Real Time Response

The Real Time Response service collection provides operations for managing and executing real-time response sessions on CrowdStrike Falcon-protected hosts. Initialize single or batch RTR sessions, execute read-only and active-responder commands, retrieve command status, manage session files, handle queued sessions, and query session IDs.

Language	Last Update
Python	v1.6.6
PowerShell	v2.2.9
Go	v0.22.0
TypeScript	v0.7.0
Rust	v0.7.1
Ruby	v1.4.0

This service collection has code examples posted to the repository.

Operation	Description
BatchActiveResponderCmd `batch_active_responder_command`	Batch executes a RTR active-responder command across the hosts mapped to the given batch ID.
BatchCmd `batch_command`	Batch executes a RTR read-only command across the hosts mapped to the given batch ID.
BatchGetCmd `batch_get_command`	Batch executes `get` command across hosts to retrieve files.
BatchGetCmdStatus `batch_get_command_status`	Retrieves the status of the specified batch get command.
BatchInitSessions `batch_init_sessions`	Batch initialize a RTR session on multiple hosts.
BatchRefreshSessions `batch_refresh_sessions`	Batch refresh a RTR session on multiple hosts.
RTR-AggregateSessions `aggregate_sessions`	Get aggregates on session data.
RTR-CheckActiveResponderCommandStatus `check_active_responder_command_status`	Get status of an executed active-responder command on a single host.
RTR-CheckCommandStatus `check_command_status`	Get status of an executed command on a single host.
RTR-DeleteFile `delete_file`	Delete a RTR session file.
RTR-DeleteFileV2 `delete_file_v2`	Delete a RTR session file.
RTR-DeleteQueuedSession `delete_queued_session`	Delete a queued session command
RTR-DeleteSession `delete_session`	Delete a session.
RTR-ExecuteActiveResponderCommand `execute_active_responder_command`	Execute an active responder command on a single host.
RTR-ExecuteCommand `execute_command`	Execute a command on a single host.
RTR-GetExtractedFileContents `get_extracted_file_contents`	Get RTR extracted file contents for specified session and sha256.
RTR-InitSession `init_session`	Initialize a new session with the RTR cloud.
RTR-ListAllSessions `list_all_sessions`	Get a list of session_ids.
RTR-ListFiles `list_files`	Get a list of files for the specified RTR session.
RTR-ListFilesV2 `list_files_v2`	Get a list of files for the specified RTR session.
RTR-ListQueuedSessions `list_queued_sessions`	Get queued session metadata by session ID.
RTR-ListSessions `list_sessions`	Get session metadata by session id.
RTR-PulseSession `pulse_session`	Refresh a session timeout on a single host.

BatchActiveResponderCmd

Batch executes a RTR active-responder command across the hosts mapped to the given batch ID.

Method POST

Route /real-time-response/combined/batch-active-responder-command/v1

Scope Real time response: WRITE

PEP 8 batch_active_responder_command

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

base_command body · string

Active-Responder command type we are going to execute, for example: get or cp. Refer to the RTR documentation for the full list of commands.

batch_id body · string

Batch ID to execute the command on. Received from batch_init_session.

command_string body · string

Full command string for the command. For example get some_file.txt.

optional_hosts body · array

List of a subset of hosts we want to run the command on. If this list is supplied, only these hosts will receive the command.

persist_all body · boolean

timeout query · integer

Timeout for how long to wait for the request in seconds, default timeout is 30 seconds. Maximum is 5 minutes.

timeout_duration query · string

Timeout duration for how long to wait for the request in duration syntax. Example, 10s. Valid units: ns, us, ms, s, m, h. Maximum is 5 minutes.

host_timeout_duration query · string

Timeout duration for how long a host has time to complete processing. Default value is a bit less than the overall timeout value. It cannot be greater than the overall request timeout. Maximum is < 5 minutes. Example, 10s. Valid units: ns, us, ms, s, m, h.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.batch_active_responder_command(base_command="string",
                                                 batch_id="string",
                                                 command_string="string",
                                                 host_timeout_duration="string",
                                                 optional_hosts=id_list,
                                                 persist_all=boolean,
                                                 timeout=integer,
                                                 timeout_duration="string")
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.BatchActiveResponderCmd(base_command="string",
                                          batch_id="string",
                                          command_string="string",
                                          host_timeout_duration="string",
                                          optional_hosts=id_list,
                                          persist_all=boolean,
                                          timeout=integer,
                                          timeout_duration="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "base_command": "string",
    "batch_id": "string",
    "command_string": "string",
    "optional_hosts": ["string"],
    "persist_all": boolean
}

response = falcon.command("BatchActiveResponderCmd",
                          timeout=integer,
                          timeout_duration="string",
                          host_timeout_duration="string",
                          body=body_payload)
print(response)

Invoke-FalconResponderCommand -Command "string" -BatchId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  timeout := int64(0)
  timeoutDuration := "string"
  hostTimeoutDuration := "string"
  baseCommand := "string"
  batchID := "string"
  commandString := "string"
  persistAll := boolean

  response, err := client.RealTimeResponse.BatchActiveResponderCmd(
    &real_time_response.BatchActiveResponderCmdParams{
      Body: &models.DomainBatchExecuteCommandRequest{
        BaseCommand: &baseCommand,
        BatchID: &batchID,
        CommandString: &commandString,
        OptionalHosts: []string{"string"},
        PersistAll: &persistAll,
      },
      Timeout: &timeout,
      TimeoutDuration: &timeoutDuration,
      HostTimeoutDuration: &hostTimeoutDuration,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.batchActiveResponderCmd(
  {  // body
      baseCommand: "string",
      batchId: "string",
      commandString: "string",
      optionalHosts: [],
      persistAll: boolean
  },
  integer,  // timeout
  "string",  // timeoutDuration
  "string"  // hostTimeoutDuration
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::batch_active_responder_cmd;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainBatchExecuteCommandRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DomainBatchExecuteCommandRequest {
        base_command: "string".to_string(),
        batch_id: "string".to_string(),
        command_string: "string".to_string(),
        optional_hosts: vec!["string".to_string()],
        persist_all: boolean,
        ..Default::default()
    };

    let response = batch_active_responder_cmd(
        &falcon.cfg,  // configuration
        body,  // body
        Some(integer),  // timeout
        Some("string"),  // timeout_duration
        Some("string"),  // host_timeout_duration
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

body = Falcon::DomainBatchExecuteCommandRequest.new(
  base_command: 'string',
  batch_id: 'string',
  command_string: 'string',
  optional_hosts: [],
  persist_all: boolean
)

response = api.batch_active_responder_cmd(body)

puts response

Responses

{
  "combined": {
    "resources": {}
  },
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

BatchCmd

Batch executes a RTR read-only command across the hosts mapped to the given batch ID.

