[EDR Workflows] Add RunScript CS Command - UI #202012
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -33,6 +33,13 @@ export const CommandInputUsage = memo<Pick<CommandUsageProps, 'commandDef'>>(({ | |
| }); | ||
| }, [commandDef]); | ||
|
|
||
| const helpExample = useMemo(() => { | ||
|
There was a problem hiding this comment. Why did we need to add a There was a problem hiding this comment. Yes, that was the reason 👍 |
||
| if (commandDef.helpUsage) { | ||
| return commandDef.helpUsage; | ||
| } | ||
| return commandDef.exampleUsage; | ||
| }, [commandDef]); | ||
|
|
||
| return ( | ||
| <> | ||
| <EuiDescriptionList | ||
|
|
@@ -55,7 +62,7 @@ export const CommandInputUsage = memo<Pick<CommandUsageProps, 'commandDef'>>(({ | |
| titleProps={additionalProps} | ||
| /> | ||
| <EuiSpacer size="s" /> | ||
| {helpExample && ( | ||
| <EuiDescriptionList | ||
| compressed | ||
| type="column" | ||
|
|
@@ -69,7 +76,7 @@ export const CommandInputUsage = memo<Pick<CommandUsageProps, 'commandDef'>>(({ | |
| })} | ||
| </ConsoleCodeBlock> | ||
| ), | ||
| description: <ConsoleCodeBlock>{helpExample}</ConsoleCodeBlock>, | ||
| }, | ||
| ]} | ||
| descriptionProps={additionalProps} | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -128,6 +128,13 @@ export interface CommandDefinition<TMeta = any> { | |
| */ | ||
| exampleUsage?: string; | ||
|
|
||
| /** | ||
| * Displayed in the output of this command's `--help`. | ||
| * This value will override the command usage generated by the console | ||
| * from the Command Definition. | ||
| */ | ||
| helpUsage?: string; | ||
paul-tavares marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
|
||
| /** | ||
| * Validate the command entered by the user. This is called only after the Console has ran | ||
| * through all of its builtin validations (based on `CommandDefinition`). | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -42,7 +42,7 @@ import { | |
| import { getCommandAboutInfo } from './get_command_about_info'; | ||
|
|
||
| import { validateUnitOfTime } from './utils'; | ||
| import { CONSOLE_COMMANDS, CROWDSTRIKE_CONSOLE_COMMANDS } from '../../../common/translations'; | ||
| import { ScanActionResult } from '../command_render_components/scan_action'; | ||
|
|
||
| const emptyArgumentValidator = (argData: ParsedArgData): true | string => { | ||
|
|
@@ -167,6 +167,7 @@ export const getEndpointConsoleCommands = ({ | |
| const featureFlags = ExperimentalFeaturesService.get(); | ||
|
|
||
| const isUploadEnabled = featureFlags.responseActionUploadEnabled; | ||
| const crowdstrikeRunScriptEnabled = featureFlags.crowdstrikeRunScriptEnabled; | ||
|
|
||
| const doesEndpointSupportCommand = (commandName: ConsoleResponseActionCommands) => { | ||
| // Agent capabilities is only validated for Endpoint agent types | ||
|
|
@@ -523,6 +524,87 @@ export const getEndpointConsoleCommands = ({ | |
| privileges: endpointPrivileges, | ||
| }), | ||
| }); | ||
| if (crowdstrikeRunScriptEnabled) { | ||
| consoleCommands.push({ | ||
| name: 'runscript', | ||
| about: getCommandAboutInfo({ | ||
| aboutInfo: CROWDSTRIKE_CONSOLE_COMMANDS.runscript.about, | ||
| isSupported: doesEndpointSupportCommand('runscript'), | ||
| }), | ||
| RenderComponent: () => null, | ||
| meta: { | ||
| agentType, | ||
| endpointId: endpointAgentId, | ||
| capabilities: endpointCapabilities, | ||
| privileges: endpointPrivileges, | ||
| }, | ||
| exampleUsage: `runscript -Raw=\`\`\`Get-ChildItem .\`\`\` -CommandLine=""`, | ||
|
There was a problem hiding this comment. This does not seem correct.
There was a problem hiding this comment.
