Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Jan 28] Adds new runscript Crowdstrike response action #6435

Merged
merged 5 commits into from
Jan 28, 2025
Merged

[Jan 28] Adds new runscript Crowdstrike response action #6435

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
5c3b32b
Adds new runscript Crowdstrike response action
natasha-moore-elastic Jan 17, 2025
59d9d73
Add missing information
natasha-moore-elastic Jan 20, 2025
9e7adb7
Updates example
natasha-moore-elastic Jan 20, 2025
cf499ea
Address feedback
natasha-moore-elastic Jan 21, 2025
9ed81fa
Update example
natasha-moore-elastic Jan 21, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 9 additions & 1 deletion docs/management/admin/response-actions.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -196,6 +196,8 @@ NOTE: Scanning can take longer for directories containing a lot of files.
[[runscript]]
=== `runscript`

NOTE: This response action is supported only for <<crowdstrike-response-actions, CrowdStrike-enrolled hosts>>.

Run a script on a host. You must include one of the following parameters to identify the script you want to run:

* `--Raw`: The full script content provided directly as a string.
Expand All @@ -209,7 +211,13 @@ You can also use these optional parameters:

Required privilege: **Execute Operations**

Example: `runscript --CloudFile="CloudScript1.ps1" --CommandLine="-Verbose true" --Timeout=180`
Examples:

`runscript --CloudFile="CloudScript1.ps1" --CommandLine="-Verbose true" --Timeout=180`

`runscript --Raw="Get-ChildItem."`
natasha-moore-elastic marked this conversation as resolved.
Show resolved Hide resolved

`runscript --HostPath="C:\temp\LocalScript.ps1" --CommandLine="-Verbose true"`

[discrete]
[[supporting-commands-parameters]]
Expand Down
2 changes: 2 additions & 0 deletions docs/management/admin/third-party-actions.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,8 @@ Refer to the instructions on <<isolate-a-host,isolating>> and <<release-a-host,r

* **Run a script on a host** with the <<runscript,`runscript` response action>>.

* **View past response action activity** in the <<response-actions-history,response actions history>> log.

[discrete]
[[sentinelone-response-actions]]
== SentinelOne response actions
Expand Down
12 changes: 10 additions & 2 deletions docs/serverless/endpoint-response-actions/response-actions.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -245,6 +245,8 @@ Scanning can take longer for directories containing a lot of files.
[[runscript]]
=== `runscript`

NOTE: This response action is supported only for <<security-third-party-actions-supported-systems-and-response-actions, CrowdStrike-enrolled hosts>>.

Run a script on a host. You must include one of the following parameters to identify the script you want to run:

* `--Raw`: The full script content provided directly as a string.
Expand All @@ -256,11 +258,17 @@ You can also use these optional parameters:
* `--CommandLine`: Additional command-line arguments passed to the script to customize its execution.
* `--Timeout`: The maximum duration, in seconds, that the script can run before it's forcibly stopped. If no timeout is specified, it defaults to 60 seconds.

Predefined role: **Tier 3 analyst**, **SOC manager**, or **Endpoint operations analyst**
Predefined role: **SOC manager** or **Endpoint operations analyst**

Custom role privilege: **Execute Operations**

Example: `runscript --CloudFile="CloudScript1.ps1" --CommandLine="-Verbose true" --Timeout=180`
Examples:

`runscript --CloudFile="CloudScript1.ps1" --CommandLine="-Verbose true" --Timeout=180`

`runscript --Raw="Get-ChildItem."`

`runscript --HostPath="C:\temp\LocalScript.ps1" --CommandLine="-Verbose true"`

[discrete]
[[supporting-commands-parameters]]
Expand Down
2 changes: 2 additions & 0 deletions docs/serverless/endpoint-response-actions/third-party-actions.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,6 +46,8 @@ Refer to the instructions on <<isolate-a-host,isolating>> and <<release-a-host,r

* **Run a script on a host** with the <<runscript,`runscript` response action>>.

* **View past response action activity** in the <<security-response-actions-history,response actions history>> log.

++++
</div>
<div tabindex="0" role="tabpanel" id="endpoint-response-actions-third-party-actions-sentinelone-panel" aria-labelledby="endpoint-response-actions-third-party-actions-sentinelone-button" hidden="">
Expand Down