Method POST

Route /real-time-response/combined/batch-command/v1

Scope Real time response: READ

PEP 8 batch_command

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

base_command body · string

Active-Responder command type we are going to execute, for example: get or cp. Refer to the RTR documentation for the full list of commands.

batch_id body · string

Batch ID to execute the command on. Received from batch_init_session.

command_string body · string

Full command string for the command. For example get some_file.txt.

optional_hosts body · array

List of a subset of hosts we want to run the command on. If this list is supplied, only these hosts will receive the command.

persist_all body · boolean

timeout query · integer

Timeout for how long to wait for the request in seconds, default timeout is 30 seconds. Maximum is 5 minutes.

timeout_duration query · string

Timeout duration for how long to wait for the request in duration syntax. Example, 10s. Valid units: ns, us, ms, s, m, h. Maximum is 5 minutes.

host_timeout_duration query · string

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.batch_command(base_command="string",
                                batch_id="string",
                                command_string="string",
                                host_timeout_duration="string",
                                optional_hosts=id_list,
                                persist_all=boolean,
                                timeout=integer,
                                timeout_duration="string")
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.BatchCmd(base_command="string",
                           batch_id="string",
                           command_string="string",
                           host_timeout_duration="string",
                           optional_hosts=id_list,
                           persist_all=boolean,
                           timeout=integer,
                           timeout_duration="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "base_command": "string",
    "batch_id": "string",
    "command_string": "string",
    "optional_hosts": ["string"],
    "persist_all": boolean
}

response = falcon.command("BatchCmd",
                          timeout=integer,
                          timeout_duration="string",
                          host_timeout_duration="string",
                          body=body_payload)
print(response)

Invoke-FalconCommand -Command "string" -BatchId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  timeout := int64(0)
  timeoutDuration := "string"
  hostTimeoutDuration := "string"
  baseCommand := "string"
  batchID := "string"
  commandString := "string"
  persistAll := boolean

  response, err := client.RealTimeResponse.BatchCmd(
    &real_time_response.BatchCmdParams{
      Body: &models.DomainBatchExecuteCommandRequest{
        BaseCommand: &baseCommand,
        BatchID: &batchID,
        CommandString: &commandString,
        OptionalHosts: []string{"string"},
        PersistAll: &persistAll,
      },
      Timeout: &timeout,
      TimeoutDuration: &timeoutDuration,
      HostTimeoutDuration: &hostTimeoutDuration,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.batchCmd(
  {  // body
      baseCommand: "string",
      batchId: "string",
      commandString: "string",
      optionalHosts: [],
      persistAll: boolean
  },
  integer,  // timeout
  "string",  // timeoutDuration
  "string"  // hostTimeoutDuration
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::batch_cmd;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainBatchExecuteCommandRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DomainBatchExecuteCommandRequest {
        base_command: "string".to_string(),
        batch_id: "string".to_string(),
        command_string: "string".to_string(),
        optional_hosts: vec!["string".to_string()],
        persist_all: boolean,
        ..Default::default()
    };

    let response = batch_cmd(
        &falcon.cfg,  // configuration
        body,  // body
        Some(integer),  // timeout
        Some("string"),  // timeout_duration
        Some("string"),  // host_timeout_duration
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

body = Falcon::DomainBatchExecuteCommandRequest.new(
  base_command: 'string',
  batch_id: 'string',
  command_string: 'string',
  optional_hosts: [],
  persist_all: boolean
)

response = api.batch_cmd(body)

puts response

Responses

{
  "combined": {
    "resources": {}
  },
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

BatchGetCmd

Batch executes get command across hosts to retrieve files.

Method POST

Route /real-time-response/combined/batch-get-command/v1

Scope Real time response: WRITE

PEP 8 batch_get_command

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

batch_id body · string

Batch ID to execute the command on. Received from batch_init_session.

file_path body · string

Full path to the file that is to be retrieved from each host in the batch.

optional_hosts body · array

List of a subset of hosts we want to run the command on. If this list is supplied, only these hosts will receive the command.

timeout query · integer

Timeout for how long to wait for the request in seconds, default timeout is 30 seconds. Maximum is 5 minutes.

timeout_duration query · string

Timeout duration for how long to wait for the request in duration syntax. Example, 10s. Valid units: ns, us, ms, s, m, h. Maximum is 5 minutes.

host_timeout_duration query · string

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.batch_get_command(batch_id="string",
                                    file_path="string",
                                    host_timeout_duration="string",
                                    optional_hosts=id_list,
                                    timeout=integer,
                                    timeout_duration="string")
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.BatchGetCmd(batch_id="string",
                              file_path="string",
                              host_timeout_duration="string",
                              optional_hosts=id_list,
                              timeout=integer,
                              timeout_duration="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "batch_id": "string",
    "file_path": "string",
    "optional_hosts": ["string"]
}

response = falcon.command("BatchGetCmd",
                          timeout=integer,
                          timeout_duration="string",
                          host_timeout_duration="string",
                          body=body_payload)
print(response)

Invoke-FalconBatchGet -FilePath "string" -BatchId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  timeout := int64(0)
  timeoutDuration := "string"
  hostTimeoutDuration := "string"
  batchID := "string"
  filePath := "string"

  response, err := client.RealTimeResponse.BatchGetCmd(
    &real_time_response.BatchGetCmdParams{
      Body: &models.DomainBatchGetCommandRequest{
        BatchID: &batchID,
        FilePath: &filePath,
        OptionalHosts: []string{"string"},
      },
      Timeout: &timeout,
      TimeoutDuration: &timeoutDuration,
      HostTimeoutDuration: &hostTimeoutDuration,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.batchGetCmd(
  {  // body
      batchId: "string",
      filePath: "string",
      optionalHosts: []
  },
  integer,  // timeout
  "string",  // timeoutDuration
  "string"  // hostTimeoutDuration
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::batch_get_cmd;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainBatchGetCommandRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DomainBatchGetCommandRequest {
        batch_id: "string".to_string(),
        file_path: "string".to_string(),
        optional_hosts: vec!["string".to_string()],
        ..Default::default()
    };

    let response = batch_get_cmd(
        &falcon.cfg,  // configuration
        body,  // body
        Some(integer),  // timeout
        Some("string"),  // timeout_duration
        Some("string"),  // host_timeout_duration
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

body = Falcon::DomainBatchGetCommandRequest.new(
  batch_id: 'string',
  file_path: 'string',
  optional_hosts: []
)

response = api.batch_get_cmd(body)

puts response

Responses

{
  "batch_get_cmd_req_id": "string",
  "combined": {
    "resources": {}
  },
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

BatchGetCmdStatus

Retrieves the status of the specified batch get command.

Method GET

Route /real-time-response/combined/batch-get-command/v1

Scope Real time response: WRITE

PEP 8 batch_get_command_status

Parameters

timeout query · integer

Timeout for how long to wait for the request in seconds, default timeout is 30 seconds. Maximum is 5 minutes.

timeout_duration query · string

Timeout duration for how long to wait for the request in duration syntax. Example, 10s. Valid units: ns, us, ms, s, m, h. Maximum is 5 minutes.

batch_get_cmd_req_id query · string

Batch Get Command Request ID received from /real-time-response/combined/get-command/v1

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.batch_get_command_status(timeout=integer,
                                           timeout_duration="string",
                                           batch_get_cmd_req_id="string")
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.BatchGetCmdStatus(timeout=integer,
                                    timeout_duration="string",
                                    batch_get_cmd_req_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("BatchGetCmdStatus",
                          timeout=integer,
                          timeout_duration="string",
                          batch_get_cmd_req_id="string")
print(response)

Confirm-FalconGetFile -BatchGetCmdReqId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  timeout := int64(0)
  timeoutDuration := "string"

  response, err := client.RealTimeResponse.BatchGetCmdStatus(
    &real_time_response.BatchGetCmdStatusParams{
      Timeout: &timeout,
      TimeoutDuration: &timeoutDuration,
      BatchGetCmdReqID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.batchGetCmdStatus(
  "string",  // batchGetCmdReqId
  integer,  // timeout
  "string"  // timeoutDuration
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::batch_get_cmd_status;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = batch_get_cmd_status(
        &falcon.cfg,  // configuration
        "string",  // batch_get_cmd_req_id
        Some(integer),  // timeout
        Some("string"),  // timeout_duration
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

response = api.batch_get_cmd_status('string')

puts response

Responses

{}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

BatchInitSessions

Batch initialize a RTR session on multiple hosts.

