Real Time Response

The Real Time Response service collection provides operations for managing and executing real-time response sessions on CrowdStrike Falcon-protected hosts. Initialize single or batch RTR sessions, execute read-only and active-responder commands, retrieve command status, manage session files, handle queued sessions, and query session IDs.

Language	Last Update
Python	v1.5.0
PowerShell	v2.2.9
Go	v0.20.0
TypeScript	v0.6.0
Rust	v0.7.0
Ruby	v1.2.0

This service collection has code examples posted to the repository.

Operation	Description
RTR_AggregateSessions `aggregate_sessions`	Get aggregates on session data.
BatchActiveResponderCmd `batch_active_responder_command`	Batch executes a RTR active-responder command across the hosts mapped to the given batch ID.
BatchCmd `batch_command`	Batch executes a RTR read-only command across the hosts mapped to the given batch ID.
BatchGetCmdStatus `batch_get_command_status`	Retrieves the status of the specified batch get command. Will return successful files when they are finished processing.
BatchGetCmd `batch_get_command`	Batch executes `get` command across hosts to retrieve files. After this call is made BatchGetCmdStatus is used to query for the results.
BatchInitSessions `batch_init_sessions`	Batch initialize a RTR session on multiple hosts. Before any RTR commands can be used, an active session is needed on the host.
BatchRefreshSessions `batch_refresh_sessions`	Batch refresh a RTR session on multiple hosts. RTR sessions will expire after 5 minutes unless refreshed.
RTR_CheckActiveResponderCommandStatus `check_active_responder_command_status`	Get status of an executed active-responder command on a single host.
RTR_ExecuteActiveResponderCommand `execute_active_responder_command`	Execute an active responder command on a single host.
RTR_CheckCommandStatus `check_command_status`	Get status of an executed command on a single host.
RTR_ExecuteCommand `execute_command`	Execute a command on a single host.
RTR_GetExtractedFileContents `get_extracted_file_contents`	Get RTR extracted file contents for specified session and sha256.
RTR_ListFiles `list_files`	Get a list of files for the specified RTR session.
RTR_ListFilesV2 `list_files_v2`	Get a list of files for the specified RTR session. (Expanded output detail.)
RTR_DeleteFile `delete_file`	Delete a RTR session file.
RTR_DeleteFileV2 `delete_file_v2`	Delete a RTR session file. (Expanded output detail, use with RTR_ListFilesV2.)
RTR_ListQueuedSessions `list_queued_sessions`	Get queued session metadata by session ID.
RTR_DeleteQueuedSession `delete_queued_session`	Delete a queued session command.
RTR_PulseSession `pulse_session`	Refresh a session timeout on a single host.
RTR_ListSessions `list_sessions`	Get session metadata by session id.
RTR_InitSession `init_session`	Initialize a new session with the RTR cloud.
RTR_DeleteSession `delete_session`	Delete a session.
RTR_ListAllSessions `list_all_sessions`	Get a list of session_ids.

RTR_AggregateSessions

Get aggregates on session data.

POST /real-time-response/aggregates/sessions/GET/v1

Scope Real Time Response: READ Consumes · Produces application/json

PEP 8 aggregate_sessions

Parameters

Name	Type	Data type	Description
body	body	list of dictionaries	Full body payload in JSON format.
date_ranges	body	list of dictionaries	Applies to date_range aggregations. Example: [ { “from”: “2016-05-28T09:00:31Z”, “to”: “2016-05-30T09:00:31Z” }, { “from”: “2016-06-01T09:00:31Z”, “to”: “2016-06-10T09:00:31Z” } ]
exclude	body	string	Elements to exclude.
field	body	string	The field on which to compute the aggregation.
filter	body	string	FQL syntax formatted string to use to filter the results.
from	body	integer	Starting position.
include	body	string	Elements to include.
interval	body	string	Time interval for date histogram aggregations. Valid values include: `year`, `month`, `week`, `day`, `hour`, `minute`.
max_doc_count	body	integer	Only return buckets if values are less than or equal to the value here.
min_doc_count	body	integer	Only return buckets if values are greater than or equal to the value here.
missing	body	string	Missing is the value to be used when the aggregation field is missing from the object. In other words, the missing parameter defines how documents that are missing a value should be treated. By default they will be ignored, but it is also possible to treat them as if they had a value.
name	body	string	Name of the aggregate query, as chosen by the user. Used to identify the results returned to you.
q	body	string	Full text search across all metadata fields.
ranges	body	list of dictionaries	Applies to range aggregations. Ranges values will depend on field. For example, if `max_severity` is used, ranges might look like: [ { “From”: 0, “To”: 70 }, { “From”: 70, “To”: 100 } ]
size	body	integer	The max number of term buckets to be returned.
sub_aggregates	body	list of dictionaries	A nested aggregation, such as: [ { “name”: “max_first_behavior”, “type”: “max”, “field”: “first_behavior” } ] There is a maximum of 3 nested aggregations per request.
sort	body	string	FQL syntax string to sort bucket results. `_count` - sort by document count, `_term` - sort by the string value alphabetically. Supports `asc` and `desc` using `\|` format. Example: `_count\|desc`
time_zone	body	string	Time zone for bucket results.
type	body	string	Type of aggregation. Valid values include: `date_histogram` — Aggregates counts on a specified time interval. Requires use of “interval” field. `date_range` — Aggregates counts on custom defined date range buckets. Can include multiple ranges. (Similar to time series, but the bucket sizes are variable). Date formats to follow ISO 8601. `terms` — Buckets alerts by the value of a specified field. `range` — Buckets alerts by specified (numeric) ranges of a specified field. `cardinality` — Returns the count of distinct values in a specified field. `max` — Returns the maximum value of a specified field. `min` — Returns the minimum value of a specified field. `avg` — Returns the average value of the specified field. `sum` — Returns the total sum of all values for the specified field. `percentiles` — Returns the following percentiles for the specified field: `1`, `5`, `25`, `50`, `75`, `95`, `99`.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

ranges = [
    {
        "From": 0,
        "To": 0
    }
]

response = falcon.aggregate_sessions(date_ranges="string",
                                     exclude="string",
                                     field="string",
                                     filter="string",
                                     from=integer,
                                     include="string",
                                     interval="string",
                                     max_doc_count=integer,
                                     min_doc_count=integer,
                                     missing="string",
                                     name="string",
                                     q="string",
                                     ranges=ranges,
                                     size=integer,
                                     sort="string",
                                     sub_aggregates=["string"],
                                     time_zone="string",
                                     type="string")
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

ranges = [
    {
        "From": 0,
        "To": 0
    }
]

response = falcon.RTR_AggregateSessions(date_ranges="string",
                                        exclude="string",
                                        field="string",
                                        filter="string",
                                        from=integer,
                                        include="string",
                                        interval="string",
                                        max_doc_count=integer,
                                        min_doc_count=integer,
                                        missing="string",
                                        name="string",
                                        q="string",
                                        ranges=ranges,
                                        size=integer,
                                        sort="string",
                                        sub_aggregates=["string"],
                                        time_zone="string",
                                        type="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = [
    {
        "date_ranges": [
            {
                "from": "string",
                "to": "string"
            }
        ],
        "exclude": "string",
        "extended_bounds": {
            "max": "string",
            "min": "string"
        },
        "field": "string",
        "filter": "string",
        "filters_spec": {
            "filters": {},
            "other_bucket": boolean,
            "other_bucket_key": "string"
        },
        "from": integer,
        "include": "string",
        "interval": "string",
        "max_doc_count": integer,
        "min_doc_count": integer,
        "missing": "string",
        "name": "string",
        "percents": ["string"],
        "q": "string",
        "ranges": [
            {
                "from": integer,
                "to": integer
            }
        ],
        "size": integer,
        "sort": "string",
        "sub_aggregates": [
            {
                "date_ranges": ["string"],
                "exclude": "string",
                "extended_bounds": {},
                "field": "string",
                "filter": "string",
                "filters_spec": {},
                "from": integer,
                "include": "string",
                "interval": "string",
                "max_doc_count": integer,
                "min_doc_count": integer,
                "missing": "string",
                "name": "string",
                "percents": ["string"],
                "q": "string",
                "ranges": ["string"],
                "size": integer,
                "sort": "string",
                "sub_aggregates": ["string"],
                "time_zone": "string",
                "type": "string"
            }
        ],
        "time_zone": "string",
        "type": "string"
    }
]

