Real Time Response Admin
The Real Time Response Admin service collection provides operations for managing RTR administrator commands, scripts, and put-files. Execute admin commands on single hosts or in batch, manage custom scripts and put-files for RTR sessions.
| Language | Last Update |
|---|---|
| Python | v1.6.5 |
| PowerShell | v2.2.9 |
| Go | v0.22.0 |
| TypeScript | v0.6.0 |
| Rust | v0.7.1 |
| Ruby | v1.4.0 |
This service collection has code examples posted to the repository.
Table of Contents
Section titled “Table of Contents”| Operation | Description |
|---|---|
BatchAdminCmdbatch_admin_command | Batch executes a RTR administrator command across the hosts mapped to the given batch ID. |
RTR-CheckAdminCommandStatuscheck_admin_command_status | Get status of an executed RTR administrator command on a single host. |
RTR-CreatePut-Filescreate_put_files | Upload a new put-file to use for the RTR put command. |
RTR-CreatePut-FilesV2create_put_files_v2 | Upload a new put-file to use for the RTR put command. |
RTR-CreateScriptscreate_scripts | Upload a new custom-script to use for the RTR runscript command. |
RTR-CreateScriptsV2create_scripts_v2 | Upload a new custom-script to use for the RTR runscript command. |
RTR-DeletePut-Filesdelete_put_files | Delete a put-file based on the ID given. |
RTR-DeleteScriptsdelete_scripts | Delete a custom-script based on the ID given. |
RTR-ExecuteAdminCommandexecute_admin_command | Execute a RTR administrator command on a single host. |
RTR-GetFalconScriptsget_falcon_scripts | Get Falcon scripts with metadata and content of script |
RTR-GetPut-Filesget_put_files | Get put-files based on the ID’s given. |
RTR-GetPut-FilesV2get_put_files_v2 | Get put-files based on the ID’s given. |
RTR-GetPutFileContentsget_put_file_contents | Get RTR put file contents for a given file ID |
RTR-GetScriptsget_scripts | Get custom-scripts based on the ID’s given. |
RTR-GetScriptsV2get_scripts_v2 | Get custom-scripts based on the ID’s given. |
RTR-ListFalconScriptslist_falcon_scripts | Get a list of Falcon script IDs available to the user to run |
RTR-ListPut-Fileslist_put_files | Get a list of put-file ID’s that are available to the user for the put command. |
RTR-ListScriptslist_scripts | Get a list of custom-script ID’s that are available to the user for the runscript command. |
RTR-UpdateScriptsupdate_scripts | Upload a new scripts to replace an existing one. |
RTR-UpdateScriptsV2update_scripts_v2 | Upload a new scripts to replace an existing one. |
BatchAdminCmd
Section titled “BatchAdminCmd”Batch executes a RTR administrator command across the hosts mapped to the given batch ID.
Method POST
Route /real-time-response/combined/batch-admin-command/v1
Scope Real time response (admin): WRITE
PEP 8
batch_admin_commandParameters
Section titled “Parameters”body body · dictionary
Full body payload as JSON formatted dictionary.
base_command body · string
Active-Responder command type we are going to execute, for example:
get or cp. Refer to the RTR documentation for the full list of commands.batch_id body · string
Batch ID to execute the command on. Received from batch_init_session.
command_string body · string
Full command string for the command. For example
get some_file.txt.optional_hosts body · array
List of a subset of hosts we want to run the command on. If this list is supplied, only these hosts will receive the command.
persist_all body · boolean
timeout query · integer
Timeout for how long to wait for the request in seconds, default timeout is 30 seconds. Maximum is 5 minutes.
timeout_duration query · string
Timeout duration for how long to wait for the request in duration syntax. Example,
10s. Valid units: ns, us, ms, s, m, h. Maximum is 5 minutes.host_timeout_duration query · string
Timeout duration for how long a host has time to complete processing. Default value is a bit less than the overall timeout value. It cannot be greater than the overall request timeout. Maximum is < 5 minutes. Example,
10s. Valid units: ns, us, ms, s, m, h. parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.batch_admin_command(base_command="string", batch_id="string", command_string="string", host_timeout_duration="string", optional_hosts=id_list, persist_all=boolean, timeout=integer, timeout_duration="string")print(response)from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.BatchAdminCmd(base_command="string", batch_id="string", command_string="string", host_timeout_duration="string", optional_hosts=id_list, persist_all=boolean, timeout=integer, timeout_duration="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
body_payload = { "base_command": "string", "batch_id": "string", "command_string": "string", "optional_hosts": ["string"], "persist_all": boolean}
response = falcon.command("BatchAdminCmd", timeout=integer, timeout_duration="string", host_timeout_duration="string", body=body_payload)print(response)Invoke-FalconAdminCommand -Command "string" -BatchId "string"package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
response, err := client.RealTimeResponseAdmin.BatchAdminCmd( &real_time_response_admin.BatchAdminCmdParams{ Timeout: integer, TimeoutDuration: "string", HostTimeoutDuration: "string", Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.realTimeResponseAdmin.batchAdminCmd( { // body baseCommand: "string", batchId: "string", commandString: "string", optionalHosts: [], persistAll: boolean }, integer, // timeout "string", // timeoutDuration "string" // hostTimeoutDuration);
console.log(response);use rusty_falcon::apis::real_time_response_admin_api::batch_admin_cmd;use rusty_falcon::easy::client::FalconHandle;use rusty_falcon::models::DomainBatchExecuteCommandRequest;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let body = DomainBatchExecuteCommandRequest { base_command: Some("string".to_string()), batch_id: Some("string".to_string()), command_string: Some("string".to_string()), optional_hosts: vec!["string".to_string()], persist_all: Some(boolean), ..Default::default() };
let response = batch_admin_cmd( &falcon.cfg, // configuration body, // body Some(integer), // timeout Some("string"), // timeout_duration Some("string"), // host_timeout_duration ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::RealTimeResponseAdmin.new
body = { base_command: 'string', batch_id: 'string', command_string: 'string', optional_hosts: [], persist_all: boolean}
response = api.batch_admin_cmd(body)
puts responseResponses
{ "combined": { "resources": {} }, "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": {}}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": {}}RTR-CheckAdminCommandStatus
Section titled “RTR-CheckAdminCommandStatus”Get status of an executed RTR administrator command on a single host.