Method POST

Route /real-time-response/combined/batch-init-session/v1

Scope Real time response: READ

PEP 8 batch_init_sessions

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

existing_batch_id body · string

Optional batch ID. Use an existing batch ID if you want to initialize new hosts and add them to the existing batch.

host_ids body · array

List of host agent ID’s to initialize a RTR session on.

queue_offline body · boolean

Boolean indicating if the command should be queued for execution when the host returns online.

timeout query · integer

Timeout for how long to wait for the request in seconds, default timeout is 30 seconds. Maximum is 5 minutes.

timeout_duration query · string

Timeout duration for how long to wait for the request in duration syntax. Example, 10s. Valid units: ns, us, ms, s, m, h. Maximum is 5 minutes.

host_timeout_duration query · string

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.batch_init_sessions(existing_batch_id="string",
                                      host_ids=id_list,
                                      host_timeout_duration="string",
                                      queue_offline=boolean,
                                      timeout=integer,
                                      timeout_duration="string")
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.BatchInitSessions(existing_batch_id="string",
                                    host_ids=id_list,
                                    host_timeout_duration="string",
                                    queue_offline=boolean,
                                    timeout=integer,
                                    timeout_duration="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "existing_batch_id": "string",
    "host_ids": ["string"],
    "queue_offline": boolean
}

response = falcon.command("BatchInitSessions",
                          timeout=integer,
                          timeout_duration="string",
                          host_timeout_duration="string",
                          body=body_payload)
print(response)

Start-FalconSession -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  timeout := int64(0)
  timeoutDuration := "string"
  hostTimeoutDuration := "string"
  existingBatchID := "string"
  queueOffline := boolean

  response, err := client.RealTimeResponse.BatchInitSessions(
    &real_time_response.BatchInitSessionsParams{
      Body: &models.DomainBatchInitSessionRequest{
        ExistingBatchID: &existingBatchID,
        HostIds: []string{"string"},
        QueueOffline: &queueOffline,
      },
      Timeout: &timeout,
      TimeoutDuration: &timeoutDuration,
      HostTimeoutDuration: &hostTimeoutDuration,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.batchInitSessions(
  {  // body
      existingBatchId: "string",
      hostIds: [],
      queueOffline: boolean
  },
  integer,  // timeout
  "string",  // timeoutDuration
  "string"  // hostTimeoutDuration
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::batch_init_sessions;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainBatchInitSessionRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DomainBatchInitSessionRequest {
        existing_batch_id: "string".to_string(),
        host_ids: vec!["string".to_string()],
        queue_offline: boolean,
        ..Default::default()
    };

    let response = batch_init_sessions(
        &falcon.cfg,  // configuration
        body,  // body
        Some(integer),  // timeout
        Some("string"),  // timeout_duration
        Some("string"),  // host_timeout_duration
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

body = Falcon::DomainBatchInitSessionRequest.new(
  existing_batch_id: 'string',
  host_ids: [],
  queue_offline: boolean
)

response = api.batch_init_sessions(body)

puts response

Responses

{}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

BatchRefreshSessions

Batch refresh a RTR session on multiple hosts.

Method POST

Route /real-time-response/combined/batch-refresh-session/v1

Scope Real time response: READ

PEP 8 batch_refresh_sessions

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

batch_id body · string

Batch ID to execute the command on. Received from batch_init_session.

hosts_to_remove body · array

Hosts to remove from the batch session. Heartbeats will no longer happen on these hosts and the sessions will expire.

timeout query · integer

Timeout for how long to wait for the request in seconds, default timeout is 30 seconds. Maximum is 5 minutes.

timeout_duration query · string

Timeout duration for how long to wait for the request in duration syntax. Example, 10s. Valid units: ns, us, ms, s, m, h. Maximum is 5 minutes.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.batch_refresh_sessions(batch_id="string",
                                         hosts_to_remove=id_list,
                                         timeout=integer,
                                         timeout_duration="string")
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.BatchRefreshSessions(batch_id="string",
                                       hosts_to_remove=id_list,
                                       timeout=integer,
                                       timeout_duration="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "batch_id": "string",
    "hosts_to_remove": ["string"]
}

response = falcon.command("BatchRefreshSessions",
                          timeout=integer,
                          timeout_duration="string",
                          body=body_payload)
print(response)

Update-FalconSession -BatchId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  timeout := int64(0)
  timeoutDuration := "string"
  batchID := "string"

  response, err := client.RealTimeResponse.BatchRefreshSessions(
    &real_time_response.BatchRefreshSessionsParams{
      Body: &models.DomainBatchRefreshSessionRequest{
        BatchID: &batchID,
        HostsToRemove: []string{"string"},
      },
      Timeout: &timeout,
      TimeoutDuration: &timeoutDuration,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.batchRefreshSessions(
  {  // body
      batchId: "string",
      hostsToRemove: []
  },
  integer,  // timeout
  "string"  // timeoutDuration
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::batch_refresh_sessions;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainBatchRefreshSessionRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DomainBatchRefreshSessionRequest {
        batch_id: "string".to_string(),
        hosts_to_remove: vec!["string".to_string()],
        ..Default::default()
    };

    let response = batch_refresh_sessions(
        &falcon.cfg,  // configuration
        body,  // body
        Some(integer),  // timeout
        Some("string"),  // timeout_duration
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

body = Falcon::DomainBatchRefreshSessionRequest.new(
  batch_id: 'string',
  hosts_to_remove: []
)

response = api.batch_refresh_sessions(body)

puts response

Responses

{}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

RTR-AggregateSessions

Get aggregates on session data.

Method POST

Route /real-time-response/aggregates/sessions/GET/v1

Scope Real time response: READ

PEP 8 aggregate_sessions

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

date_ranges body · array

If peforming a date range query specify the from and to date ranges. These can be in common date formats like 2019-07-18 or now.

exclude body · string

Fields to exclude.

extended_bounds body · object

field body · string

Term you want to aggregate on. If doing a date_range query, this is the date field you want to apply the date ranges to.

filter body · string

Optional filter criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon.

filters_spec body · object

from body · integer

include body · string

Fields to include.

interval body · string

Available values (6)

`year`	`month`	`week`
`day`	`hour`	`minute`

max_doc_count body · integer

Maximum number of documents.

min_doc_count body · integer

Minimum number of documents.

missing body · string

name body · string

Scan name.

percents body · array

q body · string

FQL syntax.

ranges body · array

size body · integer

sort body · string

FQL syntax.

Available values (2)

sub_aggregates body · array

time_zone body · string

type body · string

String. This method does not support body payload validation.

Available values (10)

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]

ranges = [
    {
        "From": 0,
        "To": 0
    }
]

response = falcon.aggregate_sessions(date_ranges=date_ranges,
                                     exclude="string",
                                     field="string",
                                     filter="string",
                                     from=integer,
                                     include="string",
                                     interval="string",
                                     max_doc_count=integer,
                                     min_doc_count=integer,
                                     missing="string",
                                     name="string",
                                     q="string",
                                     ranges=ranges,
                                     size=integer,
                                     sort="string",
                                     sub_aggregates=["string"],
                                     time_zone="string",
                                     type="string")
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

date_ranges = [
    {
        "from": "string",
        "to": "string"
    }
]

ranges = [
    {
        "From": 0,
        "To": 0
    }
]

response = falcon.RTR_AggregateSessions(date_ranges=date_ranges,
                                        exclude="string",
                                        field="string",
                                        filter="string",
                                        from=integer,
                                        include="string",
                                        interval="string",
                                        max_doc_count=integer,
                                        min_doc_count=integer,
                                        missing="string",
                                        name="string",
                                        q="string",
                                        ranges=ranges,
                                        size=integer,
                                        sort="string",
                                        sub_aggregates=["string"],
                                        time_zone="string",
                                        type="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = [
    {
        "date_ranges": [
            {
                "from": "string",
                "to": "string"
            }
        ],
        "exclude": "string",
        "extended_bounds": {
            "max": "string",
            "min": "string"
        },
        "field": "string",
        "filter": "string",
        "filters_spec": {
            "filters": {},
            "other_bucket": boolean,
            "other_bucket_key": "string"
        },
        "from": integer,
        "include": "string",
        "interval": "string",
        "max_doc_count": integer,
        "min_doc_count": integer,
        "missing": "string",
        "name": "string",
        "percents": ["string"],
        "q": "string",
        "ranges": [
            {
                "from": integer,
                "to": integer
            }
        ],
        "size": integer,
        "sort": "string",
        "sub_aggregates": [
            {
                "date_ranges": ["string"],
                "exclude": "string",
                "extended_bounds": {},
                "field": "string",
                "filter": "string",
                "filters_spec": {},
                "from": integer,
                "include": "string",
                "interval": "string",
                "max_doc_count": integer,
                "min_doc_count": integer,
                "missing": "string",
                "name": "string",
                "percents": ["string"],
                "q": "string",
                "ranges": ["string"],
                "size": integer,
                "sort": "string",
                "sub_aggregates": ["string"],
                "time_zone": "string",
                "type": "string"
            }
        ],
        "time_zone": "string",
        "type": "string"
    }
]