response = falcon.command("RTR_AggregateSessions", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  from := "string"
  to := "string"
  exclude := "string"
  field := "string"
  filter := "string"
  from := integer
  include := "string"
  interval := "string"
  max_doc_count := integer
  min_doc_count := integer
  missing := "string"
  name := "string"
  q := "string"
  From := integer
  To := integer
  size := integer
  sort := "string"
  time_zone := "string"
  type := "string"

  response, err := client.RealTimeResponse.RTRAggregateSessions(
    &real_time_response.RTRAggregateSessionsParams{
      Body: []*models.MsaAggregateQueryRequest{
        {
          DateRanges: []interface{}{
            {
            From: &from,
            To: &to,
            },
          },
          Exclude: &exclude,
          ExtendedBounds: &struct{}{},
          Field: &field,
          Filter: &filter,
          FiltersSpec: &struct{}{},
          From: &from,
          Include: &include,
          Interval: &interval,
          MaxDocCount: &max_doc_count,
          MinDocCount: &min_doc_count,
          Missing: &missing,
          Name: &name,
          Percents: []interface{}{},
          Q: &q,
          Ranges: []interface{}{
            {
            From: &From,
            To: &To,
            },
          },
          Size: &size,
          Sort: &sort,
          SubAggregates: []interface{}{
            {
            DateRanges: []interface{}{
              {
              From: &from,
              To: &to,
              },
            },
            Exclude: &exclude,
            ExtendedBounds: &struct{}{},
            Field: &field,
            Filter: &filter,
            FiltersSpec: &struct{}{},
            From: &from,
            Include: &include,
            Interval: &interval,
            MaxDocCount: &max_doc_count,
            MinDocCount: &min_doc_count,
            Missing: &missing,
            Name: &name,
            Percents: []interface{}{},
            Q: &q,
            Ranges: []interface{}{
              {
              From: &From,
              To: &To,
              },
            },
            Size: &size,
            Sort: &sort,
            SubAggregates: []interface{}{
              {
              DateRanges: []interface{}{},
              Exclude: &exclude,
              ExtendedBounds: &struct{}{},
              Field: &field,
              Filter: &filter,
              FiltersSpec: &struct{}{},
              From: &from,
              Include: &include,
              Interval: &interval,
              MaxDocCount: &max_doc_count,
              MinDocCount: &min_doc_count,
              Missing: &missing,
              Name: &name,
              Percents: []interface{}{},
              Q: &q,
              Ranges: []interface{}{},
              Size: &size,
              Sort: &sort,
              SubAggregates: []interface{}{},
              TimeZone: &time_zone,
              Type: &type,
              },
            },
            TimeZone: &time_zone,
            Type: &type,
            },
          },
          TimeZone: &time_zone,
          Type: &type,
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.rTRAggregateSessions(
  [{
    dateRanges: [{
        from: "string",
        to: "string"
      }],
    exclude: "string",
    extendedBounds: {
      max: "string",
      min: "string"
    },
    field: "string",
    filter: "string",
    filtersSpec: {
      filters: {},
      otherBucket: boolean,
      otherBucketKey: "string"
    },
    from: integer,
    include: "string",
    interval: "string",
    maxDocCount: integer,
    minDocCount: integer,
    missing: "string",
    name: "string",
    percents: [],
    q: "string",
    ranges: [{
        From: integer,
        To: integer
      }],
    size: integer,
    sort: "string",
    subAggregates: [{
        dateRanges: [{
            from: "string",
            to: "string"
          }],
        exclude: "string",
        extendedBounds: {
          max: "string",
          min: "string"
        },
        field: "string",
        filter: "string",
        filtersSpec: {
          filters: {},
          otherBucket: boolean,
          otherBucketKey: "string"
        },
        from: integer,
        include: "string",
        interval: "string",
        maxDocCount: integer,
        minDocCount: integer,
        missing: "string",
        name: "string",
        percents: [],
        q: "string",
        ranges: [{
            From: integer,
            To: integer
          }],
        size: integer,
        sort: "string",
        subAggregates: [{
            dateRanges: [],
            exclude: "string",
            extendedBounds: {},
            field: "string",
            filter: "string",
            filtersSpec: {},
            from: integer,
            include: "string",
            interval: "string",
            maxDocCount: integer,
            minDocCount: integer,
            missing: "string",
            name: "string",
            percents: [],
            q: "string",
            ranges: [],
            size: integer,
            sort: "string",
            subAggregates: [],
            timeZone: "string",
            type: "string"
          }],
        timeZone: "string",
        type: "string"
      }],
    timeZone: "string",
    type: "string"
}]  // body
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::r_tr_aggregate_sessions;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::MsaAggregateQueryRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = vec![MsaAggregateQueryRequest {
            date_ranges: vec![DateRangeSpec {
                from: Some("string".to_string()),
                to: Some("string".to_string()),
                ..Default::default()
            }],
            exclude: Some("string".to_string()),
            field: Some("string".to_string()),
            filter: Some("string".to_string()),
            filters_spec: Default::default(),
            from: Some(integer),
            include: Some("string".to_string()),
            interval: Some("string".to_string()),
            missing: Some("string".to_string()),
            name: Some("string".to_string()),
            percents: vec![],
            q: Some("string".to_string()),
            ranges: vec![RangeSpec {
                from: Some(integer),
                to: Some(integer),
                ..Default::default()
            }],
            size: Some(integer),
            sort: Some("string".to_string()),
            sub_aggregates: vec![AggregateQueryRequest {
                date_ranges: vec![DateRangeSpec {
                    from: Some("string".to_string()),
                    to: Some("string".to_string()),
                    ..Default::default()
                }],
                exclude: Some("string".to_string()),
                field: Some("string".to_string()),
                filter: Some("string".to_string()),
                filters_spec: Default::default(),
                from: Some(integer),
                include: Some("string".to_string()),
                interval: Some("string".to_string()),
                missing: Some("string".to_string()),
                name: Some("string".to_string()),
                percents: vec![],
                q: Some("string".to_string()),
                ranges: vec![RangeSpec {
                    from: Some(integer),
                    to: Some(integer),
                    ..Default::default()
                }],
                size: Some(integer),
                sort: Some("string".to_string()),
                sub_aggregates: vec![AggregateQueryRequest {
                    date_ranges: vec![],
                    exclude: Some("string".to_string()),
                    field: Some("string".to_string()),
                    filter: Some("string".to_string()),
                    filters_spec: Default::default(),
                    from: Some(integer),
                    include: Some("string".to_string()),
                    interval: Some("string".to_string()),
                    missing: Some("string".to_string()),
                    name: Some("string".to_string()),
                    percents: vec![],
                    q: Some("string".to_string()),
                    ranges: vec![],
                    size: Some(integer),
                    sort: Some("string".to_string()),
                    sub_aggregates: vec![],
                    time_zone: Some("string".to_string()),
                    type: Some("string".to_string()),
                    ..Default::default()
                }],
                time_zone: Some("string".to_string()),
                type: Some("string".to_string()),
                ..Default::default()
            }],
            time_zone: Some("string".to_string()),
            type: Some("string".to_string()),
            ..Default::default()
        }];

    let response = r_tr_aggregate_sessions(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

body = {}

response = api.r_tr_aggregate_sessions(body)

puts response

BatchActiveResponderCmd

Batch executes a RTR active-responder command across the hosts mapped to the given batch ID.

