rtr

CrowdStrike FalconPyCrowdStrike FalconPyCrowdStrike Subreddit

Real Time Response examples

The examples within this folder focus on leveraging CrowdStrike's Real Time Response API to respond to security events.

  • Bulk Execute - Bulk execute a command on multiple hosts that you select by using a search string.

  • Queued Execute - Bulk execute a command on multiple hosts that are selected by using a search string or a provided list of host AIDs. Execution is queued for offline hosts with request IDs stored to an external file for later result retrieval.

  • Get file from multiple hosts - Retrieve a file of the same name from multiple hosts.

  • Get host uptime - Retrieve the uptime for a host using a RTR session and a script command.

  • Get RTR result - Retrieve the results for previously executed RTR batch commands.

  • Restart Sensor - Restarts the sensor while taking a TCP dump.

  • Script Manager - Upload and delete RTR scripts for use on endpoints.

  • Dump Process Memory - Dumps the memory for a running process on a target system.

  • My Little RTR - Retrieve System Information and draws ASCII art.

  • Streaming File Download - Stream download a file from a target host.

Bulk execute a command on matched hosts

This simple example demonstrates performing batch administrative commands against multiple hosts. The host list is calculated based upon a string match between the hostname and a search string you provide at runtime. The command executed is also provided at runtime, and passed to the target host in Raw format. (Default command: ls -al)

You must provide your credentials to the program at runtime, or have them pre-defined within your environment. These environment variables are called FALCON_CLIENT_ID and FALCON_CLIENT_SECRET.

Results are output to the screen broken out by host.

Running the program

In order to run this demonstration, you will need access to CrowdStrike API keys with the following scopes:

Service Collection
Scope

Hosts

READ

Real Time Response

READ, WRITE

Real Time Response Admin

READ, WRITE

Execution syntax

The following command line arguments are accepted.

Argument
Long argument
Description

-h

--help

Show help message and exit

-k FALCON_CLIENT_ID

--falcon_client_id FALCON_CLIENT_ID

CrowdStrike Falcon API Client ID

-s FALCON_CLIENT_SECRET

--falcon_client_secret FALCON_CLIENT_SECRET

CrowdStrike Falcon API Client Secret

-c COMMAND

--command COMMAND

Command to perform. Defaults to ls -al.

-f FIND

--find FIND

String to match against hostname to select hosts.

-t TIMEOUT

--timeout TIMEOUT

Timeout duration for command execution in seconds. (Max: 600)

The only required argument is find (-f) which provides the search string to use to match against host names. If you do not have the FALCON_CLIENT_ID and FALCON_CLIENT_SECRET environment variables defined, then the -k and -s arguments are also required.

Example

This example will return the root directory contents for every host that matches the search string.

You can specify a command to perform with the -c argument.

Example

This example will return the contents of /etc/resolv.conf for each host matched to the search string.

This example command will only work on Linux or macOS host targets as this file does not exist in this location on Windows hosts.

Example result

Example source code

The source code for this example can be found here.

Bulk execute a command on matched hosts (with queuing)

This simple example demonstrates performing batch administrative commands against multiple hosts. The host list is calculated based upon a string match between the hostname and a search string you provide at runtime. The command executed is also provided at runtime, and passed to the target host in Raw format. (Default command: ls -al) Commands sent to offline hosts are queued for execution when the host is returned to service. (Expires after 7 days.)

You must provide your credentials to the program at runtime, or have them pre-defined within your environment. These environment variables are called FALCON_CLIENT_ID and FALCON_CLIENT_SECRET.

Results are output to the screen broken out by host.

Queued results are stored to standalone files for consumption using the Get RTR result sample.

Running the program

In order to run this demonstration, you will need access to CrowdStrike API keys with the following scopes:

Service Collection
Scope

Hosts

READ

Real Time Response

READ, WRITE

Real Time Response Admin

READ, WRITE

Execution syntax

The following command line arguments are accepted.