response = falcon.command("RTR_AggregateSessions", body=body_payload)
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  from := "string"
  to := "string"
  exclude := "string"
  max := "string"
  min := "string"
  field := "string"
  filter := "string"
  otherBucket := boolean
  otherBucketKey := "string"
  from2 := int32(0)
  include := "string"
  interval := "string"
  missing := "string"
  name := "string"
  q := "string"
  from3 := float64(0)
  to2 := float64(0)
  size := int32(0)
  sort := "string"
  exclude2 := "string"
  field2 := "string"
  filter2 := "string"
  from4 := int32(0)
  include2 := "string"
  interval2 := "string"
  missing2 := "string"
  name2 := "string"
  q2 := "string"
  size2 := int32(0)
  sort2 := "string"
  timeZone := "string"
  typeVar := "string"
  timeZone2 := "string"
  typeVar2 := "string"

  response, err := client.RealTimeResponse.RTRAggregateSessions(
    &real_time_response.RTRAggregateSessionsParams{
      Body: []*models.MsaAggregateQueryRequest{
        {
          DateRanges: []*models.MsaDateRangeSpec{
            {
              From: &from,
              To: &to,
            },
          },
          Exclude: &exclude,
          ExtendedBounds: &models.MsaExtendedBoundsSpec{
            Max: &max,
            Min: &min,
          },
          Field: &field,
          Filter: &filter,
          FiltersSpec: &models.MsaAPIFiltersSpec{
            Filters: map[string]string{},
            OtherBucket: &otherBucket,
            OtherBucketKey: &otherBucketKey,
          },
          From: &from2,
          Include: &include,
          Interval: &interval,
          MaxDocCount: integer,
          MinDocCount: integer,
          Missing: &missing,
          Name: &name,
          Percents: []float64{integer},
          Q: &q,
          Ranges: []*models.MsaRangeSpec{
            {
              From: &from3,
              To: &to2,
            },
          },
          Size: &size,
          Sort: &sort,
          SubAggregates: []*models.MsaAggregateQueryRequest{
            {
              DateRanges: []*models.MsaDateRangeSpec{},
              Exclude: &exclude2,
              ExtendedBounds: &models.MsaExtendedBoundsSpec{},
              Field: &field2,
              Filter: &filter2,
              FiltersSpec: &models.MsaAPIFiltersSpec{},
              From: &from4,
              Include: &include2,
              Interval: &interval2,
              MaxDocCount: integer,
              MinDocCount: integer,
              Missing: &missing2,
              Name: &name2,
              Percents: []float64{integer},
              Q: &q2,
              Ranges: []*models.MsaRangeSpec{},
              Size: &size2,
              Sort: &sort2,
              SubAggregates: []*models.MsaAggregateQueryRequest{},
              TimeZone: &timeZone,
              Type: &typeVar,
            },
          },
          TimeZone: &timeZone2,
          Type: &typeVar2,
        },
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.rTRAggregateSessions(
  [{
    dateRanges: [{
        from: "string",
        to: "string"
      }],
    exclude: "string",
    extendedBounds: {
      max: "string",
      min: "string"
    },
    field: "string",
    filter: "string",
    filtersSpec: {
      filters: {},
      otherBucket: boolean,
      otherBucketKey: "string"
    },
    from: integer,
    include: "string",
    interval: "string",
    maxDocCount: integer,
    minDocCount: integer,
    missing: "string",
    name: "string",
    percents: [],
    q: "string",
    ranges: [{
        from: integer,
        to: integer
      }],
    size: integer,
    sort: "string",
    subAggregates: [{
        dateRanges: [{
            from: "string",
            to: "string"
          }],
        exclude: "string",
        extendedBounds: {
          max: "string",
          min: "string"
        },
        field: "string",
        filter: "string",
        filtersSpec: {
          filters: {},
          otherBucket: boolean,
          otherBucketKey: "string"
        },
        from: integer,
        include: "string",
        interval: "string",
        maxDocCount: integer,
        minDocCount: integer,
        missing: "string",
        name: "string",
        percents: [],
        q: "string",
        ranges: [{
            from: integer,
            to: integer
          }],
        size: integer,
        sort: "string",
        subAggregates: [{
            dateRanges: [],
            exclude: "string",
            field: "string",
            filter: "string",
            filtersSpec: {
              filters: {},
              otherBucket: boolean,
              otherBucketKey: "string"
            },
            from: integer,
            include: "string",
            interval: "string",
            maxDocCount: integer,
            minDocCount: integer,
            missing: "string",
            name: "string",
            percents: [],
            q: "string",
            ranges: [],
            size: integer,
            sort: "string",
            subAggregates: [],
            timeZone: "string",
            type: "string"
          }],
        timeZone: "string",
        type: "string"
      }],
    timeZone: "string",
    type: "string"
}]  // body
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::r_tr_aggregate_sessions;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::MsaAggregateQueryRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = vec![MsaAggregateQueryRequest {
            date_ranges: vec![rusty_falcon::models::MsaDateRangeSpec {
                from: "string".to_string(),
                to: "string".to_string(),
                ..Default::default()
            }],
            exclude: "string".to_string(),
            field: "string".to_string(),
            filter: "string".to_string(),
            from: integer,
            include: "string".to_string(),
            interval: "string".to_string(),
            missing: "string".to_string(),
            name: "string".to_string(),
            q: "string".to_string(),
            ranges: vec![rusty_falcon::models::MsaRangeSpec {
                from: number,
                to: number,
                ..Default::default()
            }],
            size: integer,
            sort: "string".to_string(),
            sub_aggregates: vec![rusty_falcon::models::MsaAggregateQueryRequest {
                date_ranges: vec![rusty_falcon::models::MsaDateRangeSpec {
                    from: "string".to_string(),
                    to: "string".to_string(),
                    ..Default::default()
                }],
                exclude: "string".to_string(),
                field: "string".to_string(),
                filter: "string".to_string(),
                from: integer,
                include: "string".to_string(),
                interval: "string".to_string(),
                missing: "string".to_string(),
                name: "string".to_string(),
                q: "string".to_string(),
                ranges: vec![rusty_falcon::models::MsaRangeSpec {
                    from: number,
                    to: number,
                    ..Default::default()
                }],
                size: integer,
                sort: "string".to_string(),
                sub_aggregates: vec![rusty_falcon::models::MsaAggregateQueryRequest {
                    date_ranges: vec![],
                    exclude: "string".to_string(),
                    field: "string".to_string(),
                    filter: "string".to_string(),
                    from: integer,
                    include: "string".to_string(),
                    interval: "string".to_string(),
                    missing: "string".to_string(),
                    name: "string".to_string(),
                    q: "string".to_string(),
                    ranges: vec![],
                    size: integer,
                    sort: "string".to_string(),
                    sub_aggregates: vec![],
                    time_zone: "string".to_string(),
                    r#type: "string".to_string(),
                    ..Default::default()
                }],
                time_zone: "string".to_string(),
                r#type: "string".to_string(),
                ..Default::default()
            }],
            time_zone: "string".to_string(),
            r#type: "string".to_string(),
            ..Default::default()
        }];

    let response = r_tr_aggregate_sessions(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

