Real Time Response Audit

The Real Time Response Audit service collection provides operations for auditing RTR sessions created for a customer in a specified duration.

Language	Last Update
Python	v1.6.5
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.6.0
Rust	v0.7.1
Ruby	v1.4.0

Operation	Description
RTRAuditSessions `audit_sessions`	Get all the RTR sessions created for a customer in a specified duration

RTRAuditSessions

Get all the RTR sessions created for a customer in a specified duration

Method GET

Route /real-time-response-audit/combined/sessions/v1

Scope Real time response audit: READ

PEP 8 audit_sessions

Parameters

filter query · string

Optional filter criteria in FQL format.

sort query · string

Sort order in FQL format.

Available values (3)

created_at updated_at deleted_at

limit query · string

number of sessions to be returned

offset query · string

offset value to be used for paginated results

with_command_info query · boolean

get sessions with command info included; by default sessions are returned without command info which include cloud_request_ids and logs fields

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import RealTimeResponseAudit

falcon = RealTimeResponseAudit(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.audit_sessions(filter="string",
                                 limit="string",
                                 offset="string",
                                 sort="string",
                                 with_command_info=boolean)
print(response)

from falconpy import RealTimeResponseAudit

falcon = RealTimeResponseAudit(client_id=CLIENT_ID,
                               client_secret=CLIENT_SECRET
                               )

response = falcon.RTRAuditSessions(filter="string",
                                   limit="string",
                                   offset="string",
                                   sort="string",
                                   with_command_info=boolean)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("RTRAuditSessions",
                          filter="string",
                          sort="string",
                          limit="string",
                          offset="string",
                          with_command_info=boolean)
print(response)

Get-FalconSession -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer `
  -Cid $boolean

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response_audit"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filter := "string"
  sort := "string"
  limit := "string"
  offset := "string"
  withCommandInfo := boolean

  response, err := client.RealTimeResponseAudit.RTRAuditSessions(
    &real_time_response_audit.RTRAuditSessionsParams{
      Filter: &filter,
      Sort: &sort,
      Limit: &limit,
      Offset: &offset,
      WithCommandInfo: &withCommandInfo,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponseAudit.rTRAuditSessions(
  "string",  // filter
  "string",  // sort
  "string",  // limit
  "string",  // offset
  boolean  // withCommandInfo
);

console.log(response);

use rusty_falcon::apis::real_time_response_audit_api::r_tr_audit_sessions;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = r_tr_audit_sessions(
        &falcon.cfg,  // configuration
        Some("string"),  // filter
        Some("string"),  // sort
        Some("string"),  // limit
        Some("string"),  // offset
        Some(boolean),  // with_command_info
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponseAudit.new

response = api.r_tr_audit_sessions(filter: 'string',
                                   sort: 'string',
                                   limit: 'string',
                                   offset: 'string',
                                   with_command_info: boolean)

puts response

Responses

[
  {
    "cid": "string",
    "cloud_request_ids": [],
    "commands": {},
    "commands_queued": false,
    "created_at": "string",
    "deleted_at": "string",
    "device_details": {},
    "device_id": "string",
    "duration": 0.0,
    "execution_id": "string",
    "hostname": "string",
    "id": "string",
    "logs": [],
    "offline_queued": false,
    "origin": "string",
    "platform_id": 0,
    "platform_name": "string",
    "pwd": "string",
    "updated_at": "string",
    "user_id": "string",
    "user_uuid": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

Real Time Response Audit

Table of Contents

RTRAuditSessions

Parameters