Method GET
Route /real-time-response/entities/admin-command/v1
Scope Real time response (admin): WRITE
PEP 8
check_admin_command_statusParameters
Section titled “Parameters”cloud_request_id query · string
Cloud Request ID of the executed command to query
sequence_id query · integer
Sequence ID that we want to retrieve. Command responses are chunked across sequences
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.check_admin_command_status(cloud_request_id="string", sequence_id=integer)print(response)from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.RTR_CheckAdminCommandStatus(cloud_request_id="string", sequence_id=integer)print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("RTR_CheckAdminCommandStatus", cloud_request_id="string", sequence_id=integer)print(response)Confirm-FalconAdminCommand -CloudRequestId "string"package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
response, err := client.RealTimeResponseAdmin.RTRCheckAdminCommandStatus( &real_time_response_admin.RTRCheckAdminCommandStatusParams{ CloudRequestID: "string", SequenceID: integer, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.realTimeResponseAdmin.rTRCheckAdminCommandStatus( "string", // cloudRequestId integer // sequenceId);
console.log(response);use rusty_falcon::apis::real_time_response_admin_api::r_tr_check_admin_command_status;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = r_tr_check_admin_command_status( &falcon.cfg, // configuration "string", // cloud_request_id integer, // sequence_id ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::RealTimeResponseAdmin.new
response = api.r_tr_check_admin_command_status('string', integer)
puts responseResponses
[ { "base_command": "string", "complete": false, "sequence_id": 0, "session_id": "string", "stderr": "string", "stdout": "string", "task_id": "string" }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": {}}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}RTR-CreatePut-Files
Section titled “RTR-CreatePut-Files”Upload a new put-file to use for the RTR put command.
Method POST
Route /real-time-response/entities/put-files/v1
Scope Real time response (admin): WRITE
PEP 8
create_put_filesParameters
Section titled “Parameters”file body · file
put-file to upload
description body · string
File description
name body · string
File name (if different than actual file name)
comments_for_audit_log body · string
The audit log comment
data body · string
full formData payload, not required if other keywords are used.
files body · string
File to be uploaded. List of tuples. *REQUIRED* Ex: [(‘file’, (‘file.ext’, open(‘file.ext’,‘rb’).read(), ‘application/script’))]
Code Examples
from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.create_put_files(data="string", files="string", description="string", name="string", comments_for_audit_log="string")print(response)from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.RTR_CreatePut_Files(data="string", files="string", description="string", name="string", comments_for_audit_log="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("RTR_CreatePut_Files", file_data=open("filename", "rb").read(), description="string", name="string", comments_for_audit_log="string")print(response)Send-FalconPutFile -Path "string"package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
name := "string" commentsForAuditLog := "string"
response, err := client.RealTimeResponseAdmin.RTRCreatePutFiles( &real_time_response_admin.RTRCreatePutFilesParams{ Description: "string", Name: &name, CommentsForAuditLog: &commentsForAuditLog, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.realTimeResponseAdmin.rTRCreatePutFiles( "string", // file "string", // description "string", // name "string" // commentsForAuditLog);
console.log(response);use rusty_falcon::apis::real_time_response_admin_api::r_tr_create_put_files;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = r_tr_create_put_files( &falcon.cfg, // configuration std::path::PathBuf::default(), // file "string", // description Some("string"), // name Some("string"), // comments_for_audit_log ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::RealTimeResponseAdmin.new
response = api.r_tr_create_put_files('string', 'string')
puts responseResponses
{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": {}}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}RTR-CreatePut-FilesV2
Section titled “RTR-CreatePut-FilesV2”Upload a new put-file to use for the RTR put command.
Method POST
Route /real-time-response/entities/put-files/v2
Scope Real time response (admin): WRITE
PEP 8
create_put_files_v2Parameters
Section titled “Parameters”file body · file
put-file to upload
description body · string
File description
name body · string
File name (if different than actual file name)
comments_for_audit_log body · string
The audit log comment
data body · string
full formData payload, not required if other keywords are used. formData.
files body · string
File to be uploaded. List of tuples. *REQUIRED* Ex: [(‘file’, (‘file.ext’, open(‘file.ext’,‘rb’).read(), ‘application/script’))]
Code Examples
from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.create_put_files_v2(data="string", files="string", description="string", name="string", comments_for_audit_log="string")print(response)from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.RTR_CreatePut_FilesV2(data="string", files="string", description="string", name="string", comments_for_audit_log="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("RTR_CreatePut_FilesV2", file_data=open("filename", "rb").read(), description="string", name="string", comments_for_audit_log="string")print(response)Examples coming soon.
package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
name := "string" commentsForAuditLog := "string"
response, err := client.RealTimeResponseAdmin.RTRCreatePutFilesV2( &real_time_response_admin.RTRCreatePutFilesV2Params{ Description: "string", Name: &name, CommentsForAuditLog: &commentsForAuditLog, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.realTimeResponseAdmin.rTRCreatePutFilesV2( "string", // file "string", // description "string", // name "string" // commentsForAuditLog);
console.log(response);Examples coming soon.
require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::RealTimeResponseAdmin.new
response = api.r_tr_create_put_files_v2('string', 'string')
puts responseResponses
[ { "comments_for_audit_log": "string", "content": "string", "created_by": "string", "created_by_uuid": "string", "created_timestamp": "string", "description": "string", "file_type": "string", "id": "string", "modified_by": "string", "modified_by_uuid": "string", "modified_timestamp": "string", "name": "string", "permission_type": "string", "platform": [], "run_attempt_count": 0, "run_success_count": 0, "sha256": "string", "share_with_workflow": false, "size": 0, "workflow_activity_id": "string", "workflow_input_schema": "string", "workflow_is_disruptive": false, "workflow_output_schema": "string", "write_access": false }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": {}}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}RTR-CreateScripts
Section titled “RTR-CreateScripts”Upload a new custom-script to use for the RTR runscript command.