body = [Falcon::MsaAggregateQueryRequest.new(
  date_ranges: [{
      from: 'string',
      to: 'string'
    }],
  exclude: 'string',
  extended_bounds: {
    max: 'string',
    min: 'string'
  },
  field: 'string',
  filter: 'string',
  filters_spec: {
    filters: {},
    other_bucket: boolean,
    other_bucket_key: 'string'
  },
  from: integer,
  include: 'string',
  interval: 'string',
  max_doc_count: integer,
  min_doc_count: integer,
  missing: 'string',
  name: 'string',
  percents: [],
  q: 'string',
  ranges: [{
      From: integer,
      To: integer
    }],
  size: integer,
  sort: 'string',
  sub_aggregates: [{
      date_ranges: [{
          from: 'string',
          to: 'string'
        }],
      exclude: 'string',
      extended_bounds: {
        max: 'string',
        min: 'string'
      },
      field: 'string',
      filter: 'string',
      filters_spec: {
        filters: {},
        other_bucket: boolean,
        other_bucket_key: 'string'
      },
      from: integer,
      include: 'string',
      interval: 'string',
      max_doc_count: integer,
      min_doc_count: integer,
      missing: 'string',
      name: 'string',
      percents: [],
      q: 'string',
      ranges: [{
          From: integer,
          To: integer
        }],
      size: integer,
      sort: 'string',
      sub_aggregates: [{
          date_ranges: [],
          exclude: 'string',
          extended_bounds: {},
          field: 'string',
          filter: 'string',
          filters_spec: {},
          from: integer,
          include: 'string',
          interval: 'string',
          max_doc_count: integer,
          min_doc_count: integer,
          missing: 'string',
          name: 'string',
          percents: [],
          q: 'string',
          ranges: [],
          size: integer,
          sort: 'string',
          sub_aggregates: [],
          time_zone: 'string',
          type: 'string'
        }],
      time_zone: 'string',
      type: 'string'
    }],
  time_zone: 'string',
  type: 'string'
)]

response = api.r_tr_aggregate_sessions(body)

puts response

Responses

[
  {
    "buckets": [],
    "doc_count_error_upper_bound": 0,
    "hits": {},
    "name": "string",
    "sum_other_doc_count": 0
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

RTR-CheckActiveResponderCommandStatus

Get status of an executed active-responder command on a single host.

Method GET

Route /real-time-response/entities/active-responder-command/v1

Scope Real time response: WRITE

PEP 8 check_active_responder_command_status

Parameters

cloud_request_id query · string

Cloud Request ID of the executed command to query

sequence_id query · integer

Sequence ID that we want to retrieve. Command responses are chunked across sequences

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.check_active_responder_command_status(cloud_request_id="string",
                                                        sequence_id=integer)
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.RTR_CheckActiveResponderCommandStatus(cloud_request_id="string",
                                                        sequence_id=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("RTR_CheckActiveResponderCommandStatus",
                          cloud_request_id="string",
                          sequence_id=integer)
print(response)

Confirm-FalconResponderCommand -CloudRequestId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.RealTimeResponse.RTRCheckActiveResponderCommandStatus(
    &real_time_response.RTRCheckActiveResponderCommandStatusParams{
      CloudRequestID: "string",
      SequenceID: integer,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.rTRCheckActiveResponderCommandStatus(
  "string",  // cloudRequestId
  integer  // sequenceId
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::r_tr_check_active_responder_command_status;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = r_tr_check_active_responder_command_status(
        &falcon.cfg,  // configuration
        "string",  // cloud_request_id
        integer,  // sequence_id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

response = api.r_tr_check_active_responder_command_status('string', integer)

puts response

Responses

[
  {
    "base_command": "string",
    "complete": false,
    "sequence_id": 0,
    "session_id": "string",
    "stderr": "string",
    "stdout": "string",
    "task_id": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

RTR-CheckCommandStatus

Get status of an executed command on a single host.

Method GET

Route /real-time-response/entities/command/v1

Scope Real time response: READ

PEP 8 check_command_status

Parameters

cloud_request_id query · string

Cloud Request ID of the executed command to query

sequence_id query · integer

Sequence ID that we want to retrieve. Command responses are chunked across sequences

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.check_command_status(cloud_request_id="string",
                                       sequence_id=integer)
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.RTR_CheckCommandStatus(cloud_request_id="string",
                                         sequence_id=integer)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("RTR_CheckCommandStatus",
                          cloud_request_id="string",
                          sequence_id=integer)
print(response)

Confirm-FalconCommand -CloudRequestId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.RealTimeResponse.RTRCheckCommandStatus(
    &real_time_response.RTRCheckCommandStatusParams{
      CloudRequestID: "string",
      SequenceID: integer,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.rTRCheckCommandStatus(
  "string",  // cloudRequestId
  integer  // sequenceId
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::r_tr_check_command_status;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = r_tr_check_command_status(
        &falcon.cfg,  // configuration
        "string",  // cloud_request_id
        integer,  // sequence_id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

response = api.r_tr_check_command_status('string', integer)

puts response

Responses

[
  {
    "base_command": "string",
    "complete": false,
    "sequence_id": 0,
    "session_id": "string",
    "stderr": "string",
    "stdout": "string",
    "task_id": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

RTR-DeleteFile

Delete a RTR session file.

Method DELETE

Route /real-time-response/entities/file/v1

Scope Real time response: WRITE

PEP 8 delete_file

Parameters

ids query · string

RTR Session file id

session_id query · string

RTR Session id

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_file(ids=id_list, session_id="string")
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.RTR_DeleteFile(ids=id_list, session_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("RTR_DeleteFile",
                          ids="string",
                          session_id="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.RealTimeResponse.RTRDeleteFile(
    &real_time_response.RTRDeleteFileParams{
      Ids: "string",
      SessionID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.rTRDeleteFile(
  "string",  // ids
  "string"  // sessionId
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::r_tr_delete_file;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = r_tr_delete_file(
        &falcon.cfg,  // configuration
        "string",  // ids
        "string",  // session_id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

response = api.r_tr_delete_file('string', 'string')

puts response

Responses

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

RTR-DeleteFileV2

Delete a RTR session file.

Method DELETE

Route /real-time-response/entities/file/v2

Scope Real time response: WRITE

PEP 8 delete_file_v2

Parameters

ids query · string

RTR Session file id

session_id query · string

RTR Session id

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.delete_file_v2(ids=id_list, session_id="string")
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.RTR_DeleteFileV2(ids=id_list, session_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("RTR_DeleteFileV2",
                          ids="string",
                          session_id="string")
print(response)

Remove-FalconGetFile -SessionId "string" -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.RealTimeResponse.RTRDeleteFileV2(
    &real_time_response.RTRDeleteFileV2Params{
      Ids: "string",
      SessionID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.rTRDeleteFileV2(
  "string",  // ids
  "string"  // sessionId
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::r_tr_delete_file_v2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = r_tr_delete_file_v2(
        &falcon.cfg,  // configuration
        "string",  // ids
        "string",  // session_id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

response = api.r_tr_delete_file_v2('string', 'string')

puts response

Responses

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

RTR-DeleteQueuedSession

Delete a queued session command

Method DELETE

Route /real-time-response/entities/queued-sessions/command/v1

Scope Real time response: READ

PEP 8 delete_queued_session

Parameters

session_id query · string

RTR Session id

cloud_request_id query · string

Cloud Request ID of the executed command to query

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.delete_queued_session(cloud_request_id="string",
                                        session_id="string")
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.RTR_DeleteQueuedSession(cloud_request_id="string",
                                          session_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("RTR_DeleteQueuedSession",
                          session_id="string",
                          cloud_request_id="string")
print(response)

Remove-FalconCommand -SessionId "string" -CloudRequestId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, rtrdeletequeuedsessionnocontent, err := client.RealTimeResponse.RTRDeleteQueuedSession(
    &real_time_response.RTRDeleteQueuedSessionParams{
      SessionID: "string",
      CloudRequestID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
  fmt.Printf("%+v\n", rtrdeletequeuedsessionnocontent.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.rTRDeleteQueuedSession(
  "string",  // sessionId
  "string"  // cloudRequestId
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::r_tr_delete_queued_session;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = r_tr_delete_queued_session(
        &falcon.cfg,  // configuration
        "string",  // session_id
        "string",  // cloud_request_id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

response = api.r_tr_delete_queued_session('string', 'string')

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

RTR-DeleteSession

Delete a session.

