[EDR Workflows] Add RunScript CS Command - UI by tomsonpl · Pull Request #202012 · elastic/kibana

tomsonpl · 2024-11-27T15:20:26Z

Summary

This PR introduces the runscript command for CrowdStrike RTR and adds parameter validation to align with the CrowdStrike API. The functionality is currently hidden behind a new crowdstrikeRunScriptEnabled feature flag for controlled rollout. Some aspects are temporary and will be refined in future PRs.

Key Changes

Added runscript Command:
- Implements the runscript command to allow execution of scripts via CrowdStrike RTR.
Added helpUsage to Command Definition:
- Introduced an optional helpUsage field that will overwrite exampleUsage in --help command if provided
Parameter Validation:
- Added validation for the following arguments - choose one, as defined by the CrowdStrike API:
  - --Raw
  - --HostPath
  - --CloudFile
- Optional arguments:
  - --CommandLine
  - --Timeout
*Temporary return of Null:
- A dedicated component for runscript results will be introduced in a separate PR.
API Route:
- The API route for executing the runscript command will be added in a subsequent PR.
Feature Flag:
- Hidden behind the new crowdstrikeRunScriptEnabled feature flag to ensure incremental adoption and testing.

Future Work

Replace null with a dedicated component for displaying runscript results.
Add API route for executing the runscript command.
Expand support for additional RTR commands and enhance error handling.

Why is this needed?

The runscript command is a critical RTR feature that enables script execution on target hosts. Adding this functionality brings Elastic closer to full-featured integration with CrowdStrike RTR, providing greater flexibility and utility for users.

tomsonpl · 2024-11-27T15:22:56Z

/ci

tomsonpl · 2024-11-28T07:58:42Z

/ci

tomsonpl · 2024-11-28T08:32:13Z

/ci

…-fix'

tomsonpl · 2024-11-28T10:25:18Z

/ci

tomsonpl · 2024-11-28T11:40:24Z

/ci

…-fix'

tomsonpl · 2024-11-28T13:43:17Z

/ci

tomsonpl · 2024-11-28T19:13:04Z

/ci

…-fix'

tomsonpl · 2024-11-28T20:18:23Z

/ci

…pt-cs-input

tomsonpl · 2024-11-29T09:21:19Z

/ci

tomsonpl · 2024-11-29T11:56:54Z

/ci

tomsonpl · 2024-11-29T12:50:04Z

/ci

tomsonpl · 2024-11-29T14:51:13Z

/ci

…pt-cs-input

ashokaditya

Thanks for the changes. I have left some questions and suggestions that I would like to hear before I approve. Also, you're missing a ff check for action type filter in https://github.com/elastic/kibana/blob/main/x-pack/plugins/security_solution/public/management/components/endpoint_response_actions_list/components/hooks.tsx

ashokaditya · 2024-12-09T12:38:36Z

x-pack/plugins/security_solution/common/endpoint/data_generators/endpoint_action_generator.ts

+        output = {
+          type: 'json',
+          content: {
+            code: 'ra_runscript_success_done',


Do you also have a list of error codes? Then you should add those below in a function as well.
randomRunscriptFailureCode()

I don't have a list unfortunately, I noted a few codes though so when I conitnue working on CrowdStrike connector and results - I'll adjust the CS errors list 👍

ashokaditya · 2024-12-09T12:40:42Z

x-pack/plugins/security_solution/public/management/common/translations.ts

+        about: i18n.translate(
+          'xpack.securitySolution.crowdStrikeConsoleCommands.runscript.args.hostPath.about',
+          {
+            defaultMessage: 'Absolute or relative path of script on host machine',


Suggested change

defaultMessage: 'Absolute or relative path of script on host machine',

defaultMessage: 'Absolute or relative path of script file on host machine',

This was taken 1:1 from CrowdStrike console - although I am ok with adjusting if you prefer

ashokaditya · 2024-12-09T12:56:00Z

..._solution/public/management/components/endpoint_responder/lib/console_commands_definition.ts

+      helpUsage: `runscript -CloudFile="CloudScript1.ps1" -CommandLine="-Verbose true"
+      Run a script saved to the CrowdStrike cloud with the specified command line arguments
+      runscript -CloudFile="CloudScript1.ps1" -CommandLine="-Verbose true" -Timeout=180
+      Run a script saved to the CrowdStrike cloud with the specified command line arguments and 180 seconds timeout
+      runscript -Raw=\`\`\`Get-ChildItem .\`\`\` -CommandLine=""
+      Run a raw script whose entire contents are provided in the "-Raw=" flag
+      runscript -HostPath="C:\\temp\\LocalScript.ps1" -CommandLine="-Verbose true"
+      Run a script from a path on the remote host with the specified command line arguments`,


In the screenshot, I notice the first line is indented separately from the rest of the lines.

Also, I feel the set of example help text here is a bit too dense to read on the screen. Consider visually separating the help title/text from the actual example command. Why not have the help description on top of the help syntax?