Method POST
Route /real-time-response/entities/scripts/v1
Scope Real time response (admin): WRITE
PEP 8
create_scriptsParameters
Section titled “Parameters”file body · file
custom-script file to upload. These should be powershell scripts.
description body · string
File description
name body · string
File name (if different than actual file name)
comments_for_audit_log body · string
The audit log comment
permission_type body · string
Permission for the custom-script. Valid permission values: -
private, usable by only the user who uploaded it - group, usable by all RTR Admins - public, usable by all active-responders and RTR adminsAvailable values (3)
privateusable only by the user who upload it
groupusable by all RTR admins
publicusable by all active-responders and RTR admins
content body · string
The script text that you want to use to upload
platform body · string or list of strings
Platforms for the file. Currently supports: windows, mac, linux, . If no platform is provided, it will default to ‘windows’
data body · string
full formData payload, not required if other keywords are used.
files body · string
File to be uploaded. List of tuples. *REQUIRED* Ex: [(‘file’, (‘file.ext’, open(‘file.ext’,‘rb’).read(), ‘application/script’))]
Code Examples
from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.create_scripts(data="string", files="string", description="string", name="string", comments_for_audit_log="string", permission_type="string", content="string", platform="string")print(response)from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.RTR_CreateScripts(data="string", files="string", description="string", name="string", comments_for_audit_log="string", permission_type="string", content="string", platform="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("RTR_CreateScripts", file_data=open("filename", "rb").read(), description="string", name="string", comments_for_audit_log="string", permission_type="string", content="string", platform="string")print(response)Send-FalconScript -Platform @("ID1", "ID2") ` -PermissionType "string" ` -Path "string"package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
name := "string" commentsForAuditLog := "string" content := "string"
response, err := client.RealTimeResponseAdmin.RTRCreateScripts( &real_time_response_admin.RTRCreateScriptsParams{ Description: "string", Name: &name, CommentsForAuditLog: &commentsForAuditLog, PermissionType: "string", Content: &content, Platform: []string{"ID1", "ID2", "ID3"}, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.realTimeResponseAdmin.rTRCreateScripts( "string", // description "string", // permissionType "string", // file "string", // name "string", // commentsForAuditLog "string", // content ["ID1", "ID2", "ID3"] // platform);
console.log(response);use rusty_falcon::apis::real_time_response_admin_api::r_tr_create_scripts;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = r_tr_create_scripts( &falcon.cfg, // configuration "string", // description "string", // permission_type Some(std::path::PathBuf::default()), // file Some("string"), // name Some("string"), // comments_for_audit_log Some("string"), // content Some(vec!["string".to_string()]), // platform ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::RealTimeResponseAdmin.new
response = api.r_tr_create_scripts('string', 'string')
puts responseResponses
{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": {}}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}RTR-CreateScriptsV2
Section titled “RTR-CreateScriptsV2”Upload a new custom-script to use for the RTR runscript command.
Method POST
Route /real-time-response/entities/scripts/v2
Scope Real time response (admin): WRITE
PEP 8
create_scripts_v2Parameters
Section titled “Parameters”file body · file
custom-script file to upload. These should be powershell scripts.
description body · string
File description
name body · string
File name (if different than actual file name)
comments_for_audit_log body · string
The audit log comment
permission_type body · string
Permission for the custom-script. Valid permission values: -
private, usable by only the user who uploaded it - group, usable by all RTR Admins - public, usable by all active-responders and RTR adminscontent body · string
The script text that you want to use to upload
platform body · string or list of strings
Platforms for the file. Currently supports: windows, mac, linux, . If no platform is provided, it will default to ‘windows’
data body · string
full formData payload, not required if other keywords are used. formData.
files body · string
File to be uploaded. List of tuples. *REQUIRED* Ex: [(‘file’, (‘file.ext’, open(‘file.ext’,‘rb’).read(), ‘application/script’))]
Code Examples
from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.create_scripts_v2(data="string", files="string", description="string", name="string", comments_for_audit_log="string", permission_type="string", content="string", platform="string")print(response)from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.RTR_CreateScriptsV2(data="string", files="string", description="string", name="string", comments_for_audit_log="string", permission_type="string", content="string", platform="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("RTR_CreateScriptsV2", file_data=open("filename", "rb").read(), description="string", name="string", comments_for_audit_log="string", permission_type="string", content="string", platform="string")print(response)Examples coming soon.
package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
name := "string" commentsForAuditLog := "string" content := "string"
response, err := client.RealTimeResponseAdmin.RTRCreateScriptsV2( &real_time_response_admin.RTRCreateScriptsV2Params{ Description: "string", Name: &name, CommentsForAuditLog: &commentsForAuditLog, PermissionType: "string", Content: &content, Platform: []string{"ID1", "ID2", "ID3"}, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.realTimeResponseAdmin.rTRCreateScriptsV2( "string", // description "string", // permissionType "string", // file "string", // name "string", // commentsForAuditLog "string", // content ["ID1", "ID2", "ID3"] // platform);
console.log(response);Examples coming soon.
require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::RealTimeResponseAdmin.new
response = api.r_tr_create_scripts_v2('string', 'string')
puts responseResponses
[ { "comments_for_audit_log": "string", "content": "string", "created_by": "string", "created_by_uuid": "string", "created_timestamp": "string", "description": "string", "file_type": "string", "id": "string", "modified_by": "string", "modified_by_uuid": "string", "modified_timestamp": "string", "name": "string", "permission_type": "string", "platform": [], "run_attempt_count": 0, "run_success_count": 0, "sha256": "string", "share_with_workflow": false, "size": 0, "workflow_activity_id": "string", "workflow_input_schema": "string", "workflow_is_disruptive": false, "workflow_output_schema": "string", "write_access": false }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": {}}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}RTR-DeletePut-Files
Section titled “RTR-DeletePut-Files”Delete a put-file based on the ID given.