POST /real-time-response/combined/batch-active-responder-command/v1

Scope Real Time Response: WRITE Consumes · Produces application/json

PEP 8 batch_active_responder_command

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
base_command	body	string	Active Responder base command to perform. For example: `get` or `cp`. Refer to the Available Commands table below for a complete listing of available commands.
batch_id	body	string	RTR Batch ID to execute the command against. Received from `batch_init_session`.
command_string	body	string	Full command line of the command to execute. Example: `get some_file.txt`.
host_timeout_duration	query	string	Timeout duration for how long a host has time to complete processing. Default value is a bit less than the overall timeout value. It cannot be greater than the overall request timeout. Maximum is < 5 minutes. Example, `10s`. Valid units: `ns`, `us`, `ms`, `s`, `m`, `h`.
optional_hosts	body	string or list of strings	List of the subset of hosts we want to impact by this command. Allows for filtering of hosts from execution within the same batch.
persist_all	body	boolean	Flag indicating if this command should be executed when the host returns to service.
timeout	query	integer	Timeout for how long to wait for the request in seconds, default timeout is 30 seconds. Maximum is 5 minutes.
timeout_duration	query	string	Timeout duration for for how long to wait for the request in duration syntax. Example, `10s`. Valid units: `ns, us, ms, s, m, h`. Maximum is 5 minutes.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Available Commands

Command	Description	Operating System
`cat`	View file contents	All
`cd`	Change directory	All
`clear`	Clear the screen	All
`cp`	Copy a file	All
`encrypt`	Encrypt a file	All
`env`	Display environment variables	All
`eventlog`	Inspect the event log. Subcommands: list, view, export, backup. `eventlog backup` is the recommended solution as opposed to `eventlog export`.	Windows
`filehash`	Calculate a file hash (MD5 or SHA256)	All
`get`	Retrieve a file	All
`getsid`	Retrieve the current SID	Windows, macOS
`help`	Access help for a specific command or sub-command	All
`history`	Review command history for the current user	All
`ipconfig`	Review TCP configuration	Windows
`kill`	Kill a running process	All
`ls`	List the contents of a directory	All
`map`	Map a UNC (SMB) path to a drive letter	Windows
`memdump`	Dump memory of a running process	Windows
`mkdir`	Create a directory	All
`mount`	Mount a file system (macOS, Linux) or list available drives (Windows)	All
`mv`	Move a file	All
`netstat`	Retrieve network connection detail	All
`ps`	List running processes	All
`reg`	Registry operations. Subcommands: query, set, delete, load, unload.	Windows
`restart`	Restart the system	All
`rm`	Remove a file	All
`runscript`	Run a script	All
`shutdown`	Shutdown the system	All
`unmap`	Unmap a UNC (SMB) path from a drive letter	Windows
`update`	Install patches through Windows Update. Subcommands: history, install, list, query.	Windows
`xmemdump`	Dump complete memory (kernel) for the system	Windows
`zip`	Create a zip archive	All

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.batch_active_responder_command(base_command="string",
                                                 batch_id="string",
                                                 command_string="string",
                                                 host_timeout_duration="string",
                                                 optional_hosts=["string"],
                                                 persist_all=boolean,
                                                 timeout="string",
                                                 timeout_duration="string")
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.BatchActiveResponderCmd(base_command="string",
                                          batch_id="string",
                                          command_string="string",
                                          host_timeout_duration="string",
                                          optional_hosts=["string"],
                                          persist_all=boolean,
                                          timeout="string",
                                          timeout_duration="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "base_command": "string",
    "batch_id": "string",
    "command_string": "string",
    "optional_hosts": ["string"],
    "persist_all": boolean
}

response = falcon.command("BatchActiveResponderCmd",
                          timeout=integer,
                          timeout_duration="string",
                          host_timeout_duration="string",
                          body=body_payload)
print(response)

Invoke-FalconResponderCommand -Command "string" -BatchId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.RealTimeResponse.BatchActiveResponderCmd(
    &real_time_response.BatchActiveResponderCmdParams{
      Timeout: integer,
      TimeoutDuration: "string",
      HostTimeoutDuration: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.batchActiveResponderCmd(
  {  // body
      baseCommand: "string",
      batchId: "string",
      commandString: "string",
      optionalHosts: [],
      persistAll: boolean
  },
  integer,  // timeout
  "string",  // timeoutDuration
  "string"  // hostTimeoutDuration
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::batch_active_responder_cmd;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainBatchExecuteCommandRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DomainBatchExecuteCommandRequest {
        base_command: Some("string".to_string()),
        batch_id: Some("string".to_string()),
        command_string: Some("string".to_string()),
        optional_hosts: vec!["string".to_string()],
        persist_all: Some(boolean),
        ..Default::default()
    };

    let response = batch_active_responder_cmd(
        &falcon.cfg,  // configuration
        body,  // body
        Some(integer),  // timeout
        Some("string"),  // timeout_duration
        Some("string"),  // host_timeout_duration
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

body = {
  base_command: 'string',
  batch_id: 'string',
  command_string: 'string',
  optional_hosts: [],
  persist_all: boolean
}

response = api.batch_active_responder_cmd(body)

puts response

BatchCmd

Batch executes a RTR read-only command across the hosts mapped to the given batch ID.

POST /real-time-response/combined/batch-command/v1

Scope Real Time Response: READ Consumes · Produces application/json

PEP 8 batch_command

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
base_command	body	string	Active Responder base command to perform. For example: `get` or `cp`. Refer to the Available Commands table below for a complete listing of available commands.
batch_id	body	string	RTR Batch ID to execute the command against. Received from `batch_init_session`.
command_string	body	string	Full command line of the command to execute. Example: `cat some_file.txt`.
host_timeout_duration	query	string	Timeout duration for how long a host has time to complete processing. Default value is a bit less than the overall timeout value. It cannot be greater than the overall request timeout. Maximum is < 5 minutes. Example, `10s`. Valid units: `ns`, `us`, `ms`, `s`, `m`, `h`.
optional_hosts	body	string or list of strings	List of the subset of hosts we want to impact by this command. Allows for filtering of hosts from execution within the same batch.
persist_all	body	boolean	Flag indicating if this command should be executed when the host returns to service.
timeout	query	integer	Timeout for how long to wait for the request in seconds, default timeout is 30 seconds. Maximum is 5 minutes.
timeout_duration	query	string	Timeout duration for for how long to wait for the request in duration syntax. Example, `10s`. Valid units: `ns, us, ms, s, m, h`. Maximum is 5 minutes.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Available Commands (Read only)

Command	Description	Operating System
`cat`	View file contents	All
`cd`	Change directory	All
`clear`	Clear the screen	All
`csrutil`	Get system integrity protection status	macOS
`env`	Display environment variables	All
`eventlog`	Inspect the event log. Subcommands: list, view.	Windows
`filehash`	Calculate a file hash (MD5 or SHA256)	All
`getsid`	Retrieve the current SID	Windows, macOS
`help`	Access help for a specific command or sub-command	All
`history`	Review command history for the current user	All
`ipconfig`	Review TCP configuration	Windows
`ls`	List the contents of a directory	All
`mount`	Mount a file system (macOS, Linux) or list available drives (Windows)	All
`netstat`	Retrieve network connection detail	All
`ps`	List running processes	All
`reg`	Registry operations. Subcommands: query.	Windows

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.batch_command(base_command="string",
                                batch_id="string",
                                command_string="string",
                                host_timeout_duration="string",
                                optional_hosts=["string"],
                                persist_all=boolean,
                                timeout="string",
                                timeout_duration="string")
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.BatchCmd(base_command="string",
                           batch_id="string",
                           command_string="string",
                           host_timeout_duration="string",
                           optional_hosts=["string"],
                           persist_all=boolean,
                           timeout="string",
                           timeout_duration="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "base_command": "string",
    "batch_id": "string",
    "command_string": "string",
    "optional_hosts": ["string"],
    "persist_all": boolean
}

response = falcon.command("BatchCmd",
                          timeout=integer,
                          timeout_duration="string",
                          host_timeout_duration="string",
                          body=body_payload)
print(response)

