Real-time Response processes and session counts

[bk-cs]

Copied from a post made by u/w33ha_AD on reddit:

Hey Guys,

I have been playing around PSFalcon for a couple of days now, and it is hands down one of the best underrated feature of CS, hopefully CS Sales teams start adding them and using them aggressively in their Sales Pitches.

So I have been testing out - Run a command against a group of devices script from your repository and have a couple of questions

Basic Scripts · CrowdStrike/psfalcon Wiki · GitHub

Does RTR initiate parallel threads for execution of RTR or does it happen sequentially?.

Also noticed it generates output in CSV format in batches of 500 - Is that the case ?

$QueueOffline - How is that variable being used since its not a Positional Argument as per the script

[bk-cs]

Thank you! For the record, it's not an official feature of CrowdStrike, it's entirely my own project that I thought CrowdStrike users that are fans of PowerShell might appreciate. :)

1. Real-time Response passes commands to a single PowerShell thread and waits for it to complete. Real-time Response sessions eventually expire, so if the process takes a long time, I typically use a separate process.

2. There is no technical limitation to the number of hosts that can be added to a Real-time Response session. I made a design choice to limit the number of hosts with the use of Invoke-FalconRtr to 500 hosts per session to reduce potential for unexpected issues. Note that Invoke-FalconRtr was designed as an easy "I want to run one operation on some hosts" command, but it's not the proper way to use Real-time Response for more complex workflows.

3. Positional arguments are optional. In the case of this script, that means if you want to use the offline queueing functionality, you add -QueueOffline $true to the list of arguments provided when you run the script. Since I wrote that example, I added -GroupId as a parameter to Invoke-FalconRtr itself, so you can run a Real-time Response command against a Host Group without using this example script.

Invoke-FalconRtr -GroupId <string> -Command <string> ...

[bk-cs]

/u/w33ha_AP:

Kudos if its a side project, other vendors don't even put this much efforts into their main product !!!

One suggestion/query -

Around the Get-Detections cmdlet, it would be helpful if one can pivot around detections. For Example, I have a malware outbreak on a couple of machines. I have the triggering file, I would want to export the machines that are part of the outbreak, although grouping is possible by the UI, it does not allow us to export, was thinking it there was a easier way to do it via PSFalcon.

Get-FalconDetection -Filter "behaviors.filename:'xxx.exe'" -Detailed | Select-Object "device"

I am trying to convert the output to CSV but unable to do so, the @ appended to the front does not allow it to do so, looking if I can trim or substring the @ out of the equation

[bk-cs]

The @ denotes that the property you’re viewing is a [PSCustomObject]. CSV is string-based, so you either need to select the specific properties you’re interested in or iterate through the object and convert each one to a column. I created Export-FalconReport for this purpose.

It iterates through objects and joins arrays in an effort to convert any PSFalcon result into something that is CSV compatible. It may not work perfectly in all cases, but it’s worth a try to see if you get the data you want:

Get-FalconDetection -Filter "behaviors.filename:'xxx.exe'" -Detailed | Export-FalconReport .\my.csv

You can also select just the properties you want, if you want to see what devices have detections matching the ones you’re interested in. For example, this should just return the device_ids with matching detections (if I did it correctly from memory):

(Get-FalconDetection -Filter "behaviors.filename:'xxx.exe'" -Detailed).device.device_id