Method DELETE
Route /real-time-response/entities/put-files/v1
Scope Real time response (admin): WRITE
PEP 8
delete_put_filesParameters
Section titled “Parameters”ids query · string
File id
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.delete_put_files(ids=id_list)print(response)from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.RTR_DeletePut_Files(ids=id_list)print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.command("RTR_DeletePut_Files", ids="string")print(response)Remove-FalconPutFile -Id "string"package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
response, err := client.RealTimeResponseAdmin.RTRDeletePutFiles( &real_time_response_admin.RTRDeletePutFilesParams{ Ids: "string", Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.realTimeResponseAdmin.rTRDeletePutFiles("string"); // ids
console.log(response);use rusty_falcon::apis::real_time_response_admin_api::r_tr_delete_put_files;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = r_tr_delete_put_files( &falcon.cfg, // configuration "string", // ids ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::RealTimeResponseAdmin.new
response = api.r_tr_delete_put_files('string')
puts responseResponses
{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}RTR-DeleteScripts
Section titled “RTR-DeleteScripts”Delete a custom-script based on the ID given.
Method DELETE
Route /real-time-response/entities/scripts/v1
Scope Real time response (admin): WRITE
PEP 8
delete_scriptsParameters
Section titled “Parameters”ids query · string
File id
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.delete_scripts(ids=id_list)print(response)from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.RTR_DeleteScripts(ids=id_list)print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.command("RTR_DeleteScripts", ids="string")print(response)Remove-FalconScript -Id "string"package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
response, err := client.RealTimeResponseAdmin.RTRDeleteScripts( &real_time_response_admin.RTRDeleteScriptsParams{ Ids: "string", Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.realTimeResponseAdmin.rTRDeleteScripts("string"); // ids
console.log(response);use rusty_falcon::apis::real_time_response_admin_api::r_tr_delete_scripts;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = r_tr_delete_scripts( &falcon.cfg, // configuration "string", // ids ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::RealTimeResponseAdmin.new
response = api.r_tr_delete_scripts('string')
puts responseResponses
{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}RTR-ExecuteAdminCommand
Section titled “RTR-ExecuteAdminCommand”Execute a RTR administrator command on a single host.
Method POST
Route /real-time-response/entities/admin-command/v1
Scope Real time response (admin): WRITE
PEP 8
execute_admin_commandParameters
Section titled “Parameters”body body · dictionary
Full body payload as JSON formatted dictionary.
base_command body · string
Active-Responder command type we are going to execute, for example:
get or cp. Refer to the RTR documentation for the full list of commands.command_string body · string
Full command string for the command. For example
get some_file.txt.device_id body · string
ID of the device to execute the command on.
id body · integer
Command sequence.
persist body · boolean
Execute this command when host returns to service.
session_id body · string
RTR session ID.
Code Examples
from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.execute_admin_command(base_command="string", command_string="string", device_id="string", id=integer, persist=boolean, session_id="string")print(response)from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.RTR_ExecuteAdminCommand(base_command="string", command_string="string", device_id="string", id=integer, persist=boolean, session_id="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
body_payload = { "base_command": "string", "command_string": "string", "device_id": "string", "id": integer, "persist": boolean, "session_id": "string"}
response = falcon.command("RTR_ExecuteAdminCommand", body=body_payload)print(response)Invoke-FalconAdminCommand -Command "string" -SessionId "string"package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin" "github.com/crowdstrike/gofalcon/falcon/models")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
base_command := "string" command_string := "string" device_id := "string" id := integer persist := boolean session_id := "string"
response, err := client.RealTimeResponseAdmin.RTRExecuteAdminCommand( &real_time_response_admin.RTRExecuteAdminCommandParams{ Body: &models.DomainCommandExecuteRequest{ BaseCommand: &base_command, CommandString: &command_string, DeviceID: &device_id, ID: &id, Persist: &persist, SessionID: &session_id, }, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.realTimeResponseAdmin.rTRExecuteAdminCommand( { baseCommand: "string", commandString: "string", deviceId: "string", id: integer, persist: boolean, sessionId: "string"} // body);
console.log(response);use rusty_falcon::apis::real_time_response_admin_api::r_tr_execute_admin_command;use rusty_falcon::easy::client::FalconHandle;use rusty_falcon::models::DomainCommandExecuteRequest;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let body = DomainCommandExecuteRequest { base_command: Some("string".to_string()), command_string: Some("string".to_string()), device_id: Some("string".to_string()), id: Some(integer), persist: Some(boolean), session_id: Some("string".to_string()), ..Default::default() };
let response = r_tr_execute_admin_command( &falcon.cfg, // configuration body, // body ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::RealTimeResponseAdmin.new
body = { base_command: 'string', command_string: 'string', device_id: 'string', id: integer, persist: boolean, session_id: 'string'}
response = api.r_tr_execute_admin_command(body)
puts responseResponses
[ { "cloud_request_id": "string", "queued_command_offline": false, "session_id": "string" }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": {}}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}RTR-GetFalconScripts
Section titled “RTR-GetFalconScripts”Get Falcon scripts with metadata and content of script
Method GET
Route /real-time-response/entities/falcon-scripts/v1
Scope Real time response (admin): WRITE
PEP 8
get_falcon_scriptsParameters
Section titled “Parameters”ids query · string or list of strings
IDs of the Falcon scripts you want to retrieve
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_falcon_scripts(ids=id_list)print(response)from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.RTR_GetFalconScripts(ids=id_list)print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.command("RTR_GetFalconScripts", ids=id_list)print(response)Get-FalconLibraryScript -Id @("ID1", "ID2")package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
response, err := client.RealTimeResponseAdmin.RTRGetFalconScripts( &real_time_response_admin.RTRGetFalconScriptsParams{ Ids: []string{"ID1", "ID2", "ID3"}, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.realTimeResponseAdmin.rTRGetFalconScripts(["ID1", "ID2", "ID3"]); // ids
console.log(response);use rusty_falcon::apis::real_time_response_admin_api::r_tr_get_falcon_scripts;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = r_tr_get_falcon_scripts( &falcon.cfg, // configuration vec!["string".to_string()], // ids ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::RealTimeResponseAdmin.new
response = api.r_tr_get_falcon_scripts(['ID1', 'ID2', 'ID3'])
puts responseResponses
[ { "access_roles": [], "categories": [], "content": "string", "created_by": "string", "created_timestamp": "string", "description": "string", "id": "string", "is_disruptive": false, "modified_by": "string", "modified_timestamp": "string", "modifies_system": false, "name": "string", "platform": "string", "required_skus": [], "revision": 0, "sha256": "string", "size": 0, "use_case": "string", "workflow_enabled": false, "workflow_input_schema": "string", "workflow_output_schema": "string", "workflow_tags": [] }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": {}}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": {}}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}RTR-GetPut-Files
Section titled “RTR-GetPut-Files”Get put-files based on the ID’s given.
