Real Time Response Admin

The Real Time Response Admin service collection provides operations for managing RTR administrator commands, scripts, and put-files. Execute admin commands on single hosts or in batch, manage custom scripts and put-files for RTR sessions.

Language	Last Update
Python	v1.6.1
PowerShell	v2.2.9
Go	v0.20.0
TypeScript	v0.6.0
Rust	v0.7.0
Ruby	v1.2.0

This service collection has code examples posted to the repository.

Operation	Description
BatchAdminCmd `batch_admin_command`	Batch executes a RTR administrator command across the hosts mapped to the given batch ID.
RTR_CheckAdminCommandStatus `check_admin_command_status`	Get status of an executed RTR administrator command on a single host.
RTR_ExecuteAdminCommand `execute_admin_command`	Execute a RTR administrator command on a single host.
RTR_GetFalconScripts `get_falcon_scripts`	Get Falcon scripts with metadata and content of script
RTR_GetPut_Files `get_put_files`	Get put-files based on the ID’s given. These are used for the RTR `put` command.
RTR_GetPut_FilesV2 `get_put_files_v2`	Get put-files based on the ID’s given. These are used for the RTR `put` command.
RTR_GetPutFileContents `get_put_file_contents`	Get the contents of a put-file based on the ID given.
RTR_CreatePut_Files `create_put_files`	Upload a new put-file to use for the RTR `put` command.
RTR_CreatePut_FilesV2 `create_put_files_v2`	Upload a new put-file to use for the RTR `put` command.
RTR_DeletePut_Files `delete_put_files`	Delete a put-file based on the ID given. Can only delete one file at a time.
RTR_GetScripts `get_scripts`	Get custom-scripts based on the ID’s given. These are used for the RTR `runscript` command.
RTR_GetScriptsV2 `get_scripts_v2`	Get custom-scripts based on the ID’s given. These are used for the RTR `runscript` command.
RTR_ListFalconScripts `list_falcon_scripts`	Get a list of Falcon script IDs available to the user to run
RTR_CreateScripts `create_scripts`	Upload a new custom-script to use for the RTR `runscript` command.
RTR_CreateScriptsV2 `create_scripts_v2`	Upload a new custom-script to use for the RTR `runscript` command.
RTR_DeleteScripts `delete_scripts`	Delete a custom-script based on the ID given. Can only delete one script at a time.
RTR_UpdateScripts `update_scripts`	Upload a new scripts to replace an existing one.
RTR_UpdateScriptsV2 `update_scripts_v2`	Upload a new scripts to replace an existing one.
RTR_ListPut_Files `list_put_files`	Get a list of put-file ID’s that are available to the user for the `put` command.
RTR_ListScripts `list_scripts`	Get a list of custom-script ID’s that are available to the user for the `runscript` command.

BatchAdminCmd

Batch executes a RTR administrator command across the hosts mapped to the given batch ID.

POST /real-time-response/combined/batch-admin-command/v1

Scope Real Time Response (Admin): WRITE Consumes · Produces application/json

PEP 8 batch_admin_command

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
base_command	body	string	Active Responder base command to perform. For example: `get` or `cp`. Refer to this list for a complete listing of available commands.
batch_id	body	string	RTR Batch ID to execute the command against. Received from `batch_init_session`.
command_string	body	string	Full command line of the command to execute. Example: `get some_file.txt`.
host_timeout_duration	query	string	Timeout duration for for how long a host has to complete processing in duration syntax. Example, `10s`. Valid units: `ns, us, ms, s, m, h`. Maximum is 5 minutes.
optional_hosts	body	string or list of strings	List of the subset of hosts we want to impact by this command. Allows for filtering of hosts from execution within the same batch.
persist_all	body	boolean	Flag indicating if this command should be executed when the host returns to service.
timeout	query	integer	Timeout for how long to wait for the request in seconds, default timeout is 30 seconds. Maximum is 5 minutes.
timeout_duration	query	string	Timeout duration for for how long to wait for the request in duration syntax. Example, `10s`. Valid units: `ns, us, ms, s, m, h`. Maximum is 5 minutes.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Available base commands

Command	Description	Operating System
`cat`	View file contents	All supported
`cd`	Change directory	All supported
`clear`	Clear the screen	All supported
`cp`	Copy a file	All supported
`csrutil`	Get system integrity protection status	MacOS
`encrypt`	Encrypt a file	All supported
`env`	Display environment variables	All supported
`eventlog`	Inspect the event log. Subcommands: list, view, export, backup. `eventlog backup` is the recommended solution as it is faster and follows industry-standard file format.	Windows
`filehash`	Calculate a file hash (MD5 or SHA256)	All supported
`get`	Retrieve a file	All supported
`getsid`	Retrieve the current SID	Windows, MacOS
`help`	Access help for a specific command or sub-command	All supported
`history`	Review command history for the current user	All supported
`ifconfig`	Review TCP configuration	Linux, MacOS
`ipconfig`	Review TCP configuration	Windows
`kill`	Kill a running process	All supported
`ls`	List the contents of a directory	All supported
`map`	Map a UNC (SMB) path to a drive letter	Windows
`memdump`	Dump memory of a running process	Windows
`mkdir`	Create a directory	All supported
`mount`	Mount a file system (MacOS, Linux) or list available drives (Windows)	All supported
`mv`	Move a file	All supported
`netstat`	Retrieve network connection detail	All supported
`ps`	List running processes	All supported
`put`	Put a file onto a remote host	Windows, MacOS
`put-and-run`	Put a file onto a remote host and then execute it. The put-and-run command reduces the potential for user error in file selection by ensuring that the file ‘put’ on the host is the same file that is ‘run’ on the host.	Windows, Linux, MacOS
`reg`	Registry operations. Subcommands: `query`, `set`, `delete`, `load`, `unload`.	Windows
`restart`	Restart the system	All supported
`rm`	Remove a file	All supported
`run`	Run an executable	All supported
`runscript`	Run a script	All supported
`shutdown`	Shutdown the system	All supported
`tar`	Compress a file or directory into a tar file	Linux
`unmap`	Unmap a UNC (SMB) path from a drive letter	Windows
`unmount`	Unmount a file system	Linux, MacOS
`update`	Install patches through Windows Update. Subcommands: `history`, `install`, `list`, `query`.	Windows
`users`	Get details about local users	Linux, MacOS
`xmemdump`	Dump complete memory (kernel) for the system	Windows
`zip`	Create a zip archive	All supported