Invoke-FalconCommand -Command "string" -BatchId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.RealTimeResponse.BatchCmd(
    &real_time_response.BatchCmdParams{
      Timeout: integer,
      TimeoutDuration: "string",
      HostTimeoutDuration: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.batchCmd(
  {  // body
      baseCommand: "string",
      batchId: "string",
      commandString: "string",
      optionalHosts: [],
      persistAll: boolean
  },
  integer,  // timeout
  "string",  // timeoutDuration
  "string"  // hostTimeoutDuration
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::batch_cmd;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainBatchExecuteCommandRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DomainBatchExecuteCommandRequest {
        base_command: Some("string".to_string()),
        batch_id: Some("string".to_string()),
        command_string: Some("string".to_string()),
        optional_hosts: vec!["string".to_string()],
        persist_all: Some(boolean),
        ..Default::default()
    };

    let response = batch_cmd(
        &falcon.cfg,  // configuration
        body,  // body
        Some(integer),  // timeout
        Some("string"),  // timeout_duration
        Some("string"),  // host_timeout_duration
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

body = {
  base_command: 'string',
  batch_id: 'string',
  command_string: 'string',
  optional_hosts: [],
  persist_all: boolean
}

response = api.batch_cmd(body)

puts response

BatchGetCmdStatus

Retrieves the status of the specified batch get command. Will return successful files when they are finished processing.

GET /real-time-response/combined/batch-get-command/v1

Scope Real Time Response: WRITE Consumes · Produces application/json

PEP 8 batch_get_command_status

Parameters

Name	Type	Data type	Description
batch_get_cmd_req_id	query	string	Batch Get Command Request ID (usually retrieved when making a call to BatchGetCmd).
parameters	query	dictionary	Full query string parameters payload in JSON format.
timeout	query	integer	Timeout for how long to wait for the request in seconds, default timeout is 30 seconds. Maximum is 5 minutes.
timeout_duration	query	string	Timeout duration for for how long to wait for the request in duration syntax. Example, `10s`. Valid units: `ns, us, ms, s, m, h`. Maximum is 5 minutes.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.batch_get_command_status(timeout="string",
                                           timeout_duration="string",
                                           batch_get_cmd_req_id="string")
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.BatchGetCmdStatus(timeout="string",
                                    timeout_duration="string",
                                    batch_get_cmd_req_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("BatchGetCmdStatus",
                          timeout=integer,
                          timeout_duration="string",
                          batch_get_cmd_req_id="string")
print(response)

Confirm-FalconGetFile -BatchGetCmdReqId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.RealTimeResponse.BatchGetCmdStatus(
    &real_time_response.BatchGetCmdStatusParams{
      Timeout: integer,
      TimeoutDuration: "string",
      BatchGetCmdReqID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.batchGetCmdStatus(
  "string",  // batchGetCmdReqId
  integer,  // timeout
  "string"  // timeoutDuration
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::batch_get_cmd_status;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = batch_get_cmd_status(
        &falcon.cfg,  // configuration
        "string",  // batch_get_cmd_req_id
        Some(integer),  // timeout
        Some("string"),  // timeout_duration
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

response = api.batch_get_cmd_status('string')

puts response

BatchGetCmd

Batch executes get command across hosts to retrieve files. After this call is made BatchGetCmdStatus is used to query for the results.

POST /real-time-response/combined/batch-get-command/v1

Scope Real Time Response: WRITE Consumes · Produces application/json

PEP 8 batch_get_command

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
batch_id	body	string	RTR Batch ID to execute the get command against. Received from `batch_init_session`.
file_path	body	string	Full path to the file that is to be retrieved from each host in the batch.
host_timeout_duration	query	string	Timeout duration for how long a host has time to complete processing. Default value is a bit less than the overall timeout value. It cannot be greater than the overall request timeout. Maximum is < 5 minutes. Example, `10s`. Valid units: `ns`, `us`, `ms`, `s`, `m`, `h`.
optional_hosts	body	string or list of strings	List of the subset of hosts we want to impact by this command. Allows for filtering of hosts from execution within the same batch.
parameters	query	dictionary	Full query string parameters payload in JSON format.
timeout	query	integer	Timeout for how long to wait for the request in seconds, default timeout is 30 seconds. Maximum is 5 minutes.
timeout_duration	query	string	Timeout duration for for how long to wait for the request in duration syntax. Example, `10s`. Valid units: `ns, us, ms, s, m, h`. Maximum is 5 minutes.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.batch_get_command(batch_id="string",
                                    file_path="string",
                                    host_timeout_duration="string",
                                    optional_hosts=["string"],
                                    timeout="string",
                                    timeout_duration="string")
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.BatchGetCmd(batch_id="string",
                              file_path="string",
                              host_timeout_duration="string",
                              optional_hosts=["string"],
                              timeout="string",
                              timeout_duration="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "batch_id": "string",
    "file_path": "string",
    "optional_hosts": ["string"]
}

response = falcon.command("BatchGetCmd",
                          timeout=integer,
                          timeout_duration="string",
                          host_timeout_duration="string",
                          body=body_payload)
print(response)

Invoke-FalconBatchGet -FilePath "string" -BatchId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.RealTimeResponse.BatchGetCmd(
    &real_time_response.BatchGetCmdParams{
      Timeout: integer,
      TimeoutDuration: "string",
      HostTimeoutDuration: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.batchGetCmd(
  {  // body
      batchId: "string",
      filePath: "string",
      optionalHosts: []
  },
  integer,  // timeout
  "string",  // timeoutDuration
  "string"  // hostTimeoutDuration
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::batch_get_cmd;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainBatchGetCommandRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DomainBatchGetCommandRequest {
        batch_id: Some("string".to_string()),
        file_path: Some("string".to_string()),
        optional_hosts: vec!["string".to_string()],
        ..Default::default()
    };

    let response = batch_get_cmd(
        &falcon.cfg,  // configuration
        body,  // body
        Some(integer),  // timeout
        Some("string"),  // timeout_duration
        Some("string"),  // host_timeout_duration
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

body = {
  batch_id: 'string',
  file_path: 'string',
  optional_hosts: []
}

response = api.batch_get_cmd(body)

puts response

BatchInitSessions

Batch initialize a RTR session on multiple hosts. Before any RTR commands can be used, an active session is needed on the host.

POST /real-time-response/combined/batch-init-session/v1

Scope Real Time Response: READ Consumes · Produces application/json

PEP 8 batch_init_sessions

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
existing_batch_id	body	string	Optional existing RTR batch ID. Use this to initialize new hosts and add them to the existing batch.
host_ids	body	string or list of strings	List of host agent IDs to initialize a RTR session on.
host_timeout_duration	query	string	Timeout duration for how long a host has time to complete processing. Default value is a bit less than the overall timeout value. It cannot be greater than the overall request timeout. Maximum is < 5 minutes. Example, `10s`. Valid units: `ns`, `us`, `ms`, `s`, `m`, `h`.
parameters	query	dictionary	Full query string parameters payload in JSON format.
queue_offline	body	boolean	Flag indicating if the command should be queued for execution when the host returns to service.
timeout	query	integer	Timeout for how long to wait for the request in seconds, default timeout is 30 seconds. Maximum is 5 minutes.
timeout_duration	query	string	Timeout duration for for how long to wait for the request in duration syntax. Example, `10s`. Valid units: `ns, us, ms, s, m, h`. Maximum is 5 minutes.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.batch_init_sessions(existing_batch_id="string",
                                      host_ids=id_list,
                                      host_timeout_duration="string",
                                      queue_offline=boolean,
                                      timeout="string",
                                      timeout_duration="string")
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.BatchInitSessions(existing_batch_id="string",
                                    host_ids=id_list,
                                    host_timeout_duration="string",
                                    queue_offline=boolean,
                                    timeout="string",
                                    timeout_duration="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "existing_batch_id": "string",
    "host_ids": ["string"],
    "queue_offline": boolean
}

response = falcon.command("BatchInitSessions",
                          timeout=integer,
                          timeout_duration="string",
                          host_timeout_duration="string",
                          body=body_payload)
print(response)