Something like
-- Run a script saved to the CrowdStrike cloud with the specified command line arguments
runscript -CloudFile="CloudScript1.ps1" -CommandLine="-Verbose true"

--Run a script saved to the CrowdStrike cloud with the specified command line arguments and 180 seconds timeout
runscript -CloudFile="CloudScript1.ps1" -CommandLine="-Verbose true" -Timeout=180
...
...
etc.

Applied some changes - hope it looks better :) I might create a component to render it nicer but I'd prefer to do it at the later stage if we still have time before 8.18 👍

ashokaditya · 2024-12-09T13:00:16Z

x-pack/plugins/security_solution/public/management/common/translations.ts

+        about: i18n.translate(
+          'xpack.securitySolution.crowdStrikeConsoleCommands.runscript.args.cloudFile.about',
+          {
+            defaultMessage: 'Script name in cloud storage',


Q: Should be file name I think? Unless script name and file name are the same?

Suggested change

defaultMessage: 'Script name in cloud storage',

defaultMessage: 'Script file name in cloud storage',

Good question. So scripts are on the Cloud, files are on a host. Again I copied this over from CrowdStrike console. But I am happy to adjust if you prefer

ashokaditya · 2024-12-09T13:06:38Z

...ins/security_solution/public/management/cypress/e2e/serverless/feature_access/complete.cy.ts

        // kbnServerArgs: [
        //   `--xpack.securitySolution.enableExperimental=${JSON.stringify([
-        //     'featureFlagName',
+        //     'crowdstrikeRunScriptEnabled',


Do you need this change?

Good catch. This can be reverted for the purposes of this PR, will be needed for another one.

ashokaditya · 2024-12-09T13:06:55Z

...ution/public/management/cypress/e2e/serverless/feature_access/essentials_with_endpoint.cy.ts

        // kbnServerArgs: [
        //   `--xpack.securitySolution.enableExperimental=${JSON.stringify([
-        //     'featureFlagName',
+        //     'crowdstrikeRunScriptEnabled',


ashokaditya · 2024-12-09T13:12:04Z

x-pack/plugins/security_solution/server/endpoint/routes/actions/utils.ts

+  runscript: {
+    endpoint: false,
+    sentinel_one: false,
+    crowdstrike: true,


Q: Looks like this is yet to be updated to false?

ashokaditya · 2024-12-09T13:38:57Z

...nt/components/endpoint_response_actions_list/integration_tests/response_actions_log.test.tsx

+      // TODO: RUNSCRIPT does not have a corresponding action in the API yet
+      const TEMPORARY_LENGTH = RESPONSE_ACTION_API_COMMANDS_NAMES.length - 1;
+      expect(getAllByTestId(`${filterPrefix}-option`).length).toEqual(TEMPORARY_LENGTH);


This is an issue with the EUI filter popover component. The popover list shows 9 items at a time on the default height. We need to collect the options using querySelectorAll or something like that. I think worth noting this glitch in a comment here 😓

I tried adjusting according to your suggestions but nothing helped. I'd take a note though and try to address this in another PR if this is ok with you? :)

Ok @ashokaditya showed me on zoom, that this was indeed the case. I was adjusting wrong components height 😅 Thanks!

I found a workaround and sent you the diff.

Applied, thanks a lot 👍

tomsonpl · 2024-12-09T14:51:30Z

/ci

ashokaditya

Thanks for the changes.

ashokaditya · 2024-12-09T15:02:50Z

...nt/components/endpoint_response_actions_list/integration_tests/response_actions_log.test.tsx

-    it('should show a list of actions (with `scan`) when opened', async () => {
-      render();
+    it('should show a list of actions (with `runscript`) when opened', async () => {
+      render({ 'data-test-height': 350 });


Just a note that we would need to have larger heights here as the number of commands increases. We might want to add a note somewhere here about that.

...olution/public/management/components/endpoint_response_actions_list/response_actions_log.tsx

…endpoint_response_actions_list/response_actions_log.tsx Co-authored-by: Ash <1849116+ashokaditya@users.noreply.github.com>

…pt-cs-input

paul-tavares

2nd round of feedback provided - I still see several issues. Let me know if you have any questions.

also, I checked out the PR and test it manually... here is what I found:

the help command output does not show the runscript correctly (note the --. I think this is due to the fact that you have the command configured to require arguments, but tehre are no required arguments defined. I think its due to the fact the fact that you did not define the arguments correctly for the mutually exclusive arguments (see my code comment)
There are argument validations in place. I just entered runscript --comment and it was accepted

paul-tavares · 2024-12-09T15:56:21Z

.../plugins/security_solution/public/management/components/console/components/command_usage.tsx

    });
  }, [commandDef]);

+  const helpExample = useMemo(() => {


Why did we need to add a helpUsage property if exampleUsage already existed? Is it because you wanted to have the input hint be different from what --help displays?

