HarborWatch API Claim Request

Detects network requests to the HarborWatch API endpoint '/api/agent/tasks/claim'. This activity could indicate an agent attempting to claim tasks from a HarborWatch server, which might be part of legitimate operations or could be indicative of unauthorized access or activity if the agent is not recognized or the request is unexpected.

Microsoft Sentinel (KQL)