Method DELETE

Route /real-time-response/entities/sessions/v1

Scope Real time response: READ

PEP 8 delete_session

Parameters

session_id query · string

RTR Session id

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.delete_session(session_id="string")
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.RTR_DeleteSession(session_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("RTR_DeleteSession",
                          session_id="string")
print(response)

Remove-FalconSession -Id "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.RealTimeResponse.RTRDeleteSession(
    &real_time_response.RTRDeleteSessionParams{
      SessionID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.rTRDeleteSession("string");  // sessionId

console.log(response);

use rusty_falcon::apis::real_time_response_api::r_tr_delete_session;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = r_tr_delete_session(
        &falcon.cfg,  // configuration
        "string",  // session_id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

response = api.r_tr_delete_session('string')

puts response

Responses

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

RTR-ExecuteActiveResponderCommand

Execute an active responder command on a single host.

Method POST

Route /real-time-response/entities/active-responder-command/v1

Scope Real time response: WRITE

PEP 8 execute_active_responder_command

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

base_command body · string

Active-Responder command type we are going to execute, for example: get or cp. Refer to the RTR documentation for the full list of commands.

command_string body · string

Full command string for the command. For example get some_file.txt.

device_id body · string

ID of the device to execute the command on.

id body · integer

Command sequence.

persist body · boolean

Execute this command when host returns to service.

session_id body · string

RTR session ID.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.execute_active_responder_command(base_command="string",
                                                   command_string="string",
                                                   device_id="string",
                                                   id=integer,
                                                   persist=boolean,
                                                   session_id="string")
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.RTR_ExecuteActiveResponderCommand(base_command="string",
                                                    command_string="string",
                                                    device_id="string",
                                                    id=integer,
                                                    persist=boolean,
                                                    session_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "base_command": "string",
    "command_string": "string",
    "device_id": "string",
    "id": integer,
    "persist": boolean,
    "session_id": "string"
}

response = falcon.command("RTR_ExecuteActiveResponderCommand", body=body_payload)
print(response)

Invoke-FalconResponderCommand -Command "string" -SessionId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  baseCommand := "string"
  commandString := "string"
  deviceID := "string"
  id := int32(0)
  persist := boolean
  sessionID := "string"

  response, err := client.RealTimeResponse.RTRExecuteActiveResponderCommand(
    &real_time_response.RTRExecuteActiveResponderCommandParams{
      Body: &models.DomainCommandExecuteRequest{
        BaseCommand: &baseCommand,
        CommandString: &commandString,
        DeviceID: &deviceID,
        ID: &id,
        Persist: &persist,
        SessionID: &sessionID,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.rTRExecuteActiveResponderCommand(
  {
    baseCommand: "string",
    commandString: "string",
    deviceId: "string",
    id: integer,
    persist: boolean,
    sessionId: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::r_tr_execute_active_responder_command;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainCommandExecuteRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DomainCommandExecuteRequest {
        base_command: "string".to_string(),
        command_string: "string".to_string(),
        device_id: "string".to_string(),
        id: integer,
        persist: boolean,
        session_id: "string".to_string(),
        ..Default::default()
    };

    let response = r_tr_execute_active_responder_command(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

body = Falcon::DomainCommandExecuteRequest.new(
  base_command: 'string',
  command_string: 'string',
  device_id: 'string',
  id: integer,
  persist: boolean,
  session_id: 'string'
)

response = api.r_tr_execute_active_responder_command(body)

puts response

Responses

[
  {
    "cloud_request_id": "string",
    "queued_command_offline": false,
    "session_id": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

RTR-ExecuteCommand

Execute a command on a single host.

Method POST

Route /real-time-response/entities/command/v1

Scope Real time response: READ

PEP 8 execute_command

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

base_command body · string

Active-Responder command type we are going to execute, for example: get or cp. Refer to the RTR documentation for the full list of commands.

command_string body · string

Full command string for the command. For example get some_file.txt.

device_id body · string

ID of the device to execute the command on.

id body · integer

Command sequence.

persist body · boolean

Execute this command when host returns to service.

session_id body · string

RTR session ID.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.execute_command(base_command="string",
                                  command_string="string",
                                  device_id="string",
                                  id=integer,
                                  persist=boolean,
                                  session_id="string")
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.RTR_ExecuteCommand(base_command="string",
                                     command_string="string",
                                     device_id="string",
                                     id=integer,
                                     persist=boolean,
                                     session_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "base_command": "string",
    "command_string": "string",
    "device_id": "string",
    "id": integer,
    "persist": boolean,
    "session_id": "string"
}

response = falcon.command("RTR_ExecuteCommand", body=body_payload)
print(response)

Invoke-FalconCommand -Command "string" -SessionId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  baseCommand := "string"
  commandString := "string"
  deviceID := "string"
  id := int32(0)
  persist := boolean
  sessionID := "string"

  response, err := client.RealTimeResponse.RTRExecuteCommand(
    &real_time_response.RTRExecuteCommandParams{
      Body: &models.DomainCommandExecuteRequest{
        BaseCommand: &baseCommand,
        CommandString: &commandString,
        DeviceID: &deviceID,
        ID: &id,
        Persist: &persist,
        SessionID: &sessionID,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.rTRExecuteCommand(
  {
    baseCommand: "string",
    commandString: "string",
    deviceId: "string",
    id: integer,
    persist: boolean,
    sessionId: "string"
}  // body
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::r_tr_execute_command;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainCommandExecuteRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DomainCommandExecuteRequest {
        base_command: "string".to_string(),
        command_string: "string".to_string(),
        device_id: "string".to_string(),
        id: integer,
        persist: boolean,
        session_id: "string".to_string(),
        ..Default::default()
    };

    let response = r_tr_execute_command(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

body = Falcon::DomainCommandExecuteRequest.new(
  base_command: 'string',
  command_string: 'string',
  device_id: 'string',
  id: integer,
  persist: boolean,
  session_id: 'string'
)

response = api.r_tr_execute_command(body)

puts response

Responses

[
  {
    "cloud_request_id": "string",
    "queued_command_offline": false,
    "session_id": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

RTR-GetExtractedFileContents

Get RTR extracted file contents for specified session and sha256.

Method GET

Route /real-time-response/entities/extracted-file-contents/v1

Scope Real time response: WRITE

PEP 8 get_extracted_file_contents

Parameters

session_id query · string

RTR Session id

sha256 query · string

Extracted SHA256 (e.g. ‘efa256a96af3b556cd3fc9d8b1cf587d72807d7805ced441e8149fc279db422b’)

filename query · string

Filename to use for the archive name and the file within the archive.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

stream body · boolean

Enabling streaming download for the requested file.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.get_extracted_file_contents(session_id="string",
                                              sha256="string",
                                              filename="string",
                                              stream=boolean)
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.RTR_GetExtractedFileContents(session_id="string",
                                               sha256="string",
                                               filename="string",
                                               stream=boolean)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("RTR_GetExtractedFileContents",
                          session_id="string",
                          sha256="string",
                          filename="string")
print(response)

Receive-FalconGetFile -Sha256 "string" -SessionId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  filename := "string"

  file, err := os.Create("output_file")
  if err != nil {
    panic(err)
  }
  defer file.Close()

  response, err := client.RealTimeResponse.RTRGetExtractedFileContents(
    &real_time_response.RTRGetExtractedFileContentsParams{
      SessionID: "string",
      Sha256: "string",
      Filename: &filename,
      Context: context.Background(),
    },
    file,
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.rTRGetExtractedFileContents(
  "string",  // sessionId
  "string",  // sha256
  "string"  // filename
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::r_tr_get_extracted_file_contents;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = r_tr_get_extracted_file_contents(
        &falcon.cfg,  // configuration
        "string",  // session_id
        "string",  // sha256
        Some("string"),  // filename
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

response = api.r_tr_get_extracted_file_contents('string', 'string')

puts response

Responses

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

RTR-InitSession

Initialize a new session with the RTR cloud.