Code Examples

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.batch_admin_command(base_command="string",
                                      batch_id="string",
                                      command_string="string",
                                      host_timeout_duration="string",
                                      optional_hosts=["string"],
                                      persist_all=boolean,
                                      timeout="string",
                                      timeout_duration="string")
print(response)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.BatchAdminCmd(base_command="string",
                                batch_id="string",
                                command_string="string",
                                host_timeout_duration="string",
                                optional_hosts=["string"],
                                persist_all=boolean,
                                timeout="string",
                                timeout_duration="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "base_command": "string",
    "batch_id": "string",
    "command_string": "string",
    "optional_hosts": ["string"],
    "persist_all": boolean
}

response = falcon.command("BatchAdminCmd",
                          timeout=integer,
                          timeout_duration="string",
                          host_timeout_duration="string",
                          body=body_payload)
print(response)

Invoke-FalconAdminCommand -Command "string" -BatchId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.RealTimeResponseAdmin.BatchAdminCmd(
    &real_time_response_admin.BatchAdminCmdParams{
      Timeout: integer,
      TimeoutDuration: "string",
      HostTimeoutDuration: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponseAdmin.batchAdminCmd(
  {  // body
      baseCommand: "string",
      batchId: "string",
      commandString: "string",
      optionalHosts: [],
      persistAll: boolean
  },
  integer,  // timeout
  "string",  // timeoutDuration
  "string"  // hostTimeoutDuration
);

console.log(response);

use rusty_falcon::apis::real_time_response_admin_api::batch_admin_cmd;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainBatchExecuteCommandRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DomainBatchExecuteCommandRequest {
        base_command: Some("string".to_string()),
        batch_id: Some("string".to_string()),
        command_string: Some("string".to_string()),
        optional_hosts: vec!["string".to_string()],
        persist_all: Some(boolean),
        ..Default::default()
    };

    let response = batch_admin_cmd(
        &falcon.cfg,  // configuration
        body,  // body
        Some(integer),  // timeout
        Some("string"),  // timeout_duration
        Some("string"),  // host_timeout_duration
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponseAdmin.new

body = {
  base_command: 'string',
  batch_id: 'string',
  command_string: 'string',
  optional_hosts: [],
  persist_all: boolean
}

response = api.batch_admin_cmd(body)

puts response

RTR_CheckAdminCommandStatus

Get status of an executed RTR administrator command on a single host.

GET /real-time-response/entities/admin-command/v1

Scope Real Time Response (Admin): WRITE Consumes · Produces application/json

PEP 8 check_admin_command_status

Parameters

Name	Type	Data type	Description
cloud_request_id	query	string	Cloud Request ID of the executed command to query.
parameters	query	dictionary	Full query string parameters payload in JSON format.
sequence_id	query	integer	Sequence ID that we want to retrieve. Command responses are chunked across sequences.

Code Examples

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.check_admin_command_status(cloud_request_id="string",
                                             sequence_id="string")
print(response)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.RTR_CheckAdminCommandStatus(cloud_request_id="string",
                                              sequence_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("RTR_CheckAdminCommandStatus",
                          cloud_request_id="string",
                          sequence_id=integer)
print(response)

Confirm-FalconAdminCommand -CloudRequestId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.RealTimeResponseAdmin.RTRCheckAdminCommandStatus(
    &real_time_response_admin.RTRCheckAdminCommandStatusParams{
      CloudRequestID: "string",
      SequenceID: integer,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponseAdmin.rTRCheckAdminCommandStatus(
  "string",  // cloudRequestId
  integer  // sequenceId
);

console.log(response);

use rusty_falcon::apis::real_time_response_admin_api::r_tr_check_admin_command_status;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = r_tr_check_admin_command_status(
        &falcon.cfg,  // configuration
        "string",  // cloud_request_id
        integer,  // sequence_id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponseAdmin.new

response = api.r_tr_check_admin_command_status('string', integer)

puts response

RTR_ExecuteAdminCommand

Execute a RTR administrator command on a single host.

POST /real-time-response/entities/admin-command/v1

Scope Real Time Response (Admin): WRITE Consumes · Produces application/json

PEP 8 execute_admin_command

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
base_command	body	string	Active Responder base command to perform. For example: `get` or `cp`. Refer to this list for a complete listing of available commands.
session_id	body	string	RTR Session ID to execute the command against. Received from `init_session`.
command_string	body	string	Full command line of the command to execute. Example: `get some_file.txt`.
device_id	body	string	ID of the device to execute the command on.
id	body	integer	Command sequence.
persist	body	boolean	Flag indicating if this command should be executed when the host returns to service.