Argument
Long argument
Description

-h

--help

Show help message and exit

-k FALCON_CLIENT_ID

--falcon_client_id FALCON_CLIENT_ID

CrowdStrike Falcon API Client ID

-s FALCON_CLIENT_SECRET

--falcon_client_secret FALCON_CLIENT_SECRET

CrowdStrike Falcon API Client Secret

-c COMMAND

--command COMMAND

Command to perform. Defaults to ls -al.

-f FIND

--find FIND

String to match against hostname to select hosts.

-l LOAD_FILE

--load_file LOAD_FILE

File containing a list of AIDs to target (JSON or ASCII list). When not provided, the value of FIND will be used to target hosts.

The only required argument is find (-f) which provides the search string to use to match against host names. If you do not have the FALCON_CLIENT_ID and FALCON_CLIENT_SECRET environment variables defined, then the -k and -s arguments are also required.

Example

This example will return the root directory contents for every host that matches the search string.

You can specify a command to perform with the -c argument.

Example

This example will return the contents of /etc/resolv.conf for each host matched to the search string.

This example command will only work on Linux or macOS host targets as this file does not exist in this location on Windows hosts.

Example source code

The source code for this example can be found here.

Get file from multiple hosts

This sample demonstrates retrieving a file of the same name from multiple hosts.

Running the program

In order to run this demonstration, you you will need access to CrowdStrike API keys with the following scopes:

Service Collection
Scope

Hosts

READ

Real Time Response

READ, WRITE

Execution syntax

This sample leverages simple command-line arguments to implement functionality.

Basic usage

Retrieve a file from multiple hosts.

[!TIP] Hostname is a stemmed search.

GovCloud users can change their CrowdStrike region using the -b argument.

Environment authentication is supported, so this solution can be executed without providing credentials if the environment variables FALCON_CLIENT_ID and FALCON_CLIENT_SECRET are defined.

Activate API debug logging with the -d argument.

Command-line help

Command-line help is available via the -h argument.

Example source code

The source code for this example can be found here.

Get host uptime

Leverages the runscript RTR command to retrieve the uptime for host(s) within your environment.

Running the program

In order to run this demonstration, you you will need access to CrowdStrike API keys with the following scopes:

Service Collection
Scope

Real Time Response

WRITE

Real Time Response Admin

WRITE

Execution syntax

This sample leverages simple command-line arguments to implement functionality.

Basic usage

Retrieve the total running time for one or more hosts within your environment.

Retrieve all host uptimes (up to 5,000).

Retrieve the uptime for hosts that match a hostname filter.

Retrieve the uptime for hosts last seen within a certain number of minutes.

GovCloud users can change their CrowdStrike region using the -b argument.

Command-line help

Command-line help is available via the -h argument.

Example source code

The source code for this example can be found here.

Get RTR result

Retrieve the results for previously executed RTR commands.

Running the program

In order to run this demonstration, you you will need access to CrowdStrike API keys with the following scopes:

Service Collection
Scope

Real Time Response Admin

WRITE

Execution syntax

This sample leverages simple command-line arguments to implement functionality.

Basic usage

Retrieve the result for previously executed RTR batch admin commands.

GovCloud users can change their CrowdStrike region using the -b argument.

Specify the child CID where the commands where executed.

Specify a specific cloud request ID.

Specify a specific sequence of a specific cloud request ID.

Specify a custom output folder where execution request IDs are stored.

Command-line help

Command-line help is available via the -h argument.

Example source code

The source code for this example can be found here.

Restart Sensor

This program creates a RTR Session, drops a script on the host, runs the script, and then finally retrieves the output. The script will start TCPdump and perform a capture while the Falcon Sensor is restarted.

[!WARNING] This example only supports endpoints running Linux operating systems.

Running the program

In order to run this demonstration, you you will need access to CrowdStrike API keys with the following scopes:

Service Collection
Scope

ML Exclusions

READ

Flight Control

READ

Sensor Download

READ

[!NOTE] This program can be executed using an API key that is not scoped for the Flight Control (MSSP) service collection, but will be unable to access hosts within child CIDs.

Execution syntax

This sample leverages simple command-line arguments to implement functionality.