Method POST

Route /real-time-response/entities/sessions/v1

Scope Real time response: READ

PEP 8 init_session

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

device_id body · string

The host agent ID to initialize the RTR session on. RTR will retrieve an existing session for the calling user on this host.

origin body · string

queue_offline body · boolean

timeout query · integer

Timeout for how long to wait for the request in seconds, default timeout is 30 seconds. Maximum is 5 minutes.

timeout_duration query · string

Timeout duration for how long to wait for the request in duration syntax. Example, 10s. Valid units: ns, us, ms, s, m, h. Maximum is 5 minutes.

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.init_session(device_id="string",
                               origin="string",
                               queue_offline=boolean,
                               timeout=integer,
                               timeout_duration="string")
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.RTR_InitSession(device_id="string",
                                  origin="string",
                                  queue_offline=boolean,
                                  timeout=integer,
                                  timeout_duration="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "device_id": "string",
    "origin": "string",
    "queue_offline": boolean
}

response = falcon.command("RTR_InitSession",
                          timeout=integer,
                          timeout_duration="string",
                          body=body_payload)
print(response)

Start-FalconSession -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  timeout := int64(0)
  timeoutDuration := "string"
  deviceID := "string"
  origin := "string"
  queueOffline := boolean

  response, err := client.RealTimeResponse.RTRInitSession(
    &real_time_response.RTRInitSessionParams{
      Body: &models.DomainInitRequest{
        DeviceID: &deviceID,
        Origin: &origin,
        QueueOffline: &queueOffline,
      },
      Timeout: &timeout,
      TimeoutDuration: &timeoutDuration,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.rTRInitSession(
  {  // body
      deviceId: "string",
      origin: "string",
      queueOffline: boolean
  },
  integer,  // timeout
  "string"  // timeoutDuration
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::r_tr_init_session;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainInitRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DomainInitRequest {
        device_id: "string".to_string(),
        origin: "string".to_string(),
        queue_offline: boolean,
        ..Default::default()
    };

    let response = r_tr_init_session(
        &falcon.cfg,  // configuration
        body,  // body
        Some(integer),  // timeout
        Some("string"),  // timeout_duration
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

body = Falcon::DomainInitRequest.new(
  device_id: 'string',
  origin: 'string',
  queue_offline: boolean
)

response = api.r_tr_init_session(body)

puts response

Responses

[
  {
    "created_at": "string",
    "device_id": "string",
    "existing_aid_sessions": 0,
    "offline_queued": false,
    "platform": "string",
    "previous_commands": [],
    "pwd": "string",
    "scripts": [],
    "session_id": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

RTR-ListAllSessions

Get a list of session_ids.

Method GET

Route /real-time-response/queries/sessions/v1

Scope Real time response: READ

PEP 8 list_all_sessions

Parameters

offset query · string

Starting index of overall result set from which to return ids.

limit query · integer

Number of ids to return.

sort query · string

The property to sort by.

filter query · string

Optional filter criteria in the form of an FQL query. For more information about FQL queries, see our FQL documentation in Falcon. “user_id” can accept a special value ‘@me’ which will restrict results to records with current user’s ID.

Available values (14)

`id`	`created_at`	`updated_at`
`deleted_at`	`aid`	`hostname`
`user_id`	`origin`	`cloud_request_id`
`command_string`	`base_command`	`offline_queued`
`commands_queued`	`user_id`

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.list_all_sessions(filter="string",
                                    limit=integer,
                                    offset="string",
                                    sort="string")
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.RTR_ListAllSessions(filter="string",
                                      limit=integer,
                                      offset="string",
                                      sort="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("RTR_ListAllSessions",
                          offset="string",
                          limit=integer,
                          sort="string",
                          filter="string")
print(response)

Get-FalconSession -Filter "string" `
  -Sort "string" `
  -Limit integer `
  -Offset integer

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  offset := "string"
  limit := int64(0)
  sort := "string"
  filter := "string"

  response, err := client.RealTimeResponse.RTRListAllSessions(
    &real_time_response.RTRListAllSessionsParams{
      Offset: &offset,
      Limit: &limit,
      Sort: &sort,
      Filter: &filter,
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.rTRListAllSessions(
  "string",  // offset
  integer,  // limit
  "string",  // sort
  "string"  // filter
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::r_tr_list_all_sessions;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = r_tr_list_all_sessions(
        &falcon.cfg,  // configuration
        Some("string"),  // offset
        Some(integer),  // limit
        Some("string"),  // sort
        Some("string"),  // filter
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

response = api.r_tr_list_all_sessions(offset: 'string',
                                      limit: integer,
                                      sort: 'string',
                                      filter: 'string')

puts response

Responses

[
  "string"
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

RTR-ListFiles

Get a list of files for the specified RTR session.

Method GET

Route /real-time-response/entities/file/v1

Scope Real time response: WRITE

PEP 8 list_files

Parameters

session_id query · string

RTR Session id

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.list_files(session_id="string")
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.RTR_ListFiles(session_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("RTR_ListFiles",
                          session_id="string")
print(response)

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.RealTimeResponse.RTRListFiles(
    &real_time_response.RTRListFilesParams{
      SessionID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.rTRListFiles("string");  // sessionId

console.log(response);

use rusty_falcon::apis::real_time_response_api::r_tr_list_files;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = r_tr_list_files(
        &falcon.cfg,  // configuration
        "string",  // session_id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

response = api.r_tr_list_files('string')

puts response

Responses

[
  {
    "cloud_request_id": "string",
    "created_at": "string",
    "deleted_at": "string",
    "id": 0,
    "name": "string",
    "session_id": "string",
    "sha256": "string",
    "size": 0,
    "updated_at": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

RTR-ListFilesV2

Get a list of files for the specified RTR session.

Method GET

Route /real-time-response/entities/file/v2

Scope Real time response: WRITE

PEP 8 list_files_v2

Parameters

session_id query · string

RTR Session id

parameters query · dictionary

Full query string parameters payload in JSON format. Not required when using other keywords.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.list_files_v2(session_id="string")
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.RTR_ListFilesV2(session_id="string")
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

response = falcon.command("RTR_ListFilesV2",
                          session_id="string")
print(response)

Confirm-FalconGetFile -SessionId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.RealTimeResponse.RTRListFilesV2(
    &real_time_response.RTRListFilesV2Params{
      SessionID: "string",
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.rTRListFilesV2("string");  // sessionId

console.log(response);

use rusty_falcon::apis::real_time_response_api::r_tr_list_files_v2;
use rusty_falcon::easy::client::FalconHandle;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let response = r_tr_list_files_v2(
        &falcon.cfg,  // configuration
        "string",  // session_id
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

response = api.r_tr_list_files_v2('string')

puts response

Responses

[
  {
    "cloud_request_id": "string",
    "complete": false,
    "created_at": "string",
    "deleted_at": "string",
    "error_message": "string",
    "id": "string",
    "name": "string",
    "progress": 0.0,
    "session_id": "string",
    "sha256": "string",
    "size": 0,
    "stage": "string",
    "status": "string",
    "updated_at": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

RTR-ListQueuedSessions

Get queued session metadata by session ID.