Available base commands

Command	Description	Operating System
`cat`	View file contents	All supported
`cd`	Change directory	All supported
`clear`	Clear the screen	All supported
`cp`	Copy a file	All supported
`csrutil`	Get system integrity protection status	MacOS
`encrypt`	Encrypt a file	All supported
`env`	Display environment variables	All supported
`eventlog`	Inspect the event log. Subcommands: list, view, export, backup. `eventlog backup` is the recommended solution as it is faster and follows industry-standard file format.	Windows
`filehash`	Calculate a file hash (MD5 or SHA256)	All supported
`get`	Retrieve a file	All supported
`getsid`	Retrieve the current SID	Windows, MacOS
`help`	Access help for a specific command or sub-command	All supported
`history`	Review command history for the current user	All supported
`ifconfig`	Review TCP configuration	Linux, MacOS
`ipconfig`	Review TCP configuration	Windows
`kill`	Kill a running process	All supported
`ls`	List the contents of a directory	All supported
`map`	Map a UNC (SMB) path to a drive letter	Windows
`memdump`	Dump memory of a running process	Windows
`mkdir`	Create a directory	All supported
`mount`	Mount a file system (MacOS, Linux) or list available drives (Windows)	All supported
`mv`	Move a file	All supported
`netstat`	Retrieve network connection detail	All supported
`ps`	List running processes	All supported
`put-and-run`	Put a file onto a remote host and then execute it. The put-and-run command reduces the potential for user error in file selection by ensuring that the file ‘put’ on the host is the same file that is ‘run’ on the host.	Windows, Linux, MacOS
`reg`	Registry operations. Subcommands: `query`, `set`, `delete`, `load`, `unload`.	Windows
`restart`	Restart the system	All supported
`rm`	Remove a file	All supported
`run`	Run an executable	All supported
`runscript`	Run a script	All supported
`shutdown`	Shutdown the system	All supported
`tar`	Compress a file or directory into a tar file	Linux
`unmap`	Unmap a UNC (SMB) path from a drive letter	Windows
`unmount`	Unmount a file system	Linux, MacOS
`update`	Install patches through Windows Update. Subcommands: `history`, `install`, `list`, `query`.	Windows
`users`	Get details about local users	Linux, MacOS
`xmemdump`	Dump complete memory (kernel) for the system	Windows
`zip`	Create a zip archive	All supported

Code Examples

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.execute_admin_command(base_command="string",
                                        command_string="string",
                                        device_id="string",
                                        id=integer,
                                        persist=boolean,
                                        session_id="string")
print(response)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.RTR_ExecuteAdminCommand(base_command="string",
                                          command_string="string",
                                          device_id="string",
                                          id=integer,
                                          persist=boolean,
                                          session_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "base_command": "string",
    "command_string": "string",
    "device_id": "string",
    "id": integer,
    "persist": boolean,
    "session_id": "string"
}

response = falcon.command("RTR_ExecuteAdminCommand", body=body_payload)
print(response)

Invoke-FalconAdminCommand -Command "string" -SessionId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  base_command := "string"
  command_string := "string"
  device_id := "string"
  id := integer
  persist := boolean
  session_id := "string"

  response, err := client.RealTimeResponseAdmin.RTRExecuteAdminCommand(
    &real_time_response_admin.RTRExecuteAdminCommandParams{
      Body: &models.DomainCommandExecuteRequest{
        BaseCommand: &base_command,
        CommandString: &command_string,
        DeviceID: &device_id,
        ID: &id,
        Persist: &persist,
        SessionID: &session_id,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponseAdmin.rTRExecuteAdminCommand(
  {
    baseCommand: "string",
    commandString: "string",
    deviceId: "string",
    id: integer,
    persist: boolean,
    sessionId: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::real_time_response_admin_api::r_tr_execute_admin_command;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainCommandExecuteRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DomainCommandExecuteRequest {
        base_command: Some("string".to_string()),
        command_string: Some("string".to_string()),
        device_id: Some("string".to_string()),
        id: Some(integer),
        persist: Some(boolean),
        session_id: Some("string".to_string()),
        ..Default::default()
    };

    let response = r_tr_execute_admin_command(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponseAdmin.new

body = {
  base_command: 'string',
  command_string: 'string',
  device_id: 'string',
  id: integer,
  persist: boolean,
  session_id: 'string'
}

response = api.r_tr_execute_admin_command(body)

puts response

RTR_GetFalconScripts

Get Falcon scripts with metadata and content of script

GET /real-time-response/entities/falcon-scripts/v1

Scope Real Time Response (Admin): WRITE Consumes · Produces application/json

PEP 8 get_falcon_scripts

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	IDs of the Falcon scripts you want to retrieve
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_falcon_scripts(ids=id_list)
print(response)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.RTR_GetFalconScripts(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("RTR_GetFalconScripts",
                          ids=id_list)
print(response)

Get-FalconLibraryScript -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.RealTimeResponseAdmin.RTRGetFalconScripts(
    &real_time_response_admin.RTRGetFalconScriptsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponseAdmin.rTRGetFalconScripts(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::real_time_response_admin_api::r_tr_get_falcon_scripts;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = r_tr_get_falcon_scripts(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponseAdmin.new

response = api.r_tr_get_falcon_scripts(['ID1', 'ID2', 'ID3'])

puts response

RTR_GetPut_Files

Get put-files based on the ID’s given. These are used for the RTR put command.