Start-FalconSession -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.RealTimeResponse.BatchInitSessions(
    &real_time_response.BatchInitSessionsParams{
      Timeout: integer,
      TimeoutDuration: "string",
      HostTimeoutDuration: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.batchInitSessions(
  {  // body
      existingBatchId: "string",
      hostIds: [],
      queueOffline: boolean
  },
  integer,  // timeout
  "string",  // timeoutDuration
  "string"  // hostTimeoutDuration
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::batch_init_sessions;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainBatchInitSessionRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DomainBatchInitSessionRequest {
        existing_batch_id: Some("string".to_string()),
        host_ids: vec!["string".to_string()],
        queue_offline: Some(boolean),
        ..Default::default()
    };

    let response = batch_init_sessions(
        &falcon.cfg,  // configuration
        body,  // body
        Some(integer),  // timeout
        Some("string"),  // timeout_duration
        Some("string"),  // host_timeout_duration
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

body = {
  existing_batch_id: 'string',
  host_ids: [],
  queue_offline: boolean
}

response = api.batch_init_sessions(body)

puts response

BatchRefreshSessions

Batch refresh a RTR session on multiple hosts. RTR sessions will expire after 5 minutes unless refreshed.

POST /real-time-response/combined/batch-refresh-session/v1

Scope Real Time Response: READ Consumes · Produces application/json

PEP 8 batch_refresh_sessions

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
batch_id	body	string	Existing RTR batch ID to refresh.
host_to_remove	body	string or list of strings	List of host agent IDs to remove from the batch.
parameters	query	dictionary	Full query string parameters payload in JSON format.
timeout	query	integer	Timeout for how long to wait for the request in seconds, default timeout is 30 seconds. Maximum is 5 minutes.
timeout_duration	query	string	Timeout duration for for how long to wait for the request in duration syntax. Example, `10s`. Valid units: `ns, us, ms, s, m, h`. Maximum is 5 minutes.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.batch_refresh_sessions(batch_id="string",
                                         hosts_to_remove="string",
                                         timeout="string",
                                         timeout_duration="string")
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.BatchRefreshSessions(batch_id="string",
                                       hosts_to_remove="string",
                                       timeout="string",
                                       timeout_duration="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "batch_id": "string",
    "hosts_to_remove": ["string"]
}

response = falcon.command("BatchRefreshSessions",
                          timeout=integer,
                          timeout_duration="string",
                          body=body_payload)
print(response)

Update-FalconSession -BatchId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.RealTimeResponse.BatchRefreshSessions(
    &real_time_response.BatchRefreshSessionsParams{
      Timeout: integer,
      TimeoutDuration: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.batchRefreshSessions(
  {  // body
      batchId: "string",
      hostsToRemove: []
  },
  integer,  // timeout
  "string"  // timeoutDuration
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::batch_refresh_sessions;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainBatchRefreshSessionRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DomainBatchRefreshSessionRequest {
        batch_id: Some("string".to_string()),
        hosts_to_remove: vec!["string".to_string()],
        ..Default::default()
    };

    let response = batch_refresh_sessions(
        &falcon.cfg,  // configuration
        body,  // body
        Some(integer),  // timeout
        Some("string"),  // timeout_duration
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

body = {
  batch_id: 'string',
  hosts_to_remove: []
}

response = api.batch_refresh_sessions(body)

puts response

RTR_CheckActiveResponderCommandStatus

Get status of an executed active-responder command on a single host.

GET /real-time-response/entities/active-responder-command/v1

Scope Real Time Response: WRITE Consumes · Produces application/json

PEP 8 check_active_responder_command_status

Parameters

Name	Type	Data type	Description
cloud_request_id	query	string	Cloud Request ID of the executed command to query.
parameters	query	dictionary	Full query string parameters payload in JSON format.
sequence_id	query	integer	Sequence ID that we want to retrieve. Command responses are chunked across sequences.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.check_active_responder_command_status(cloud_request_id="string",
                                                        sequence_id="string")
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.RTR_CheckActiveResponderCommandStatus(cloud_request_id="string",
                                                        sequence_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("RTR_CheckActiveResponderCommandStatus",
                          cloud_request_id="string",
                          sequence_id=integer)
print(response)

Confirm-FalconResponderCommand -CloudRequestId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.RealTimeResponse.RTRCheckActiveResponderCommandStatus(
    &real_time_response.RTRCheckActiveResponderCommandStatusParams{
      CloudRequestID: "string",
      SequenceID: integer,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.rTRCheckActiveResponderCommandStatus(
  "string",  // cloudRequestId
  integer  // sequenceId
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::r_tr_check_active_responder_command_status;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = r_tr_check_active_responder_command_status(
        &falcon.cfg,  // configuration
        "string",  // cloud_request_id
        integer,  // sequence_id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

response = api.r_tr_check_active_responder_command_status('string', integer)

puts response

RTR_ExecuteActiveResponderCommand

Execute an active responder command on a single host.

POST /real-time-response/entities/active-responder-command/v1

Scope Real Time Response: WRITE Consumes · Produces application/json

PEP 8 execute_active_responder_command

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
base_command	body	string	Active Responder base command to perform. For example: `get` or `cp`. Refer to the Available Commands table below for a complete listing of available commands.
command_string	body	string	Full command line of the command to execute. Example: `get some_file.txt`.
persist	body	boolean	Flag indicating if this command should be executed when the host returns to service. Unused
session_id	body	string	RTR Session ID.

Available Commands

Command	Description	Operating System
`cat`	View file contents	All
`cd`	Change directory	All
`clear`	Clear the screen	All
`cp`	Copy a file	All
`encrypt`	Encrypt a file	All
`env`	Display environment variables	All
`eventlog`	Inspect the event log. Subcommands: list, view, export, backup. `eventlog backup` is the recommended solution as opposed to `eventlog export`.	Windows
`filehash`	Calculate a file hash (MD5 or SHA256)	All
`get`	Retrieve a file	All
`getsid`	Retrieve the current SID	Windows, macOS
`help`	Access help for a specific command or sub-command	All
`history`	Review command history for the current user	All
`ipconfig`	Review TCP configuration	Windows
`kill`	Kill a running process	All
`ls`	List the contents of a directory	All
`map`	Map a UNC (SMB) path to a drive letter	Windows
`memdump`	Dump memory of a running process	Windows
`mkdir`	Create a directory	All
`mount`	Mount a file system (macOS, Linux) or list available drives (Windows)	All
`mv`	Move a file	All
`netstat`	Retrieve network connection detail	All
`ps`	List running processes	All
`reg`	Registry operations. Subcommands: query, set, delete, load, unload.	Windows
`restart`	Restart the system	All
`rm`	Remove a file	All
`runscript`	Run a script	All
`shutdown`	Shutdown the system	All
`unmap`	Unmap a UNC (SMB) path from a drive letter	Windows
`update`	Install patches through Windows Update. Subcommands: history, install, list, query.	Windows
`xmemdump`	Dump complete memory (kernel) for the system	Windows
`zip`	Create a zip archive	All

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.execute_active_responder_command(base_command="string",
                                                   command_string="string",
                                                   device_id="string",
                                                   id=integer,
                                                   persist=boolean,
                                                   session_id="string")
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.RTR_ExecuteActiveResponderCommand(base_command="string",
                                                    command_string="string",
                                                    device_id="string",
                                                    id=integer,
                                                    persist=boolean,
                                                    session_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "base_command": "string",
    "command_string": "string",
    "device_id": "string",
    "id": integer,
    "persist": boolean,
    "session_id": "string"
}

response = falcon.command("RTR_ExecuteActiveResponderCommand", body=body_payload)
print(response)