|
||
| helpUsage: ` | ||
|
There was a problem hiding this comment. This needs to be |
||
| Command Examples for Running Scripts: | ||
|
|
||
| 1. Executes a script saved in the CrowdStrike cloud with the specified command-line arguments. | ||
|
|
||
| runscript -CloudFile="CloudScript1.ps1" -CommandLine="-Verbose true" | ||
|
|
||
| 2. Executes a script saved in the CrowdStrike cloud with the specified command-line arguments and a 180-second timeout. | ||
|
|
||
| runscript -CloudFile="CloudScript1.ps1" -CommandLine="-Verbose true" -Timeout=180 | ||
|
|
||
| 3. Executes a raw script provided entirely within the "-Raw" flag. | ||
|
|
||
| runscript -Raw="Get-ChildItem." | ||
|
|
||
| 4. Executes a script located on the remote host at the specified path with the provided command-line arguments. | ||
|
|
||
| runscript -HostPath="C:\\temp\\LocalScript.ps1" -CommandLine="-Verbose true" | ||
|
|
||
| `, | ||
| exampleInstruction: CROWDSTRIKE_CONSOLE_COMMANDS.runscript.about, | ||
| validate: capabilitiesAndPrivilegesValidator(agentType), | ||
| mustHaveArgs: true, | ||
| args: { | ||
| Raw: { | ||
| required: false, | ||
| allowMultiples: false, | ||
| about: CROWDSTRIKE_CONSOLE_COMMANDS.runscript.args.raw.about, | ||
| mustHaveValue: 'non-empty-string', | ||
| }, | ||
| CloudFile: { | ||
| required: false, | ||
| allowMultiples: false, | ||
| about: CROWDSTRIKE_CONSOLE_COMMANDS.runscript.args.cloudFile.about, | ||
| mustHaveValue: 'non-empty-string', | ||
| }, | ||
| CommandLine: { | ||
| required: false, | ||
| allowMultiples: false, | ||
| about: CROWDSTRIKE_CONSOLE_COMMANDS.runscript.args.commandLine.about, | ||
| mustHaveValue: 'non-empty-string', | ||
| }, | ||
| HostPath: { | ||
| required: false, | ||
| allowMultiples: false, | ||
| about: CROWDSTRIKE_CONSOLE_COMMANDS.runscript.args.hostPath.about, | ||
| mustHaveValue: 'non-empty-string', | ||
| }, | ||
|
There was a problem hiding this comment. I thought you said that 1 of these tree needed to be used... so should have the There was a problem hiding this comment. This is a bit tricky, since CrowdStrike lets you add multiple of these arguments, and then the strange behavior I explained during the meeting happened. But I agree with you that our approach would be to use There was a problem hiding this comment. Ok. Sorry about this - I do now remember that we discussed that they can use multiples, but at least one of them must be present. In that case, you are correct in that we can't use The main issue I saw when testing this is that there was no validations in place. Realizing now that all three could be used, and that at least 1 must be defined, I think the perhaps the command should be setup as:
Removing the |
||
| Timeout: { | ||
| required: false, | ||
| allowMultiples: false, | ||
| about: CROWDSTRIKE_CONSOLE_COMMANDS.runscript.args.timeout.about, | ||
| mustHaveValue: 'non-empty-string', | ||
|
There was a problem hiding this comment. This setting's value ( 
|
||
| }, | ||
|
There was a problem hiding this comment. I'm a bit confused on this setup for the arguments... Should at least one of these be required? if so, then all arguments configuration should have There was a problem hiding this comment. Good point, I wasn't aware There was a problem hiding this comment. Reading through the options again - can you detail in the issue what the input is to these arguments and how they should be used? Example:
There was a problem hiding this comment. Sure, I understand this may be a bit unclear 👍
I'll put some info about it in the issue itself too as you suggested 👍 There was a problem hiding this comment. Also: I played with CS Console and it's possible to pass multiple arguments eg. What do you think? |
||
| ...commandCommentArgument(), | ||
| }, | ||
| helpGroupLabel: HELP_GROUPS.responseActions.label, | ||
| helpGroupPosition: HELP_GROUPS.responseActions.position, | ||
| helpCommandPosition: 9, | ||
| helpDisabled: !doesEndpointSupportCommand('runscript'), | ||
| helpHidden: !getRbacControl({ | ||
| commandName: 'runscript', | ||
| privileges: endpointPrivileges, | ||
| }), | ||
| }); | ||
| } | ||
|
|
||
| switch (agentType) { | ||
| case 'sentinel_one': | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -299,6 +299,13 @@ const CODES = Object.freeze({ | |
| 'xpack.securitySolution.endpointActionResponseCodes.scan.success', | ||
| { defaultMessage: 'Scan complete' } | ||
| ), | ||
|
|
||
| // Dev: | ||
| // runscript success/competed | ||
| ra_runscript_success_done: i18n.translate( | ||
|
There was a problem hiding this comment. You should not be using these code for Crowdstrike. This are Elastic Defend specific and IMO should remain as such. There was a problem hiding this comment. I did it to reflect the behavior in tests, but I am ok with removing it 👍 |
||
| 'xpack.securitySolution.endpointActionResponseCodes.runscript.success', | ||
| { defaultMessage: 'Runscript complete' } | ||
| ), | ||
| }); | ||
|
|
||
| /** | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -73,7 +73,10 @@ describe('When displaying Endpoint Response Actions', () => { | |
| HELP_GROUPS.responseActions.label | ||
| ); | ||
|
|
||
| const endpointCommands = CONSOLE_RESPONSE_ACTION_COMMANDS.filter( | ||
| (command) => command !== 'runscript' | ||
| ); | ||
| const expectedCommands: string[] = [...endpointCommands]; | ||
| // add status to the list of expected commands in that order | ||
| expectedCommands.splice(2, 0, 'status'); | ||
|
|
||
|
|
@@ -149,6 +152,7 @@ describe('When displaying Endpoint Response Actions', () => { | |
| beforeEach(() => { | ||
| (ExperimentalFeaturesService.get as jest.Mock).mockReturnValue({ | ||
| responseActionsCrowdstrikeManualHostIsolationEnabled: true, | ||
| crowdstrikeRunScriptEnabled: true, | ||
| }); | ||
| commands = getEndpointConsoleCommands({ | ||
| agentType: 'crowdstrike', | ||
|
|
@@ -176,7 +180,7 @@ describe('When displaying Endpoint Response Actions', () => { | |
| HELP_GROUPS.responseActions.label | ||
| ); | ||
|
|
||
| expect(commandsInPanel).toEqual(['isolate', 'release', 'runscript --']); | ||
| }); | ||
| }); | ||
| }); | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Do you also have a list of error codes? Then you should add those below in a function as well.
randomRunscriptFailureCode()There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't have a list unfortunately, I noted a few codes though so when I conitnue working on CrowdStrike connector and results - I'll adjust the CS errors list 👍