GET /real-time-response/entities/put-files/v1

Scope Real Time Response (Admin): WRITE Consumes · Produces application/json

PEP 8 get_put_files

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	File IDs.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_put_files(ids=id_list)
print(response)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.RTR_GetPut_Files(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("RTR_GetPut_Files",
                          ids=id_list)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.RealTimeResponseAdmin.RTRGetPutFiles(
    &real_time_response_admin.RTRGetPutFilesParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponseAdmin.rTRGetPutFiles(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::real_time_response_admin_api::r_tr_get_put_files;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = r_tr_get_put_files(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponseAdmin.new

response = api.r_tr_get_put_files(['ID1', 'ID2', 'ID3'])

puts response

RTR_GetPut_FilesV2

Get put-files based on the ID’s given. These are used for the RTR put command.

GET /real-time-response/entities/put-files/v2

Scope Real Time Response (Admin): WRITE Consumes · Produces application/json

PEP 8 get_put_files_v2

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	File IDs.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_put_files_v2(ids=id_list)
print(response)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.RTR_GetPut_FilesV2(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("RTR_GetPut_FilesV2",
                          ids=id_list)
print(response)

Get-FalconPutFile -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.RealTimeResponseAdmin.RTRGetPutFilesV2(
    &real_time_response_admin.RTRGetPutFilesV2Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponseAdmin.rTRGetPutFilesV2(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::real_time_response_admin_api::r_tr_get_put_files_v2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = r_tr_get_put_files_v2(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponseAdmin.new

response = api.r_tr_get_put_files_v2(['ID1', 'ID2', 'ID3'])

puts response

RTR_GetPutFileContents

Get the contents of a put-file based on the ID given.

GET /real-time-response/entities/put-file-contents/v1

Scope Real Time Response (Admin): WRITE Consumes · Produces application/json

PEP 8 get_put_file_contents

Parameters

Name	Type	Data type	Description
id	query	string	ID of the put-file to retrieve contents for.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

with open("output_file", "wb") as save_file:
    response = falcon.get_put_file_contents(id="string", stream=boolean)
    save_file.write(response)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

with open("output_file", "wb") as save_file:
    response = falcon.RTR_GetPutFileContents(id="string", stream=boolean)
    save_file.write(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

with open("output_file", "wb") as save_file:
    response = falcon.command("RTR_GetPutFileContents",
                              id="string")
    save_file.write(response)

Receive-FalconPutFile -Path "string" -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.RealTimeResponseAdmin.RTRGetPutFileContents(
    &real_time_response_admin.RTRGetPutFileContentsParams{
      ID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponseAdmin.rTRGetPutFileContents("string");  // id

console.log(response);

use rusty_falcon::apis::real_time_response_admin_api::r_tr_get_put_file_contents;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = r_tr_get_put_file_contents(
        &falcon.cfg,  // configuration
        "string",  // id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponseAdmin.new

response = api.r_tr_get_put_file_contents('string')

puts response

RTR_CreatePut_Files

Upload a new put-file to use for the RTR put command.

POST /real-time-response/entities/put-files/v1

Scope Real Time Response (Admin): WRITE Consumes multipart/form-data Produces application/json

PEP 8 create_put_files

Parameters

Name	Type	Data type	Description
comments_for_audit_log	formData	string	A descriptive comment for the audit log.
data	formData	file	Full formData payload in JSON format.
description	formData	string	File description.
name	formData	string	File name (if different than actual file name).
files	query	list of tuples	File(s) to be uploaded.

Code Examples

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.create_put_files(data="string",
                                   files=["string"],
                                   description="string",
                                   name="string",
                                   comments_for_audit_log="string")
print(response)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.RTR_CreatePut_Files(data="string",
                                      files=["string"],
                                      description="string",
                                      name="string",
                                      comments_for_audit_log="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("RTR_CreatePut_Files",
                          file_data=open("filename", "rb").read(),
                          description="string",
                          name="string",
                          comments_for_audit_log="string")
print(response)

Send-FalconPutFile -Path "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  name := "string"
  commentsForAuditLog := "string"

  response, err := client.RealTimeResponseAdmin.RTRCreatePutFiles(
    &real_time_response_admin.RTRCreatePutFilesParams{
      Description: "string",
      Name: &name,
      CommentsForAuditLog: &commentsForAuditLog,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponseAdmin.rTRCreatePutFiles(
  "string",  // file
  "string",  // description
  "string",  // name
  "string"  // commentsForAuditLog
);

console.log(response);

use rusty_falcon::apis::real_time_response_admin_api::r_tr_create_put_files;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = r_tr_create_put_files(
        &falcon.cfg,  // configuration
        std::path::PathBuf::default(),  // file
        "string",  // description
        Some("string"),  // name
        Some("string"),  // comments_for_audit_log
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponseAdmin.new

response = api.r_tr_create_put_files('string', 'string')

puts response

RTR_CreatePut_FilesV2

Upload a new put-file to use for the RTR put command.