Method GET
Route /real-time-response/entities/put-files/v1
Scope Real time response (admin): WRITE
PEP 8
get_put_filesParameters
Section titled “Parameters”ids query · string or list of strings
File IDs
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_put_files(ids=id_list)print(response)from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.RTR_GetPut_Files(ids=id_list)print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.command("RTR_GetPut_Files", ids=id_list)print(response)Examples coming soon.
package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
response, err := client.RealTimeResponseAdmin.RTRGetPutFiles( &real_time_response_admin.RTRGetPutFilesParams{ Ids: []string{"ID1", "ID2", "ID3"}, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.realTimeResponseAdmin.rTRGetPutFiles(["ID1", "ID2", "ID3"]); // ids
console.log(response);use rusty_falcon::apis::real_time_response_admin_api::r_tr_get_put_files;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = r_tr_get_put_files( &falcon.cfg, // configuration vec!["string".to_string()], // ids ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::RealTimeResponseAdmin.new
response = api.r_tr_get_put_files(['ID1', 'ID2', 'ID3'])
puts responseResponses
[ { "comments_for_audit_log": "string", "content": "string", "created_by": "string", "created_by_uuid": "string", "created_timestamp": "string", "description": "string", "file_type": "string", "id": "string", "modified_by": "string", "modified_by_uuid": "string", "modified_timestamp": "string", "name": "string", "permission_type": "string", "platform": [], "run_attempt_count": 0, "run_success_count": 0, "sha256": "string", "size": 0, "write_access": false }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": {}}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": {}}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}RTR-GetPut-FilesV2
Section titled “RTR-GetPut-FilesV2”Get put-files based on the ID’s given.
Method GET
Route /real-time-response/entities/put-files/v2
Scope Real time response (admin): WRITE
PEP 8
get_put_files_v2Parameters
Section titled “Parameters”ids query · string or list of strings
File IDs
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_put_files_v2(ids=id_list)print(response)from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.RTR_GetPut_FilesV2(ids=id_list)print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.command("RTR_GetPut_FilesV2", ids=id_list)print(response)Get-FalconPutFile -Id @("ID1", "ID2")package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
response, err := client.RealTimeResponseAdmin.RTRGetPutFilesV2( &real_time_response_admin.RTRGetPutFilesV2Params{ Ids: []string{"ID1", "ID2", "ID3"}, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.realTimeResponseAdmin.rTRGetPutFilesV2(["ID1", "ID2", "ID3"]); // ids
console.log(response);use rusty_falcon::apis::real_time_response_admin_api::r_tr_get_put_files_v2;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = r_tr_get_put_files_v2( &falcon.cfg, // configuration vec!["string".to_string()], // ids ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::RealTimeResponseAdmin.new
response = api.r_tr_get_put_files_v2(['ID1', 'ID2', 'ID3'])
puts responseResponses
[ { "comments_for_audit_log": "string", "content": "string", "created_by": "string", "created_by_uuid": "string", "created_timestamp": "string", "description": "string", "file_type": "string", "id": "string", "modified_by": "string", "modified_by_uuid": "string", "modified_timestamp": "string", "name": "string", "permission_type": "string", "platform": [], "run_attempt_count": 0, "run_success_count": 0, "sha256": "string", "share_with_workflow": false, "size": 0, "workflow_activity_id": "string", "workflow_input_schema": "string", "workflow_is_disruptive": false, "workflow_output_schema": "string", "write_access": false }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": {}}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": {}}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}RTR-GetPutFileContents
Section titled “RTR-GetPutFileContents”Get RTR put file contents for a given file ID
Method GET
Route /real-time-response/entities/put-file-contents/v1
Scope Real time response (admin): WRITE
PEP 8
get_put_file_contentsParameters
Section titled “Parameters”id query · string
put file ID
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
with open("output_file", "wb") as save_file: response = falcon.get_put_file_contents(id="string", stream=boolean) save_file.write(response)from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
with open("output_file", "wb") as save_file: response = falcon.RTR_GetPutFileContents(id="string", stream=boolean) save_file.write(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
with open("output_file", "wb") as save_file: response = falcon.command("RTR_GetPutFileContents", id="string") save_file.write(response)Receive-FalconPutFile -Path "string" -Id "string"package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
response, err := client.RealTimeResponseAdmin.RTRGetPutFileContents( &real_time_response_admin.RTRGetPutFileContentsParams{ ID: "string", Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.realTimeResponseAdmin.rTRGetPutFileContents("string"); // id
console.log(response);use rusty_falcon::apis::real_time_response_admin_api::r_tr_get_put_file_contents;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = r_tr_get_put_file_contents( &falcon.cfg, // configuration "string", // id ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::RealTimeResponseAdmin.new
response = api.r_tr_get_put_file_contents('string')
puts responseResponses
{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": {}}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": {}}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": {}}RTR-GetScripts
Section titled “RTR-GetScripts”Get custom-scripts based on the ID’s given.