Invoke-FalconResponderCommand -Command "string" -SessionId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  base_command := "string"
  command_string := "string"
  device_id := "string"
  id := integer
  persist := boolean
  session_id := "string"

  response, err := client.RealTimeResponse.RTRExecuteActiveResponderCommand(
    &real_time_response.RTRExecuteActiveResponderCommandParams{
      Body: &models.DomainCommandExecuteRequest{
        BaseCommand: &base_command,
        CommandString: &command_string,
        DeviceID: &device_id,
        ID: &id,
        Persist: &persist,
        SessionID: &session_id,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.rTRExecuteActiveResponderCommand(
  {
    baseCommand: "string",
    commandString: "string",
    deviceId: "string",
    id: integer,
    persist: boolean,
    sessionId: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::r_tr_execute_active_responder_command;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainCommandExecuteRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DomainCommandExecuteRequest {
        base_command: Some("string".to_string()),
        command_string: Some("string".to_string()),
        device_id: Some("string".to_string()),
        id: Some(integer),
        persist: Some(boolean),
        session_id: Some("string".to_string()),
        ..Default::default()
    };

    let response = r_tr_execute_active_responder_command(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

body = {
  base_command: 'string',
  command_string: 'string',
  device_id: 'string',
  id: integer,
  persist: boolean,
  session_id: 'string'
}

response = api.r_tr_execute_active_responder_command(body)

puts response

RTR_CheckCommandStatus

Get status of an executed command on a single host.

GET /real-time-response/entities/command/v1

Scope Real Time Response: READ Consumes · Produces application/json

PEP 8 check_command_status

Parameters

Name	Type	Data type	Description
cloud_request_id	query	string	Cloud Request ID of the executed command to query.
parameters	query	dictionary	Full query string parameters payload in JSON format.
sequence_id	query	integer	Sequence ID that we want to retrieve. Command responses are chunked across sequences.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.check_command_status(cloud_request_id="string",
                                       sequence_id="string")
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.RTR_CheckCommandStatus(cloud_request_id="string",
                                         sequence_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("RTR_CheckCommandStatus",
                          cloud_request_id="string",
                          sequence_id=integer)
print(response)

Confirm-FalconCommand -CloudRequestId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.RealTimeResponse.RTRCheckCommandStatus(
    &real_time_response.RTRCheckCommandStatusParams{
      CloudRequestID: "string",
      SequenceID: integer,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.rTRCheckCommandStatus(
  "string",  // cloudRequestId
  integer  // sequenceId
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::r_tr_check_command_status;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = r_tr_check_command_status(
        &falcon.cfg,  // configuration
        "string",  // cloud_request_id
        integer,  // sequence_id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

response = api.r_tr_check_command_status('string', integer)

puts response

RTR_ExecuteCommand

Execute a command on a single host.

POST /real-time-response/entities/command/v1

Scope Real Time Response: READ Consumes · Produces application/json

PEP 8 execute_command

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
base_command	body	string	Read-only base command to perform. For example: `ls` or `ps`. Refer to the Available Commands table below for a complete listing of available commands.
command_string	body	string	Full command line of the command to execute. Example: `cat some_file.txt`.
persist	body	boolean	Flag indicating if this command should be executed when the host returns to service.
session_id	body	string	RTR Session ID to execute the command against.

Available Commands (Read only)

Command	Description	Operating System
`cat`	View file contents	All
`cd`	Change directory	All
`clear`	Clear the screen	All
`csrutil`	Get system integrity protection status	macOS
`env`	Display environment variables	All
`eventlog`	Inspect the event log. Subcommands: list, view.	Windows
`filehash`	Calculate a file hash (MD5 or SHA256)	All
`getsid`	Retrieve the current SID	Windows, macOS
`help`	Access help for a specific command or sub-command	All
`history`	Review command history for the current user	All
`ipconfig`	Review TCP configuration	Windows
`ls`	List the contents of a directory	All
`mount`	Mount a file system (macOS, Linux) or list available drives (Windows)	All
`netstat`	Retrieve network connection detail	All
`ps`	List running processes	All
`reg`	Registry operations. Subcommands: query.	Windows

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.execute_command(base_command="string",
                                  command_string="string",
                                  device_id="string",
                                  id=integer,
                                  persist=boolean,
                                  session_id="string")
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.RTR_ExecuteCommand(base_command="string",
                                     command_string="string",
                                     device_id="string",
                                     id=integer,
                                     persist=boolean,
                                     session_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "base_command": "string",
    "command_string": "string",
    "device_id": "string",
    "id": integer,
    "persist": boolean,
    "session_id": "string"
}

response = falcon.command("RTR_ExecuteCommand", body=body_payload)
print(response)

Invoke-FalconCommand -Command "string" -SessionId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  base_command := "string"
  command_string := "string"
  device_id := "string"
  id := integer
  persist := boolean
  session_id := "string"

  response, err := client.RealTimeResponse.RTRExecuteCommand(
    &real_time_response.RTRExecuteCommandParams{
      Body: &models.DomainCommandExecuteRequest{
        BaseCommand: &base_command,
        CommandString: &command_string,
        DeviceID: &device_id,
        ID: &id,
        Persist: &persist,
        SessionID: &session_id,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.rTRExecuteCommand(
  {
    baseCommand: "string",
    commandString: "string",
    deviceId: "string",
    id: integer,
    persist: boolean,
    sessionId: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::r_tr_execute_command;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainCommandExecuteRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DomainCommandExecuteRequest {
        base_command: Some("string".to_string()),
        command_string: Some("string".to_string()),
        device_id: Some("string".to_string()),
        id: Some(integer),
        persist: Some(boolean),
        session_id: Some("string".to_string()),
        ..Default::default()
    };

    let response = r_tr_execute_command(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

body = {
  base_command: 'string',
  command_string: 'string',
  device_id: 'string',
  id: integer,
  persist: boolean,
  session_id: 'string'
}

response = api.r_tr_execute_command(body)

puts response

RTR_GetExtractedFileContents

Get RTR extracted file contents for specified session and sha256.

GET /real-time-response/entities/extracted-file-contents/v1

Scope Real Time Response: WRITE Consumes · Produces application/x-7z-compressed

PEP 8 get_extracted_file_contents

Parameters

Name	Type	Data type	Description
parameters	query	dictionary	Full query string parameters payload in JSON format.
filename	query	string	Filename to use for the archive name and the file within the archive.
session_id	query	string	RTR Session ID.
sha256	query	string	Extracted SHA256.
stream	query	boolean	Enable streaming download of the returned file.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.get_extracted_file_contents(session_id="string",
                                              sha256="string",
                                              filename="string",
                                              stream=boolean)
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.RTR_GetExtractedFileContents(session_id="string",
                                               sha256="string",
                                               filename="string",
                                               stream=boolean)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("RTR_GetExtractedFileContents",
                          session_id="string",
                          sha256="string",
                          filename="string")
print(response)

Receive-FalconGetFile -Sha256 "string" -SessionId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filename := "string"

  response, err := client.RealTimeResponse.RTRGetExtractedFileContents(
    &real_time_response.RTRGetExtractedFileContentsParams{
      SessionID: "string",
      Sha256: "string",
      Filename: &filename,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.rTRGetExtractedFileContents(
  "string",  // sessionId
  "string",  // sha256
  "string"  // filename
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::r_tr_get_extracted_file_contents;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = r_tr_get_extracted_file_contents(
        &falcon.cfg,  // configuration
        "string",  // session_id
        "string",  // sha256
        Some("string"),  // filename
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

response = api.r_tr_get_extracted_file_contents('string', 'string')

puts response

RTR_ListFiles

Get a list of files for the specified RTR session.