POST /real-time-response/entities/put-files/v2

Scope Real Time Response (Admin): WRITE Consumes multipart/form-data Produces application/json

PEP 8 create_put_files_v2

Parameters

Name	Type	Data type	Description
data	data	dictionary	Full body payload in JSON format.
files	formData	list of tuples	File to be uploaded. List of tuples. Ex: [(‘file’, (‘file.ext’, open(‘file.ext’,‘rb’).read(), ‘application/script’))]
description	formData	string	File description.
name	formData	string	File name (if different than actual file name).
comments_for_audit_log	formData	string	The audit log comment.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.create_put_files_v2(data="string",
                                      files=["string"],
                                      description="string",
                                      name="string",
                                      comments_for_audit_log="string")
print(response)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.RTR_CreatePut_FilesV2(data="string",
                                        files=["string"],
                                        description="string",
                                        name="string",
                                        comments_for_audit_log="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("RTR_CreatePut_FilesV2",
                          file_data=open("filename", "rb").read(),
                          description="string",
                          name="string",
                          comments_for_audit_log="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  name := "string"
  commentsForAuditLog := "string"

  response, err := client.RealTimeResponseAdmin.RTRCreatePutFilesV2(
    &real_time_response_admin.RTRCreatePutFilesV2Params{
      Description: "string",
      Name: &name,
      CommentsForAuditLog: &commentsForAuditLog,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponseAdmin.rTRCreatePutFilesV2(
  "string",  // file
  "string",  // description
  "string",  // name
  "string"  // commentsForAuditLog
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponseAdmin.new

response = api.r_tr_create_put_files_v2('string', 'string')

puts response

RTR_DeletePut_Files

Delete a put-file based on the ID given. Can only delete one file at a time.

DELETE /real-time-response/entities/put-files/v1

Scope Real Time Response (Admin): WRITE Consumes · Produces application/json

PEP 8 delete_put_files

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	File IDs.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_put_files(ids=id_list)
print(response)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.RTR_DeletePut_Files(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("RTR_DeletePut_Files",
                          ids="string")
print(response)

Remove-FalconPutFile -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.RealTimeResponseAdmin.RTRDeletePutFiles(
    &real_time_response_admin.RTRDeletePutFilesParams{
      Ids: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponseAdmin.rTRDeletePutFiles("string");  // ids

console.log(response);

use rusty_falcon::apis::real_time_response_admin_api::r_tr_delete_put_files;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = r_tr_delete_put_files(
        &falcon.cfg,  // configuration
        "string",  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponseAdmin.new

response = api.r_tr_delete_put_files('string')

puts response

RTR_GetScripts

Get custom-scripts based on the ID’s given. These are used for the RTR runscript command.

GET /real-time-response/entities/scripts/v1

Scope Real Time Response (Admin): WRITE Consumes · Produces application/json

PEP 8 get_scripts

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	File IDs.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_scripts(ids=id_list)
print(response)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.RTR_GetScripts(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("RTR_GetScripts",
                          ids=id_list)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.RealTimeResponseAdmin.RTRGetScripts(
    &real_time_response_admin.RTRGetScriptsParams{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponseAdmin.rTRGetScripts(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::real_time_response_admin_api::r_tr_get_scripts;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = r_tr_get_scripts(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponseAdmin.new

response = api.r_tr_get_scripts(['ID1', 'ID2', 'ID3'])

puts response

RTR_GetScriptsV2

Get custom-scripts based on the ID’s given. These are used for the RTR runscript command.

GET /real-time-response/entities/scripts/v2

Scope Real Time Response (Admin): WRITE Consumes · Produces application/json

PEP 8 get_scripts_v2

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	File IDs.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.get_scripts_v2(ids=id_list)
print(response)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.RTR_GetScriptsV2(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("RTR_GetScriptsV2",
                          ids=id_list)
print(response)

Get-FalconScript -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.RealTimeResponseAdmin.RTRGetScriptsV2(
    &real_time_response_admin.RTRGetScriptsV2Params{
      Ids: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponseAdmin.rTRGetScriptsV2(["ID1", "ID2", "ID3"]);  // ids

console.log(response);

use rusty_falcon::apis::real_time_response_admin_api::r_tr_get_scripts_v2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = r_tr_get_scripts_v2(
        &falcon.cfg,  // configuration
        vec!["string".to_string()],  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponseAdmin.new

response = api.r_tr_get_scripts_v2(['ID1', 'ID2', 'ID3'])

puts response

RTR_ListFalconScripts

Get a list of Falcon script IDs available to the user to run

GET /real-time-response/queries/falcon-scripts/v1

Scope Real Time Response (Admin): WRITE Consumes · Produces application/json

PEP 8 list_falcon_scripts

Parameters

Name	Type	Data type	Description
filter	query	string	Optional filter criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon.
offset	query	integer	Starting index of overall result set from which to return ids.
limit	query	integer	Number of ids to return.
sort	query	string	Sort by spec. Ex: `created_at\|asc`.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.list_falcon_scripts(filter="string",
                                      limit=integer,
                                      offset=integer,
                                      sort="string")
print(response)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.RTR_ListFalconScripts(filter="string",
                                        limit=integer,
                                        offset=integer,
                                        sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("RTR_ListFalconScripts",
                          filter="string",
                          offset=integer,
                          limit=integer,
                          sort="string")
print(response)

Get-FalconLibraryScript -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  offset := int64(0)
  limit := int64(0)
  sort := "string"

  response, err := client.RealTimeResponseAdmin.RTRListFalconScripts(
    &real_time_response_admin.RTRListFalconScriptsParams{
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponseAdmin.rTRListFalconScripts(
  "string",  // filter
  integer,  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::real_time_response_admin_api::r_tr_list_falcon_scripts;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = r_tr_list_falcon_scripts(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some(integer),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponseAdmin.new

response = api.r_tr_list_falcon_scripts(filter: 'string',
                                        offset: integer,
                                        limit: integer,
                                        sort: 'string')

puts response

RTR_CreateScripts

Upload a new custom-script to use for the RTR runscript command.