Basic usage

Execute the example against a specific hostname.

Execute the example against a specific AID.

This sample supports Environment Authentication, meaning you can execute any of the command lines shown without providing credentials if you have the values FALCON_CLIENT_ID and FALCON_CLIENT_SECRET defined in your environment.

[!TIP] This example will automatically identify and restart sensors on hosts within child tenants when provided valid parent API keys.

Activate debugging with the -d argument.

Command-line help

Command-line help is available via the -h argument.

Example source code

The source code for this example can be found here.

Script Manager

This program creates a RTR Session, drops a script on the host, runs the script, and then finally retrieves the output. The script will start TCPdump and perform a capture while the Falcon Sensor is restarted.

Running the program

In order to run this demonstration, you you will need access to CrowdStrike API keys with the following scopes:

Service Collection
Scope

ML Exclusions

READ

Flight Control

READ

[!NOTE] This program can be executed using an API key that is not scoped for the Flight Control (MSSP) service collection, but will be unable to upload scripts to child CIDs.

Execution syntax

This sample leverages simple command-line arguments to implement functionality.

Basic usage

Upload a script to your tenant.

[!NOTE]c will also be accepted for "create". Create is the default action, and does not need to be specified.

Set script specific parameters.

[!TIP] The only required argument is filepath (-p or --filepath) when uploading a script.

Delete a script from your tenant.

[!NOTE]r will also be accepted for "remove".

List all scripts within your tenant.

[!NOTE]l will also be accepted for "list".

Change the format of the output tabular display with the -t argument.

Accepted formats

The following table formats are supported:

  • plain

  • simple

  • github

  • grid

  • simple_grid

  • rounded_grid

  • heavy_grid

  • mixed_grid

  • double_grid

  • fancy_grid

  • outline

  • simple_outline

  • rounded_outline

  • heavy_outline

  • mixed_outline

  • double_outline

  • fancy_outline

  • pipe

  • orgtbl

  • asciidoc

  • jira

  • presto

  • pretty

  • psql

  • rst

  • mediawiki

  • moinmoin

  • youtrack

  • html

  • unsafehtml

  • latex

  • latex_raw

  • latex_booktabs

  • latex_longtable

  • textile

  • tsv

Activate MSSP mode with the -m argument. This will upload or delete the script within all child CIDs.

Perform an upload, delete or list operation within a specific child CID using the -c argument.

This sample supports Environment Authentication, meaning you can execute any of the command lines shown without providing credentials if you have the values FALCON_CLIENT_ID and FALCON_CLIENT_SECRET defined in your environment.

Activate debugging with the -d argument.

[!TIP] This example will automatically identify and restart sensors on hosts within child tenants when provided valid parent API keys.

Command-line help

Command-line help is available via the -h argument.

Example source code

The source code for this example can be found here.

Streaming File Download

This sample creates an RTR session with a target host, and stream downloads the specified file.

Running the program

In order to run this demonstration, you you will need access to CrowdStrike API keys with the following scopes:

Service Collection
Scope

Hosts

READ

Real Time Response

READ, WRITE

[!NOTE] This program can be executed using an API key that is not scoped for the Hosts service collection. Users will need to provide an AID value for the target host instead of a hostname.

Execution syntax

This sample leverages simple command-line arguments to implement functionality.

Basic usage

Streaming download a specified file from a host by hostname.

Streaming download a specified file from a host by host AID.

[!TIP] This sample supports Environment Authentication, meaning you can execute any of the command lines shown without providing credentials if you have the values FALCON_CLIENT_ID and FALCON_CLIENT_SECRET defined in your environment.

Specify the name of the save file used to store the resulting download.

Disable the pre-existence check for the save file.

[!NOTE] This will overwrite the existing save file with the newly downloaded file.

Adjust the chunk size used for streaming the download.

Activate debugging with the -d argument.

Command-line help

Command-line help is available via the -h argument.

Example source code

The source code for this example can be found here.

The source code for the Uber Class version of this example can be found here.

Previousreport_executionsNextpid-dump

Last updated

Was this helpful?