GET /real-time-response/entities/file/v1

Scope Real Time Response: WRITE Consumes · Produces application/json

PEP 8 list_files

Parameters

Name	Type	Data type	Description
parameters	query	dictionary	Full query string parameters payload in JSON format.
session_id	query	string	RTR Session ID.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.list_files(session_id="string")
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.RTR_ListFiles(session_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("RTR_ListFiles",
                          session_id="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.RealTimeResponse.RTRListFiles(
    &real_time_response.RTRListFilesParams{
      SessionID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.rTRListFiles("string");  // sessionId

console.log(response);

use rusty_falcon::apis::real_time_response_api::r_tr_list_files;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = r_tr_list_files(
        &falcon.cfg,  // configuration
        "string",  // session_id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

response = api.r_tr_list_files('string')

puts response

RTR_ListFilesV2

Get a list of files for the specified RTR session.

GET /real-time-response/entities/file/v2

Scope Real Time Response: WRITE Consumes · Produces application/json

PEP 8 list_files_v2

Parameters

Name	Type	Data type	Description
parameters	query	dictionary	Full query string parameters payload in JSON format.
session_id	query	string	RTR Session ID.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.list_files_v2(session_id="string")
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.RTR_ListFilesV2(session_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("RTR_ListFilesV2",
                          session_id="string")
print(response)

Confirm-FalconGetFile -SessionId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.RealTimeResponse.RTRListFilesV2(
    &real_time_response.RTRListFilesV2Params{
      SessionID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.rTRListFilesV2("string");  // sessionId

console.log(response);

use rusty_falcon::apis::real_time_response_api::r_tr_list_files_v2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = r_tr_list_files_v2(
        &falcon.cfg,  // configuration
        "string",  // session_id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

response = api.r_tr_list_files_v2('string')

puts response

RTR_DeleteFile

Delete a RTR session file.

DELETE /real-time-response/entities/file/v1

Scope Real Time Response: WRITE Consumes · Produces application/json

PEP 8 delete_file

Parameters

Name	Type	Data type	Description
parameters	query	dictionary	Full query string parameters payload in JSON format.
ids	query	string	RTR Session file ID (SHA256).
session_id	query	string	RTR Session ID.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_file(ids=id_list, session_id="string")
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.RTR_DeleteFile(ids=id_list, session_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("RTR_DeleteFile",
                          ids="string",
                          session_id="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.RealTimeResponse.RTRDeleteFile(
    &real_time_response.RTRDeleteFileParams{
      Ids: "string",
      SessionID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.rTRDeleteFile(
  "string",  // ids
  "string"  // sessionId
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::r_tr_delete_file;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = r_tr_delete_file(
        &falcon.cfg,  // configuration
        "string",  // ids
        "string",  // session_id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

response = api.r_tr_delete_file('string', 'string')

puts response

RTR_DeleteFileV2

Delete a RTR session file.

DELETE /real-time-response/entities/file/v2

Scope Real Time Response: WRITE Consumes · Produces application/json

PEP 8 delete_file_v2

Parameters

Name	Type	Data type	Description
parameters	query	dictionary	Full query string parameters payload in JSON format.
ids	query	string	RTR Session file ID (SHA256).
session_id	query	string	RTR Session ID.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_file_v2(ids=id_list, session_id="string")
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.RTR_DeleteFileV2(ids=id_list, session_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.command("RTR_DeleteFileV2",
                          ids="string",
                          session_id="string")
print(response)

Remove-FalconGetFile -SessionId "string" -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.RealTimeResponse.RTRDeleteFileV2(
    &real_time_response.RTRDeleteFileV2Params{
      Ids: "string",
      SessionID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.rTRDeleteFileV2(
  "string",  // ids
  "string"  // sessionId
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::r_tr_delete_file_v2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = r_tr_delete_file_v2(
        &falcon.cfg,  // configuration
        "string",  // ids
        "string",  // session_id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

response = api.r_tr_delete_file_v2('string', 'string')

puts response

RTR_ListQueuedSessions

Get queued session metadata by session ID.

POST /real-time-response/entities/queued-sessions/GET/v1

Scope Real Time Response: READ Consumes · Produces application/json

PEP 8 list_queued_sessions

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
ids	body	string or list of strings	List of RTR sessions to retrieve. Will only return sessions created by the calling user.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.list_queued_sessions(ids=id_list)
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.RTR_ListQueuedSessions(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "ids": ["string"]
}

response = falcon.command("RTR_ListQueuedSessions", body=body_payload)
print(response)

Get-FalconQueue

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.RealTimeResponse.RTRListQueuedSessions(
    &real_time_response.RTRListQueuedSessionsParams{
      Body: &models.MsaIdsRequest{
        Ids: []string{"string"},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.rTRListQueuedSessions(
  {
    ids: []
}  // body
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::r_tr_list_queued_sessions;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::MsaIdsRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = MsaIdsRequest {
        ids: vec!["string".to_string()],
        ..Default::default()
    };

    let response = r_tr_list_queued_sessions(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

body = Falcon::MsaIdsRequest.new(
  ids: []
)

response = api.r_tr_list_queued_sessions(body)

puts response

RTR_DeleteQueuedSession

Delete a queued session command.

DELETE /real-time-response/entities/queued-sessions/command/v1

Scope Real Time Response: READ Consumes · Produces application/json

PEP 8 delete_queued_session

Parameters

Name	Type	Data type	Description
cloud_request_id	query	string	Cloud Request ID of the executed command to query.
parameters	query	dictionary	Full query string parameters payload in JSON format.
session_id	query	string	RTR Session ID.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.delete_queued_session(cloud_request_id="string",
                                        session_id="string")
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.RTR_DeleteQueuedSession(cloud_request_id="string",
                                          session_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("RTR_DeleteQueuedSession",
                          session_id="string",
                          cloud_request_id="string")
print(response)

Remove-FalconCommand -SessionId "string" -CloudRequestId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.RealTimeResponse.RTRDeleteQueuedSession(
    &real_time_response.RTRDeleteQueuedSessionParams{
      SessionID: "string",
      CloudRequestID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.rTRDeleteQueuedSession(
  "string",  // sessionId
  "string"  // cloudRequestId
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::r_tr_delete_queued_session;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = r_tr_delete_queued_session(
        &falcon.cfg,  // configuration
        "string",  // session_id
        "string",  // cloud_request_id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

response = api.r_tr_delete_queued_session('string', 'string')

puts response

RTR_PulseSession

Refresh a session timeout on a single host.

POST /real-time-response/entities/refresh-session/v1

Scope Real Time Response: READ Consumes · Produces application/json

PEP 8 pulse_session

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
device_id	body	string	The host agent ID to refresh the RTR session on. RTR will retrieve an existing session for the calling user on this host.
origin	body	string	Origin of the request.
queue_offline	body	boolean	Flag indicating if this should be queued to pulse after the host returns to service.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.pulse_session(device_id="string",
                                origin="string",
                                queue_offline=boolean)
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.RTR_PulseSession(device_id="string",
                                   origin="string",
                                   queue_offline=boolean)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "device_id": "string",
    "origin": "string",
    "queue_offline": boolean
}

response = falcon.command("RTR_PulseSession", body=body_payload)
print(response)

Update-FalconSession -HostId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  device_id := "string"
  origin := "string"
  queue_offline := boolean

  response, err := client.RealTimeResponse.RTRPulseSession(
    &real_time_response.RTRPulseSessionParams{
      Body: &models.DomainInitRequest{
        DeviceID: &device_id,
        Origin: &origin,
        QueueOffline: &queue_offline,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.rTRPulseSession(
  {
    deviceId: "string",
    origin: "string",
    queueOffline: boolean
}  // body
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::r_tr_pulse_session;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainInitRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DomainInitRequest {
        device_id: Some("string".to_string()),
        origin: Some("string".to_string()),
        queue_offline: Some(boolean),
        ..Default::default()
    };

    let response = r_tr_pulse_session(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

body = Falcon::DomainInitRequest.new(
  device_id: 'string',
  origin: 'string',
  queue_offline: boolean
)

response = api.r_tr_pulse_session(body)

puts response

RTR_ListSessions

Get session metadata by session id.