POST /real-time-response/entities/scripts/v1

Scope Real Time Response (Admin): WRITE Consumes multipart/form-data Produces application/json

PEP 8 create_scripts

Parameters

Name	Type	Data type	Description
comments_for_audit_log	formData	string	A descriptive comment for the audit log.
content	formData	string	The text contents you want to use for the script. Takes place of a file upload.
data	formData	file	Full formData payload in JSON format.
description	formData	string	File description.
name	formData	string	File name (if different than actual file name).
permission_type	formData	string	Permissions for the custom-script. Valid permission values include: `private` - usable only by the user who upload it; `group` - usable by all RTR admins; `public` - usable by all active-responders and RTR admins
platform	formData	list of strings	Platform for the script. Currently supports `windows`, `mac`, and `linux`. If no platform is provided, `windows` is assumed.
files	query	list of tuples	File(s) to be uploaded.

Code Examples

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.create_scripts(data="string",
                                 files=["string"],
                                 description="string",
                                 name="string",
                                 comments_for_audit_log="string",
                                 permission_type="string",
                                 content="string",
                                 platform="string")
print(response)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.RTR_CreateScripts(data="string",
                                    files=["string"],
                                    description="string",
                                    name="string",
                                    comments_for_audit_log="string",
                                    permission_type="string",
                                    content="string",
                                    platform="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("RTR_CreateScripts",
                          file_data=open("filename", "rb").read(),
                          description="string",
                          name="string",
                          comments_for_audit_log="string",
                          permission_type="string",
                          content="string",
                          platform="string")
print(response)

Send-FalconScript -Platform @("ID1", "ID2") `
  -PermissionType "string" `
  -Path "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  name := "string"
  commentsForAuditLog := "string"
  content := "string"

  response, err := client.RealTimeResponseAdmin.RTRCreateScripts(
    &real_time_response_admin.RTRCreateScriptsParams{
      Description: "string",
      Name: &name,
      CommentsForAuditLog: &commentsForAuditLog,
      PermissionType: "string",
      Content: &content,
      Platform: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponseAdmin.rTRCreateScripts(
  "string",  // description
  "string",  // permissionType
  "string",  // file
  "string",  // name
  "string",  // commentsForAuditLog
  "string",  // content
  ["ID1", "ID2", "ID3"]  // platform
);

console.log(response);

use rusty_falcon::apis::real_time_response_admin_api::r_tr_create_scripts;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = r_tr_create_scripts(
        &falcon.cfg,  // configuration
        "string",  // description
        "string",  // permission_type
        Some(std::path::PathBuf::default()),  // file
        Some("string"),  // name
        Some("string"),  // comments_for_audit_log
        Some("string"),  // content
        Some(vec!["string".to_string()]),  // platform
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponseAdmin.new

response = api.r_tr_create_scripts('string', 'string')

puts response

RTR_CreateScriptsV2

Upload a new custom-script to use for the RTR runscript command.

POST /real-time-response/entities/scripts/v2

Scope Real Time Response (Admin): WRITE Consumes multipart/form-data Produces application/json

PEP 8 create_scripts_v2

Parameters

Name	Type	Data type	Description
file	formData	string	Custom-script file to upload (Service class). These should be powershell scripts.
description	formData	string	Required parameter. File description.
name	formData	string	File name (if different than actual file name).
comments_for_audit_log	formData	string	The audit log comment.
content	formData	string	The script text that you want to use to upload.
platform	formData	list of strings	Platforms for the file. Currently supports: windows, mac, linux.
permission_type	formData	string	Permission type for the custom-script. Valid permission types are private, group, public.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.create_scripts_v2(data="string",
                                    files=["string"],
                                    description="string",
                                    name="string",
                                    comments_for_audit_log="string",
                                    permission_type="string",
                                    content="string",
                                    platform="string")
print(response)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.RTR_CreateScriptsV2(data="string",
                                      files=["string"],
                                      description="string",
                                      name="string",
                                      comments_for_audit_log="string",
                                      permission_type="string",
                                      content="string",
                                      platform="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("RTR_CreateScriptsV2",
                          file_data=open("filename", "rb").read(),
                          description="string",
                          name="string",
                          comments_for_audit_log="string",
                          permission_type="string",
                          content="string",
                          platform="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  name := "string"
  commentsForAuditLog := "string"
  content := "string"

  response, err := client.RealTimeResponseAdmin.RTRCreateScriptsV2(
    &real_time_response_admin.RTRCreateScriptsV2Params{
      Description: "string",
      Name: &name,
      CommentsForAuditLog: &commentsForAuditLog,
      PermissionType: "string",
      Content: &content,
      Platform: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponseAdmin.rTRCreateScriptsV2(
  "string",  // description
  "string",  // permissionType
  "string",  // file
  "string",  // name
  "string",  // commentsForAuditLog
  "string",  // content
  ["ID1", "ID2", "ID3"]  // platform
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponseAdmin.new

response = api.r_tr_create_scripts_v2('string', 'string')

puts response

RTR_DeleteScripts

Delete a custom-script based on the ID given. Can only delete one script at a time.