Method GET
Route /real-time-response/entities/scripts/v1
Scope Real time response (admin): WRITE
PEP 8
get_scriptsParameters
Section titled “Parameters”ids query · string or list of strings
File IDs
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_scripts(ids=id_list)print(response)from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.RTR_GetScripts(ids=id_list)print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.command("RTR_GetScripts", ids=id_list)print(response)Examples coming soon.
package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
response, err := client.RealTimeResponseAdmin.RTRGetScripts( &real_time_response_admin.RTRGetScriptsParams{ Ids: []string{"ID1", "ID2", "ID3"}, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.realTimeResponseAdmin.rTRGetScripts(["ID1", "ID2", "ID3"]); // ids
console.log(response);use rusty_falcon::apis::real_time_response_admin_api::r_tr_get_scripts;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = r_tr_get_scripts( &falcon.cfg, // configuration vec!["string".to_string()], // ids ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::RealTimeResponseAdmin.new
response = api.r_tr_get_scripts(['ID1', 'ID2', 'ID3'])
puts responseResponses
[ { "comments_for_audit_log": "string", "content": "string", "created_by": "string", "created_by_uuid": "string", "created_timestamp": "string", "description": "string", "file_type": "string", "id": "string", "modified_by": "string", "modified_by_uuid": "string", "modified_timestamp": "string", "name": "string", "permission_type": "string", "platform": [], "run_attempt_count": 0, "run_success_count": 0, "sha256": "string", "size": 0, "write_access": false }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": {}}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": {}}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}RTR-GetScriptsV2
Section titled “RTR-GetScriptsV2”Get custom-scripts based on the ID’s given.
Method GET
Route /real-time-response/entities/scripts/v2
Scope Real time response (admin): WRITE
PEP 8
get_scripts_v2Parameters
Section titled “Parameters”ids query · string or list of strings
File IDs
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.get_scripts_v2(ids=id_list)print(response)from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.RTR_GetScriptsV2(ids=id_list)print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
id_list = 'ID1,ID2,ID3' # Can also pass a list here: ['ID1', 'ID2', 'ID3']
response = falcon.command("RTR_GetScriptsV2", ids=id_list)print(response)Get-FalconScript -Id @("ID1", "ID2")package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
response, err := client.RealTimeResponseAdmin.RTRGetScriptsV2( &real_time_response_admin.RTRGetScriptsV2Params{ Ids: []string{"ID1", "ID2", "ID3"}, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.realTimeResponseAdmin.rTRGetScriptsV2(["ID1", "ID2", "ID3"]); // ids
console.log(response);use rusty_falcon::apis::real_time_response_admin_api::r_tr_get_scripts_v2;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = r_tr_get_scripts_v2( &falcon.cfg, // configuration vec!["string".to_string()], // ids ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::RealTimeResponseAdmin.new
response = api.r_tr_get_scripts_v2(['ID1', 'ID2', 'ID3'])
puts responseResponses
[ { "comments_for_audit_log": "string", "content": "string", "created_by": "string", "created_by_uuid": "string", "created_timestamp": "string", "description": "string", "file_type": "string", "id": "string", "modified_by": "string", "modified_by_uuid": "string", "modified_timestamp": "string", "name": "string", "permission_type": "string", "platform": [], "run_attempt_count": 0, "run_success_count": 0, "sha256": "string", "share_with_workflow": false, "size": 0, "workflow_activity_id": "string", "workflow_input_schema": "string", "workflow_is_disruptive": false, "workflow_output_schema": "string", "write_access": false }]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": {}}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": {}}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}RTR-ListFalconScripts
Section titled “RTR-ListFalconScripts”Get a list of Falcon script IDs available to the user to run
Method GET
Route /real-time-response/queries/falcon-scripts/v1
Scope Real time response (admin): WRITE
PEP 8
list_falcon_scriptsParameters
Section titled “Parameters”filter query · string
Optional filter criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon.
offset query · integer
Starting index of overall result set from which to return ids.
limit query · integer
Number of ids to return.
sort query · string
asc’.
Available values (3)
created_timestamp | modified_timestamp | name |
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.list_falcon_scripts(filter="string", limit=integer, offset=integer, sort="string")print(response)from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.RTR_ListFalconScripts(filter="string", limit=integer, offset=integer, sort="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("RTR_ListFalconScripts", filter="string", offset=integer, limit=integer, sort="string")print(response)Get-FalconLibraryScript -Filter "string" ` -Sort "string" ` -Limit integer ` -Offset integerpackage main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
filter := "string" offset := int64(0) limit := int64(0) sort := "string"
response, err := client.RealTimeResponseAdmin.RTRListFalconScripts( &real_time_response_admin.RTRListFalconScriptsParams{ Filter: &filter, Offset: &offset, Limit: &limit, Sort: &sort, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.realTimeResponseAdmin.rTRListFalconScripts( "string", // filter integer, // offset integer, // limit "string" // sort);
console.log(response);use rusty_falcon::apis::real_time_response_admin_api::r_tr_list_falcon_scripts;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = r_tr_list_falcon_scripts( &falcon.cfg, // configuration Some("string"), // filter Some(integer), // offset Some(integer), // limit Some("string"), // sort ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::RealTimeResponseAdmin.new
response = api.r_tr_list_falcon_scripts(filter: 'string', offset: integer, limit: integer, sort: 'string')
puts responseResponses
[ "string"]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": {}}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": {}}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}RTR-ListPut-Files
Section titled “RTR-ListPut-Files”Get a list of put-file ID’s that are available to the user for the put command.