POST /real-time-response/entities/sessions/GET/v1

Scope Real Time Response: READ Consumes · Produces application/json

PEP 8 list_sessions

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
ids	body	string or list of strings	List of RTR sessions to retrieve. Will only return sessions created by the calling user.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.list_sessions(ids=id_list)
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.RTR_ListSessions(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

body_payload = {
    "ids": ["string"]
}

response = falcon.command("RTR_ListSessions", body=body_payload)
print(response)

Get-FalconSession -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.RealTimeResponse.RTRListSessions(
    &real_time_response.RTRListSessionsParams{
      Body: &models.MsaIdsRequest{
        Ids: []string{"string"},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.rTRListSessions(
  {
    ids: []
}  // body
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::r_tr_list_sessions;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::MsaIdsRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = MsaIdsRequest {
        ids: vec!["string".to_string()],
        ..Default::default()
    };

    let response = r_tr_list_sessions(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

body = Falcon::MsaIdsRequest.new(
  ids: []
)

response = api.r_tr_list_sessions(body)

puts response

RTR_InitSession

Initialize a new session with the RTR cloud.

POST /real-time-response/entities/sessions/v1

Scope Real Time Response: READ Consumes · Produces application/json

PEP 8 init_session

Parameters

Name	Type	Data type	Description
body	body	dictionary	Full body payload in JSON format.
device_id	body	string	The host agent ID to refresh the RTR session on. RTR will retrieve an existing session for the calling user on this host.
origin	body	string	Origin of the request.
queue_offline	body	boolean	Flag indicating if this should be queued to pulse after the host returns to service.
timeout	body	integer	Timeout for how long to wait for the request in seconds. Default: 30 Maximum: 600
timeout_duration	body	string	Timeout duration for how long to wait for the request in duration syntax. Example: 10s Valid units: `ns`, `us`, `ms`, `s`, `m`, `h` Maximum timeout is 5 minutes.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.init_session(device_id="string",
                               origin="string",
                               queue_offline=boolean,
                               timeout=integer,
                               timeout_duration="string")
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.RTR_InitSession(device_id="string",
                                  origin="string",
                                  queue_offline=boolean,
                                  timeout=integer,
                                  timeout_duration="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "device_id": "string",
    "origin": "string",
    "queue_offline": boolean
}

response = falcon.command("RTR_InitSession",
                          timeout=integer,
                          timeout_duration="string",
                          body=body_payload)
print(response)

Start-FalconSession -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.RealTimeResponse.RTRInitSession(
    &real_time_response.RTRInitSessionParams{
      Timeout: integer,
      TimeoutDuration: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.rTRInitSession(
  {  // body
      deviceId: "string",
      origin: "string",
      queueOffline: boolean
  },
  integer,  // timeout
  "string"  // timeoutDuration
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::r_tr_init_session;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainInitRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DomainInitRequest {
        device_id: Some("string".to_string()),
        origin: Some("string".to_string()),
        queue_offline: Some(boolean),
        ..Default::default()
    };

    let response = r_tr_init_session(
        &falcon.cfg,  // configuration
        body,  // body
        Some(integer),  // timeout
        Some("string"),  // timeout_duration
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

body = {
  device_id: 'string',
  origin: 'string',
  queue_offline: boolean
}

response = api.r_tr_init_session(body)

puts response

RTR_DeleteSession

Delete a session.

DELETE /real-time-response/entities/sessions/v1

Scope Real Time Response: READ Consumes · Produces application/json

PEP 8 delete_session

Parameters

Name	Type	Data type	Description
parameters	query	dictionary	Full query string parameters payload in JSON format.
session_id	query	string	RTR Session ID.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.delete_session(session_id="string")
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.RTR_DeleteSession(session_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("RTR_DeleteSession",
                          session_id="string")
print(response)

Remove-FalconSession -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.RealTimeResponse.RTRDeleteSession(
    &real_time_response.RTRDeleteSessionParams{
      SessionID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.rTRDeleteSession("string");  // sessionId

console.log(response);

use rusty_falcon::apis::real_time_response_api::r_tr_delete_session;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = r_tr_delete_session(
        &falcon.cfg,  // configuration
        "string",  // session_id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

response = api.r_tr_delete_session('string')

puts response

RTR_ListAllSessions

Get a list of session_ids.

You will only be able to retrieve sessions that were created using the same API credentials.

GET /real-time-response/queries/sessions/v1

Scope Real Time Response: READ Consumes · Produces application/json

PEP 8 list_all_sessions

Parameters

Name	Type	Data type	Description
filter	query	string	FQL query expression that should be used to limit the results. Available filters: `id`, `created_at`, `updated_at`, `deleted_at`, `aid`, `hostname`, `user_id`, `origin`, `cloud_request_id`, `command_string`, `base_command`, `offline_queued`, `commands_queued`. `user_id` can accept a special value ‘@me’ which will restrict results to records with current user’s ID.
limit	query	integer	Maximum number of records to return. Max: 5000.
offset	query	string	Starting index of overall result set from which to return ids.
sort	query	string	The property to sort by.
parameters	query	dictionary	Full query string parameters payload in JSON format.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.list_all_sessions(filter="string",
                                    limit=integer,
                                    offset=integer,
                                    sort="string")
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.RTR_ListAllSessions(filter="string",
                                      limit=integer,
                                      offset=integer,
                                      sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("RTR_ListAllSessions",
                          offset="string",
                          limit=integer,
                          sort="string",
                          filter="string")
print(response)

Get-FalconSession -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := "string"
  limit := int64(0)
  sort := "string"
  filter := "string"

  response, err := client.RealTimeResponse.RTRListAllSessions(
    &real_time_response.RTRListAllSessionsParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: process.env.FALCON_CLOUD!,
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.rTRListAllSessions(
  "string",  // offset
  integer,  // limit
  "string",  // sort
  "string"  // filter
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::r_tr_list_all_sessions;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = r_tr_list_all_sessions(
        &falcon.cfg,  // configuration
        Some("string"),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

response = api.r_tr_list_all_sessions(offset: 'string',
                                      limit: integer,
                                      sort: 'string',
                                      filter: 'string')

puts response

Real Time Response

Table of Contents

RTR_AggregateSessions

Parameters

Code Examples

BatchActiveResponderCmd

Parameters

Available Commands

Code Examples

BatchCmd

Parameters

Available Commands (Read only)

Code Examples

BatchGetCmdStatus

Parameters

Code Examples

BatchGetCmd

Parameters

Code Examples

BatchInitSessions

Parameters

Code Examples

BatchRefreshSessions

Parameters

Code Examples

RTR_CheckActiveResponderCommandStatus

Parameters

Code Examples

RTR_ExecuteActiveResponderCommand

Parameters

Available Commands

Code Examples

RTR_CheckCommandStatus

Parameters

Code Examples

RTR_ExecuteCommand

Parameters

Available Commands (Read only)

Code Examples

RTR_GetExtractedFileContents

Parameters

Code Examples

RTR_ListFiles

Parameters

Code Examples

RTR_ListFilesV2

Parameters

Code Examples

RTR_DeleteFile

Parameters

Code Examples

RTR_DeleteFileV2

Parameters

Code Examples

RTR_ListQueuedSessions

Parameters

Code Examples

RTR_DeleteQueuedSession

Parameters

Code Examples

RTR_PulseSession

Parameters

Code Examples

RTR_ListSessions

Parameters

Code Examples

RTR_InitSession

Parameters

Code Examples

RTR_DeleteSession

Parameters

Code Examples

RTR_ListAllSessions

Parameters

Code Examples