DELETE /real-time-response/entities/scripts/v1

Scope Real Time Response (Admin): WRITE Consumes · Produces application/json

PEP 8 delete_scripts

Parameters

Name	Type	Data type	Description
ids	query	string or list of strings	File IDs.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_scripts(ids=id_list)
print(response)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.RTR_DeleteScripts(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("RTR_DeleteScripts",
                          ids="string")
print(response)

Remove-FalconScript -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.RealTimeResponseAdmin.RTRDeleteScripts(
    &real_time_response_admin.RTRDeleteScriptsParams{
      Ids: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponseAdmin.rTRDeleteScripts("string");  // ids

console.log(response);

use rusty_falcon::apis::real_time_response_admin_api::r_tr_delete_scripts;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = r_tr_delete_scripts(
        &falcon.cfg,  // configuration
        "string",  // ids
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponseAdmin.new

response = api.r_tr_delete_scripts('string')

puts response

RTR_UpdateScripts

Upload a new scripts to replace an existing one.

PATCH /real-time-response/entities/scripts/v1

Scope Real Time Response (Admin): WRITE Consumes multipart/form-data Produces application/json

PEP 8 update_scripts

Parameters

Name	Type	Data type	Description
comments_for_audit_log	formData	string	A descriptive comment for the audit log.
content	formData	string	The text contents you want to use for the script. Takes place of a file upload.
data	formData	file	Full formData payload in JSON format.
description	formData	string	File description.
id	formData	string	The ID of the script to be updated.
name	formData	string	File name (if different than actual file name).
permission_type	formData	string	Permissions for the custom-script. Valid permission values include: `private` - usable only by the user who upload it; `group` - usable by all RTR admins; `public` - usable by all active-responders and RTR admins
platform	formData	list of strings	Platform for the script. Currently supports `windows`, `mac`, and `linux`. If no platform is provided, `windows` is assumed.
files	query	list of tuples	File(s) to be uploaded.

Code Examples

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.update_scripts(data="string",
                                 files=["string"],
                                 description="string",
                                 id="string",
                                 name="string",
                                 comments_for_audit_log="string",
                                 permission_type="string",
                                 content="string",
                                 platform="string")
print(response)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.RTR_UpdateScripts(data="string",
                                    files=["string"],
                                    description="string",
                                    id="string",
                                    name="string",
                                    comments_for_audit_log="string",
                                    permission_type="string",
                                    content="string",
                                    platform="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("RTR_UpdateScripts",
                          id="string",
                          file_data=open("filename", "rb").read(),
                          description="string",
                          name="string",
                          comments_for_audit_log="string",
                          permission_type="string",
                          content="string",
                          platform="string")
print(response)

Edit-FalconScript -Path "string" -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  name := "string"
  commentsForAuditLog := "string"
  permissionType := "string"
  content := "string"

  response, err := client.RealTimeResponseAdmin.RTRUpdateScripts(
    &real_time_response_admin.RTRUpdateScriptsParams{
      ID: "string",
      Description: &description,
      Name: &name,
      CommentsForAuditLog: &commentsForAuditLog,
      PermissionType: &permissionType,
      Content: &content,
      Platform: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponseAdmin.rTRUpdateScripts(
  "string",  // id
  "string",  // file
  "string",  // description
  "string",  // name
  "string",  // commentsForAuditLog
  "string",  // permissionType
  "string",  // content
  ["ID1", "ID2", "ID3"]  // platform
);

console.log(response);

use rusty_falcon::apis::real_time_response_admin_api::r_tr_update_scripts;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = r_tr_update_scripts(
        &falcon.cfg,  // configuration
        "string",  // id
        Some(std::path::PathBuf::default()),  // file
        Some("string"),  // description
        Some("string"),  // name
        Some("string"),  // comments_for_audit_log
        Some("string"),  // permission_type
        Some("string"),  // content
        Some(vec!["string".to_string()]),  // platform
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponseAdmin.new

response = api.r_tr_update_scripts('string')

puts response

RTR_UpdateScriptsV2

Upload a new scripts to replace an existing one.

PATCH /real-time-response/entities/scripts/v2

Scope Real Time Response (Admin): WRITE Consumes multipart/form-data Produces application/json

PEP 8 update_scripts_v2

Parameters

Name	Type	Data type	Description
data	formData	dictionary	Full formData payload. Not required if using other keywords.
id	formData	string	ID of the script to update.
files	formData	list of tuples	File to be uploaded.
description	formData	string	File description.
name	formData	string	File name (if different than actual file name).
comments_for_audit_log	formData	string	Audit log comment.
permission_type	formData	string	Permission for the custom-script. Valid permission values include: `private` - usable only by the user who uploaded it; `group` - usable by all RTR admins; `public` - usable by all active-responders and RTR admins
content	formData	string	The script text that you want to use to upload.
platform	formData	list of strings	Platforms for the file. Currently supports: `windows`, `mac`, `linux`.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.update_scripts_v2(data="string",
                                    files=["string"],
                                    description="string",
                                    id="string",
                                    name="string",
                                    comments_for_audit_log="string",
                                    permission_type="string",
                                    content="string",
                                    platform="string")
print(response)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.RTR_UpdateScriptsV2(data="string",
                                      files=["string"],
                                      description="string",
                                      id="string",
                                      name="string",
                                      comments_for_audit_log="string",
                                      permission_type="string",
                                      content="string",
                                      platform="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("RTR_UpdateScriptsV2",
                          id="string",
                          file_data=open("filename", "rb").read(),
                          description="string",
                          name="string",
                          comments_for_audit_log="string",
                          permission_type="string",
                          content="string",
                          platform="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  description := "string"
  name := "string"
  commentsForAuditLog := "string"
  permissionType := "string"
  content := "string"