Method GET
Route /real-time-response/queries/put-files/v1
Scope Real time response (admin): WRITE
PEP 8
list_put_filesParameters
Section titled “Parameters”filter query · string
Optional filter criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon.
Available values (1)
user_id |
offset query · string
Starting index of overall result set from which to return ids.
limit query · integer
Number of ids to return.
sort query · string
The property to sort by.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.list_put_files(filter="string", limit=integer, offset="string", sort="string")print(response)from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.RTR_ListPut_Files(filter="string", limit=integer, offset="string", sort="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("RTR_ListPut_Files", filter="string", offset="string", limit=integer, sort="string")print(response)Get-FalconPutFile -Filter "string" ` -Sort "string" ` -Limit integer ` -Offset integerpackage main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
filter := "string" offset := "string" limit := int64(0) sort := "string"
response, err := client.RealTimeResponseAdmin.RTRListPutFiles( &real_time_response_admin.RTRListPutFilesParams{ Filter: &filter, Offset: &offset, Limit: &limit, Sort: &sort, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.realTimeResponseAdmin.rTRListPutFiles( "string", // filter "string", // offset integer, // limit "string" // sort);
console.log(response);use rusty_falcon::apis::real_time_response_admin_api::r_tr_list_put_files;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = r_tr_list_put_files( &falcon.cfg, // configuration Some("string"), // filter Some("string"), // offset Some(integer), // limit Some("string"), // sort ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::RealTimeResponseAdmin.new
response = api.r_tr_list_put_files(filter: 'string', offset: 'string', limit: integer, sort: 'string')
puts responseResponses
[ "string"]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": {}}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": {}}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}RTR-ListScripts
Section titled “RTR-ListScripts”Get a list of custom-script ID’s that are available to the user for the runscript command.
Method GET
Route /real-time-response/queries/scripts/v1
Scope Real time response (admin): WRITE
PEP 8
list_scriptsParameters
Section titled “Parameters”filter query · string
Optional filter criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon.
Available values (1)
user_id |
offset query · string
Starting index of overall result set from which to return ids.
limit query · integer
Number of ids to return.
sort query · string
The property to sort by.
parameters query · dictionary
Full query string parameters payload in JSON format. Not required when using other keywords.
Code Examples
from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.list_scripts(filter="string", limit=integer, offset="string", sort="string")print(response)from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.RTR_ListScripts(filter="string", limit=integer, offset="string", sort="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("RTR_ListScripts", filter="string", offset="string", limit=integer, sort="string")print(response)Get-FalconScript -Filter "string" ` -Sort "string" ` -Limit integer ` -Offset integerpackage main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
filter := "string" offset := "string" limit := int64(0) sort := "string"
response, err := client.RealTimeResponseAdmin.RTRListScripts( &real_time_response_admin.RTRListScriptsParams{ Filter: &filter, Offset: &offset, Limit: &limit, Sort: &sort, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.realTimeResponseAdmin.rTRListScripts( "string", // filter "string", // offset integer, // limit "string" // sort);
console.log(response);use rusty_falcon::apis::real_time_response_admin_api::r_tr_list_scripts;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = r_tr_list_scripts( &falcon.cfg, // configuration Some("string"), // filter Some("string"), // offset Some(integer), // limit Some("string"), // sort ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::RealTimeResponseAdmin.new
response = api.r_tr_list_scripts(filter: 'string', offset: 'string', limit: integer, sort: 'string')
puts responseResponses
[ "string"]{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": {}}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": {}}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}RTR-UpdateScripts
Section titled “RTR-UpdateScripts”Upload a new scripts to replace an existing one.
Method PATCH
Route /real-time-response/entities/scripts/v1
Scope Real time response (admin): WRITE
PEP 8
update_scriptsParameters
Section titled “Parameters”id body · string
ID to update
file body · file
custom-script file to upload. These should be powershell scripts.
description body · string
File description
name body · string
File name (if different than actual file name)
comments_for_audit_log body · string
The audit log comment
permission_type body · string
Permission for the custom-script. Valid permission values: -
private, usable by only the user who uploaded it - group, usable by all RTR Admins - public, usable by all active-responders and RTR adminsAvailable values (3)
privateusable only by the user who upload it
groupusable by all RTR admins
publicusable by all active-responders and RTR admins
content body · string
The script text that you want to use to upload
platform body · string or list of strings
Platforms for the file. Currently supports: windows, mac, linux,
data body · string
full formData payload, not required if other keywords are used.