Method POST

Route /real-time-response/entities/queued-sessions/GET/v1

Scope Real time response: READ

PEP 8 list_queued_sessions

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

ids body · array

List of RTR sessions to retrieve. RTR will only return the sessions that were created by the calling user.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.list_queued_sessions(ids=id_list)
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.RTR_ListQueuedSessions(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "ids": ["string"]
}

response = falcon.command("RTR_ListQueuedSessions", body=body_payload)
print(response)

Get-FalconQueue

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.RealTimeResponse.RTRListQueuedSessions(
    &real_time_response.RTRListQueuedSessionsParams{
      Body: &models.MsaIdsRequest{
        Ids: []string{"string"},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.rTRListQueuedSessions(
  {
    ids: []
}  // body
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::r_tr_list_queued_sessions;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::MsaIdsRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = MsaIdsRequest {
        ids: vec!["string".to_string()],
        ..Default::default()
    };

    let response = r_tr_list_queued_sessions(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

body = Falcon::MsaIdsRequest.new(
  ids: []
)

response = api.r_tr_list_queued_sessions(body)

puts response

Responses

[
  {
    "Commands": [],
    "aid": "string",
    "created_at": "string",
    "deleted_at": "string",
    "id": "string",
    "status": "string",
    "updated_at": "string",
    "user_id": "string",
    "user_uuid": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

RTR-ListSessions

Get session metadata by session id.

Method POST

Route /real-time-response/entities/sessions/GET/v1

Scope Real time response: READ

PEP 8 list_sessions

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

ids body · array

List of RTR sessions to retrieve. RTR will only return the sessions that were created by the calling user.

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.list_sessions(ids=id_list)
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

id_list = 'ID1,ID2,ID3'  # Can also pass a list here: ['ID1', 'ID2', 'ID3']

response = falcon.RTR_ListSessions(ids=id_list)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "ids": ["string"]
}

response = falcon.command("RTR_ListSessions", body=body_payload)
print(response)

Get-FalconSession -Id @("ID1", "ID2")

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  response, err := client.RealTimeResponse.RTRListSessions(
    &real_time_response.RTRListSessionsParams{
      Body: &models.MsaIdsRequest{
        Ids: []string{"string"},
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.rTRListSessions(
  {
    ids: []
}  // body
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::r_tr_list_sessions;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::MsaIdsRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = MsaIdsRequest {
        ids: vec!["string".to_string()],
        ..Default::default()
    };

    let response = r_tr_list_sessions(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

body = Falcon::MsaIdsRequest.new(
  ids: []
)

response = api.r_tr_list_sessions(body)

puts response

Responses

[
  {
    "cid": "string",
    "cloud_request_ids": [],
    "commands": {},
    "commands_queued": false,
    "created_at": "string",
    "deleted_at": "string",
    "device_details": {},
    "device_id": "string",
    "duration": 0.0,
    "execution_id": "string",
    "hostname": "string",
    "id": "string",
    "logs": [],
    "offline_queued": false,
    "origin": "string",
    "platform_id": 0,
    "platform_name": "string",
    "pwd": "string",
    "updated_at": "string",
    "user_id": "string",
    "user_uuid": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

RTR-PulseSession

Refresh a session timeout on a single host.

Method POST

Route /real-time-response/entities/refresh-session/v1

Scope Real time response: READ

PEP 8 pulse_session

Parameters

body body · dictionary

Full body payload as JSON formatted dictionary.

device_id body · string

The host agent ID to initialize the RTR session on. RTR will retrieve an existing session for the calling user on this host.

origin body · string

queue_offline body · boolean

Code Examples

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.pulse_session(device_id="string",
                                origin="string",
                                queue_offline=boolean)
print(response)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id=CLIENT_ID,
                          client_secret=CLIENT_SECRET
                          )

response = falcon.RTR_PulseSession(device_id="string",
                                   origin="string",
                                   queue_offline=boolean)
print(response)

from falconpy import APIHarnessV2

falcon = APIHarnessV2(client_id=CLIENT_ID,
                      client_secret=CLIENT_SECRET
                      )

body_payload = {
    "device_id": "string",
    "origin": "string",
    "queue_offline": boolean
}

response = falcon.command("RTR_PulseSession", body=body_payload)
print(response)

Update-FalconSession -HostId "string"

package main

import (
  "context"
  "fmt"
  "os"

  "github.com/crowdstrike/gofalcon/falcon"
  "github.com/crowdstrike/gofalcon/falcon/client/real_time_response"
  "github.com/crowdstrike/gofalcon/falcon/models"
)

func main() {
  client, err := falcon.NewClient(&falcon.ApiConfig{
    ClientId:     os.Getenv("FALCON_CLIENT_ID"),
    ClientSecret: os.Getenv("FALCON_CLIENT_SECRET"),
    Context:      context.Background(),
  })
  if err != nil {
    panic(err)
  }

  deviceID := "string"
  origin := "string"
  queueOffline := boolean

  response, err := client.RealTimeResponse.RTRPulseSession(
    &real_time_response.RTRPulseSessionParams{
      Body: &models.DomainInitRequest{
        DeviceID: &deviceID,
        Origin: &origin,
        QueueOffline: &queueOffline,
      },
      Context: context.Background(),
    },
  )
  if err != nil {
    panic(falcon.ErrorExplain(err))
  }

  fmt.Printf("%+v\n", response.Payload)
}

import { FalconClient } from "crowdstrike-falcon";

const client = new FalconClient({
  cloud: "us-1",
  clientId: process.env.FALCON_CLIENT_ID!,
  clientSecret: process.env.FALCON_CLIENT_SECRET!,
});

const response = await client.realTimeResponse.rTRPulseSession(
  {
    deviceId: "string",
    origin: "string",
    queueOffline: boolean
}  // body
);

console.log(response);

use rusty_falcon::apis::real_time_response_api::r_tr_pulse_session;
use rusty_falcon::easy::client::FalconHandle;
use rusty_falcon::models::DomainInitRequest;

#[tokio::main]
async fn main() {
    let falcon = FalconHandle::from_env().await.expect("Could not authenticate");

    let body = DomainInitRequest {
        device_id: "string".to_string(),
        origin: "string".to_string(),
        queue_offline: boolean,
        ..Default::default()
    };

    let response = r_tr_pulse_session(
        &falcon.cfg,  // configuration
        body,  // body
    ).await.expect("API call failed");

    println!("{:?}", response);
}

require "crimson-falcon"

Falcon.configure do |config|
  config.client_id = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
  config.cloud = ENV["FALCON_CLOUD"]
end

api = Falcon::RealTimeResponse.new

body = Falcon::DomainInitRequest.new(
  device_id: 'string',
  origin: 'string',
  queue_offline: boolean
)

response = api.r_tr_pulse_session(body)

puts response

Responses

[
  {
    "created_at": "string",
    "device_id": "string",
    "existing_aid_sessions": 0,
    "offline_queued": false,
    "platform": "string",
    "previous_commands": [],
    "pwd": "string",
    "scripts": [],
    "session_id": "string"
  }
]

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  }
}

{
  "errors": [
    {
      "code": 0,
      "id": "string",
      "message": "string"
    }
  ],
  "meta": {
    "pagination": {
      "limit": 0,
      "offset": 0,
      "total": 0
    },
    "powered_by": "string",
    "query_time": 0.0,
    "trace_id": "string",
    "writes": {
      "resources_affected": 0
    }
  },
  "resources": {}
}

Real Time Response

Table of Contents

BatchActiveResponderCmd

Parameters

BatchCmd

Parameters

BatchGetCmd

Parameters

BatchGetCmdStatus

Parameters

BatchInitSessions

Parameters

BatchRefreshSessions

Parameters

RTR-AggregateSessions

Parameters

RTR-CheckActiveResponderCommandStatus

Parameters

RTR-CheckCommandStatus

Parameters

RTR-DeleteFile

Parameters

RTR-DeleteFileV2

Parameters

RTR-DeleteQueuedSession

Parameters

RTR-DeleteSession

Parameters

RTR-ExecuteActiveResponderCommand

Parameters

RTR-ExecuteCommand

Parameters

RTR-GetExtractedFileContents

Parameters

RTR-InitSession

Parameters

RTR-ListAllSessions

Parameters

RTR-ListFiles

Parameters

RTR-ListFilesV2

Parameters

RTR-ListQueuedSessions

Parameters

RTR-ListSessions

Parameters

RTR-PulseSession

Parameters