  response, err := client.RealTimeResponseAdmin.RTRUpdateScriptsV2(
    &real_time_response_admin.RTRUpdateScriptsV2Params{
      ID: "string",
      Description: &description,
      Name: &name,
      CommentsForAuditLog: &commentsForAuditLog,
      PermissionType: &permissionType,
      Content: &content,
      Platform: []string{"ID1", "ID2", "ID3"},
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponseAdmin.rTRUpdateScriptsV2(
  "string",  // id
  "string",  // file
  "string",  // description
  "string",  // name
  "string",  // commentsForAuditLog
  "string",  // permissionType
  "string",  // content
  ["ID1", "ID2", "ID3"]  // platform
);

console.log(response);

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponseAdmin.new

response = api.r_tr_update_scripts_v2('string')

puts response

RTR_ListPut_Files

Get a list of put-file ID’s that are available to the user for the put command.

GET /real-time-response/queries/put-files/v1

Scope Real Time Response (Admin): WRITE Consumes · Produces application/json

PEP 8 list_put_files

Parameters

Name	Type	Data type	Description
filter	query	string	FQL query expression that should be used to limit the results. `user_id` can accept a special value `@me` which will restrict results to records with current user’s ID.
limit	query	integer	Maximum number of records to return.
offset	query	string	Starting index of overall result set from which to return ids.
sort	query	string	The property to sort by.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.list_put_files(filter="string",
                                 limit=integer,
                                 offset=integer,
                                 sort="string")
print(response)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.RTR_ListPut_Files(filter="string",
                                    limit=integer,
                                    offset=integer,
                                    sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("RTR_ListPut_Files",
                          filter="string",
                          offset="string",
                          limit=integer,
                          sort="string")
print(response)

Get-FalconPutFile -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  offset := "string"
  limit := int64(0)
  sort := "string"

  response, err := client.RealTimeResponseAdmin.RTRListPutFiles(
    &real_time_response_admin.RTRListPutFilesParams{
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponseAdmin.rTRListPutFiles(
  "string",  // filter
  "string",  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::real_time_response_admin_api::r_tr_list_put_files;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = r_tr_list_put_files(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponseAdmin.new

response = api.r_tr_list_put_files(filter: 'string',
                                   offset: 'string',
                                   limit: integer,
                                   sort: 'string')

puts response

RTR_ListScripts

Get a list of custom-script ID’s that are available to the user for the runscript command.

GET /real-time-response/queries/scripts/v1

Scope Real Time Response (Admin): WRITE Consumes · Produces application/json

PEP 8 list_scripts

Parameters

Name	Type	Data type	Description
filter	query	string	FQL query expression that should be used to limit the results. `user_id` can accept a special value `@me` which will restrict results to records with current user’s ID.
limit	query	integer	Maximum number of records to return.
offset	query	string	Starting index of overall result set from which to return ids.
sort	query	string	The property to sort by.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.list_scripts(filter="string",
                               limit=integer,
                               offset=integer,
                               sort="string")
print(response)

from falconpy import RealTimeResponseAdmin

falcon = RealTimeResponseAdmin(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.RTR_ListScripts(filter="string",
                                  limit=integer,
                                  offset=integer,
                                  sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("RTR_ListScripts",
                          filter="string",
                          offset="string",
                          limit=integer,
                          sort="string")
print(response)

Get-FalconScript -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  offset := "string"
  limit := int64(0)
  sort := "string"

  response, err := client.RealTimeResponseAdmin.RTRListScripts(
    &real_time_response_admin.RTRListScriptsParams{
      Filter: &filter,
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponseAdmin.rTRListScripts(
  "string",  // filter
  "string",  // offset
  integer,  // limit
  "string"  // sort
);

console.log(response);

use rusty_falcon::apis::real_time_response_admin_api::r_tr_list_scripts;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = r_tr_list_scripts(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponseAdmin.new

response = api.r_tr_list_scripts(filter: 'string',
                                 offset: 'string',
                                 limit: integer,
                                 sort: 'string')

puts response

Real Time Response Admin

Table of Contents

BatchAdminCmd

Parameters

Available base commands

Code Examples

RTR_CheckAdminCommandStatus

Parameters

Code Examples

RTR_ExecuteAdminCommand

Parameters

Available base commands

Code Examples

RTR_GetFalconScripts

Parameters

Code Examples

RTR_GetPut_Files

Parameters

Code Examples

RTR_GetPut_FilesV2

Parameters

Code Examples

RTR_GetPutFileContents

Parameters

Code Examples

RTR_CreatePut_Files

Parameters

Code Examples

RTR_CreatePut_FilesV2

Parameters

Code Examples

RTR_DeletePut_Files

Parameters

Code Examples

RTR_GetScripts

Parameters

Code Examples

RTR_GetScriptsV2

Parameters

Code Examples

RTR_ListFalconScripts

Parameters

Code Examples

RTR_CreateScripts

Parameters

Code Examples

RTR_CreateScriptsV2

Parameters

Code Examples

RTR_DeleteScripts

Parameters

Code Examples

RTR_UpdateScripts

Parameters

Code Examples

RTR_UpdateScriptsV2

Parameters

Code Examples

RTR_ListPut_Files

Parameters

Code Examples

RTR_ListScripts

Parameters

Code Examples