files body · string
File to be uploaded. List of tuples. *REQUIRED* Ex: [(‘file’, (‘file.ext’, open(‘file.ext’,‘rb’).read(), ‘application/script’))]
Code Examples
from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.update_scripts(data="string", files="string", description="string", id="string", name="string", comments_for_audit_log="string", permission_type="string", content="string", platform="string")print(response)from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.RTR_UpdateScripts(data="string", files="string", description="string", id="string", name="string", comments_for_audit_log="string", permission_type="string", content="string", platform="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("RTR_UpdateScripts", id="string", file_data=open("filename", "rb").read(), description="string", name="string", comments_for_audit_log="string", permission_type="string", content="string", platform="string")print(response)Edit-FalconScript -Path "string" -Id "string"package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
description := "string" name := "string" commentsForAuditLog := "string" permissionType := "string" content := "string"
response, err := client.RealTimeResponseAdmin.RTRUpdateScripts( &real_time_response_admin.RTRUpdateScriptsParams{ ID: "string", Description: &description, Name: &name, CommentsForAuditLog: &commentsForAuditLog, PermissionType: &permissionType, Content: &content, Platform: []string{"ID1", "ID2", "ID3"}, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.realTimeResponseAdmin.rTRUpdateScripts( "string", // id "string", // file "string", // description "string", // name "string", // commentsForAuditLog "string", // permissionType "string", // content ["ID1", "ID2", "ID3"] // platform);
console.log(response);use rusty_falcon::apis::real_time_response_admin_api::r_tr_update_scripts;use rusty_falcon::easy::client::FalconHandle;
#[tokio::main]async fn main() { let falcon = FalconHandle::from_env().await.expect("Could not authenticate");
let response = r_tr_update_scripts( &falcon.cfg, // configuration "string", // id Some(std::path::PathBuf::default()), // file Some("string"), // description Some("string"), // name Some("string"), // comments_for_audit_log Some("string"), // permission_type Some("string"), // content Some(vec!["string".to_string()]), // platform ).await.expect("API call failed");
println!("{:?}", response);}require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::RealTimeResponseAdmin.new
response = api.r_tr_update_scripts('string')
puts responseResponses
{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ "string" ]}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": {}}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}RTR-UpdateScriptsV2
Section titled “RTR-UpdateScriptsV2”Upload a new scripts to replace an existing one.
Method PATCH
Route /real-time-response/entities/scripts/v2
Scope Real time response (admin): WRITE
PEP 8
update_scripts_v2Parameters
Section titled “Parameters”id body · string
ID to update
file body · file
custom-script file to upload. These should be powershell scripts.
description body · string
File description
name body · string
File name (if different than actual file name)
comments_for_audit_log body · string
The audit log comment
permission_type body · string
Permission for the custom-script. Valid permission values: -
private, usable by only the user who uploaded it - group, usable by all RTR Admins - public, usable by all active-responders and RTR adminsAvailable values (3)
privateusable only by the user who uploaded it
groupusable by all RTR admins
publicusable by all active-responders and RTR admins
content body · string
The script text that you want to use to upload
platform body · string or list of strings
Platforms for the file. Currently supports: windows, mac, linux,
data body · string
full formData payload, not required if other keywords are used. formData.
files body · string
File to be uploaded. List of tuples. *REQUIRED* Ex: [(‘file’, (‘file.ext’, open(‘file.ext’,‘rb’).read(), ‘application/script’))]
Code Examples
from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.update_scripts_v2(data="string", files="string", description="string", id="string", name="string", comments_for_audit_log="string", permission_type="string", content="string", platform="string")print(response)from falconpy import RealTimeResponseAdmin
falcon = RealTimeResponseAdmin(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.RTR_UpdateScriptsV2(data="string", files="string", description="string", id="string", name="string", comments_for_audit_log="string", permission_type="string", content="string", platform="string")print(response)from falconpy import APIHarnessV2
falcon = APIHarnessV2(client_id=CLIENT_ID, client_secret=CLIENT_SECRET )
response = falcon.command("RTR_UpdateScriptsV2", id="string", file_data=open("filename", "rb").read(), description="string", name="string", comments_for_audit_log="string", permission_type="string", content="string", platform="string")print(response)Examples coming soon.
package main
import ( "context" "fmt" "os"
"github.com/crowdstrike/gofalcon/falcon" "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_admin")
func main() { client, err := falcon.NewClient(&falcon.ApiConfig{ ClientId: os.Getenv("FALCON_CLIENT_ID"), ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"), Context: context.Background(), }) if err != nil { panic(err) }
description := "string" name := "string" commentsForAuditLog := "string" permissionType := "string" content := "string"
response, err := client.RealTimeResponseAdmin.RTRUpdateScriptsV2( &real_time_response_admin.RTRUpdateScriptsV2Params{ ID: "string", Description: &description, Name: &name, CommentsForAuditLog: &commentsForAuditLog, PermissionType: &permissionType, Content: &content, Platform: []string{"ID1", "ID2", "ID3"}, Context: context.Background(), }, ) if err != nil { panic(falcon.ErrorExplain(err)) }
fmt.Printf("%+v\n", response.Payload)}import { FalconClient } from "crowdstrike-falcon";
const client = new FalconClient({ cloud: process.env.FALCON_CLOUD!, clientId: process.env.FALCON_CLIENT_ID!, clientSecret: process.env.FALCON_CLIENT_SECRET!,});
const response = await client.realTimeResponseAdmin.rTRUpdateScriptsV2( "string", // id "string", // file "string", // description "string", // name "string", // commentsForAuditLog "string", // permissionType "string", // content ["ID1", "ID2", "ID3"] // platform);
console.log(response);Examples coming soon.
require "crimson-falcon"
Falcon.configure do |config| config.client_id = ENV["FALCON_CLIENT_ID"] config.client_secret = ENV["FALCON_CLIENT_SECRET"] config.cloud = ENV["FALCON_CLOUD"]end
api = Falcon::RealTimeResponseAdmin.new
response = api.r_tr_update_scripts_v2('string')
puts responseResponses
{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": [ { "comments_for_audit_log": "string", "content": "string", "created_by": "string", "created_by_uuid": "string", "created_timestamp": "string", "description": "string", "file_type": "string", "id": "string", "modified_by": "string", "modified_by_uuid": "string", "modified_timestamp": "string", "name": "string", "permission_type": "string", "platform": [], "run_attempt_count": 0, "run_success_count": 0, "sha256": "string", "share_with_workflow": false, "size": 0, "workflow_activity_id": "string", "workflow_input_schema": "string", "workflow_is_disruptive": false, "workflow_output_schema": "string", "write_access": false } ]}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }, "resources": {}}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}{ "errors": [ { "code": 0, "id": "string", "message": "string" } ], "meta": { "pagination": { "limit": 0, "offset": 0, "total": 0 }, "powered_by": "string", "query_time": 0.0, "trace_id": "string", "writes": { "resources_affected": 0 } }}