          • Infoblox DDI
          • Juniper Network Switches
          • Microsoft Always On VPN
          • NGINX
          • Netfilter
          • OPNSense
          • OpenSSH
          • OpenVPN
          • PfSense
          • Pulse Connect Secure
          • Squid
          • Jizo AI / Sesame Jizo NDR
          • Umbrella DNS Logs
          • Unbound
          • Zimperium MTD - Threats
          • Akamai Guardicore On-Premises
          • Akamai Guardicore Saas
          • Akamai WAF
          • Aleph Alerts
          • AWS CloudTrail
          • Amazon CloudFront Logs
          • Amazon GuardDuty
          • Amazon WAF
          • Azure Front Door
          • Azure Network Watcher (NSG flow logs; deprecated)
          • Azure Network Watcher (Virtual Network Flow Logs)
          • Barracuda CloudGen Firewall
          • Bitsight SPM
          • Broadcom Cloud Secure Web Gateway
          • Broadcom Edge Secure Web Gateway
          • Broadcom Siteminder
          • Check Point
          • Cisco Identity Services Engine (ISE)
          • Cisco Secure Firewall
          • Cisco Secure Access - Cloud Firewall
          • Cisco Secure Access - DNS
          • Cisco Secure Access - File Events
          • Cisco Secure Access - IPS
          • Cisco Secure Access - Web
          • Cisco Web Security Appliance
          • Claroty xDome
          • Clavister Next-Gen Firewall
          • Cloudflare WAF / Firewall Events
          • Corelight
          • Cyberwatch Detection
          • Darktrace Threat Visualizer
          • Datadome Protection
          • Daspren Parad
          • Digital Shadows SearchLight
          • ExtraHop Reveal(x) 360
          • F5 Distributed Cloud
          • Fastly Next-Gen WAF
          • Forcepoint Secure Web Gateway
          • Forcepoint Management Server
          • Forcepoint NGFW
          • FortiProxy
          • FortiWeb
          • Fortigate
          • Gatewatcher AionIQ (<=v102)
          • Gatewatcher AionIQ (>=v103)
          • Google Cloud Load Balancing
          • Imperva Web Application Firewall
          • Juniper Next Gen Firewall
          • Lacework Cloud Security
          • LocateRisk Cyberrisk Analysis
          • McAfee Web Gateway / Skyhigh Secure Web Gateway - On Prem
          • McAfee Web Gateway / Skyhigh Secure Web Gateway - SaaS
          • Nanocorp
          • NeroSwarm Honeypot
          • Netskope Events
          • Netskope Log Streaming (Transaction Events)
          • Netskope Transaction Events (deprecated)
          • Nozomi Vantage
          • OGO Shield WAF
          • Olfeo SAAS
          • Olfeo Secure Web Gateway
          • Palo Alto Next-Generation Firewall
          • Palo Alto Prisma access
          • Radware DefensePro
          • Seckiot Citadelle
          • Security Scorecard Vunerability Assessment Scanner
          • SonicWall Firewall
          • SonicWall SMA
          • Sophos Firewall
          • Sophos Threat Analysis Center
          • Stormshield Network Security
          • Suricata
          • Thinkst Canary
          • Trapster
          • Trellix Network Security
          • Trellix ePO
          • Trellix ePO - On Prem
          • Trend Micro Deep Security / Workload Security
          • Ubika Cloud Protector Next Generation Alerts
          • Ubika Cloud Protector Next Generation Traffic Logs
          • Ubika WAAP Gateway
          • Umbrella IP Logs
          • Umbrella Proxy Logs
          • Varonis Data Security
          • Vectra Cognito Detect
          • Vectra Respond UX - Entity Scoring
          • WatchGuard Firebox
          • Wiz Cloud configuration findings
          • Wiz Issues
          • Wiz Threat Detections
          • Wiz Vulnerability Findings
          • Zscaler Internet Access
          • Zscaler Private Access
          • MokN - Baits
          • Prodaft USTA
          • ElasticSearch
          • Mandrill
          • Mattermost
          • New Relic
          • PagerDuty
          • Ilert
          • AWS
          • Azure Monitor
          • Google Cloud
          • Atlassian JIRA
          • Git
          • ServiceNow
          • The Hive
          • The Hive V5
          • Microsoft Outlook
          • Bitdefender GravityZone
          • CrowdStrike Falcon
          • Eset
          • HarfangLab
          • Microsoft Windows Server
          • MicrosoftDefenderXDR
          • Palo Alto Cortex XDR (EDR)
          • Palo Alto Cortex XSIAM
          • Panda Security
          • SentinelOne
          • Sophos
          • Stormshield SES
          • TrendMicro VisionOne
          • WithSecure
          • HTTP
          • OpenAI
          • RSS
          • Sekoia.io
          • Utils
          • Microsoft Active Directory
          • Microsoft Entra ID
          • DNS
          • Fortigate Firewalls
          • Sophos
          • Stormshield
          • Zscaler
        • Overview
          • Censys
          • Certificate Transparency
          • Detection Rules
          • Digital Shadows
          • GLIMPS
          • IKnowWhatYouDownload
          • IPInfo
          • IPtoASN
          • MISP
          • MWDB
          • OSINT
          • Onyphe
          • Public Suffix
          • Shodan
          • Tranco
          • Triage
          • VirusTotal
          • Whois
        • Overview
          • Tenable.io
          • AWS EC2
          • Crowdstrike Falcon
          • ESET EDR
          • Harfanglab EDR
          • Holm Security
          • Microsoft Defender XDR (Microsoft 365 Defender)
          • Okta
          • SentinelOne EDR
          • Sophos EDR
          • AWS IAM
          • Microsoft Active Directory
          • Microsoft Entra ID
          • Okta
          • Sophos EDR
        • Overview
          • Overview
          • Action
          • Create a Module
          • Development Guidelines
          • Module
          • Trigger
          • Overview
          • Create a Format
          • Datasources
          • Definition of a structured event
          • Definition of the taxonomy
          • How to write a parser
          • How to write smart descriptions
          • Troubleshooting
            • Overview
            • Authentications
            • Networks
            • Endpoints
        • Overview
          • Bug VS Improvement Requests
    • API Documentation

    Harven

    More information about this external integration: https://support.harven.ai/docs/1f8c0f70-43dc-435e-a3b1-795f11d39f1f

    Previous
    Swimlane Turbine
    Next
    Anomali ThreatStream
    Copyright © 2026 - Sekoia
    Made with Material for MkDocs