Yes, that was the reason 👍

x-pack/plugins/security_solution/public/management/components/console/types.ts

paul-tavares · 2024-12-09T16:07:07Z

..._solution/public/management/components/endpoint_responder/lib/console_commands_definition.ts

+        privileges: endpointPrivileges,
+      },
+      exampleUsage: `runscript -Raw=\`\`\`Get-ChildItem .\`\`\` -CommandLine=""`,
+      helpUsage: `


This needs to be i18n.
also - examples below are showing the argument with a single dash - instead of two --

paul-tavares · 2024-12-09T16:10:30Z

..._solution/public/management/components/endpoint_responder/lib/console_commands_definition.ts

+        capabilities: endpointCapabilities,
+        privileges: endpointPrivileges,
+      },
+      exampleUsage: `runscript -Raw=\`\`\`Get-ChildItem .\`\`\` -CommandLine=""`,


This does not seem correct.

you seem to be using single - instead of double --

Why is the example using back-tick (`) ? The helpUsage below shows the examples enclosed in double quotes

Changing - into -- thanks!

I'd say it could support both, or even more: runscript --Raw=ls | runscript --Raw="ls" | runscript --Raw='ls' | 'runscript --Raw=ls'

paul-tavares · 2024-12-09T16:13:27Z

..._solution/public/management/components/endpoint_responder/lib/console_commands_definition.ts

+          required: false,
+          allowMultiples: false,
+          about: CROWDSTRIKE_CONSOLE_COMMANDS.runscript.args.timeout.about,
+          mustHaveValue: 'non-empty-string',


This setting's value (non-empty-string) correct ? I thought timeout was a number.

paul-tavares · 2024-12-09T16:14:54Z

..._solution/public/management/components/endpoint_responder/lib/console_commands_definition.ts

+          allowMultiples: false,
+          about: CROWDSTRIKE_CONSOLE_COMMANDS.runscript.args.hostPath.about,
+          mustHaveValue: 'non-empty-string',
+        },


I thought you said that 1 of these tree needed to be used... so should have the exclusiveOr property set to true, no?

This is a bit tricky, since CrowdStrike lets you add multiple of these arguments, and then the strange behavior I explained during the meeting happened. But I agree with you that our approach would be to use exclusiveOr and just let them use one at a time.
Added exclusiveOr 👍 Thank you, I also added a description to exclusiveOr type.

Ok. Sorry about this - I do now remember that we discussed that they can use multiples, but at least one of them must be present. In that case, you are correct in that we can't use exclusiveOr because that limits the options for the user to having to only pick one.

The main issue I saw when testing this is that there was no validations in place. Realizing now that all three could be used, and that at least 1 must be defined, I think the perhaps the command should be setup as:

Remove exclusiveOr from the arguments

Set the command's mustHaveArgs to false

Add a command level validate callback and add the validation there (that at least one if being used)

Removing the mustHaveArgs (or setting it to false) will also address the visual issue where the help was showing runscript --

paul-tavares · 2024-12-09T16:16:17Z

...lution/public/management/components/endpoint_responder/lib/endpoint_action_response_codes.ts

+
+  // Dev:
+  // runscript success/competed
+  ra_runscript_success_done: i18n.translate(


You should not be using these code for Crowdstrike. This are Elastic Defend specific and IMO should remain as such.

I did it to reflect the behavior in tests, but I am ok with removing it 👍

paul-tavares · 2024-12-09T16:17:02Z

...ublic/management/components/endpoint_response_actions_list/components/actions_log_filter.tsx

    isFlyout: boolean;
    onChangeFilterOptions?: (selectedOptions: string[]) => void;
    'data-test-subj'?: string;
+    'data-test-height'?: number;


can you explain what this property is? I see it used in a few places below and I'm just not getting it. Also - the naming seems strange,since data- are normally the naming convention use if the property needs to be pass all the way though the HTML element.

This is a workaround to make our tests work with more than 9 elements on the filters list in history log. Apparently EUI component has dynamically loaded elements and without increased height we weren't able to render all 10 elements.
I wouldn't be really worried about this prop, what do you think?

Ahhhhh. Ok - so used only for testing so that we don't have to trigger a "scroll" of the popup's content. Got it. I was initially thinking this was a fix that would be visible in the UI and that concerned me because it would not scale as we add more items.

paul-tavares · 2024-12-09T16:20:45Z

...ins/security_solution/public/management/cypress/e2e/serverless/feature_access/complete.cy.ts

      // No access to response actions (except `unisolate`)
      for (const actionName of RESPONSE_ACTION_API_COMMANDS_NAMES.filter(
-        (apiName) => apiName !== 'unisolate'
+        (apiName) => apiName !== 'unisolate' && apiName !== 'runscript'


Is this temporary? if not, then please update the JSDoc comment above (it mentions only UnIsolate)

Yes, this is temporary. This PR doesn't include API changes. The next PR will include it.

tomsonpl · 2024-12-10T10:50:19Z

@paul-tavares thank's for the review. i was confused about exclusiveOr because it lacked the description, but in the end it's a great out of the box functionality that is perfect for our usage here 👍

I think I applied all the suggestions, also included an updated screenshot in the description.

Also - thanks for the review and help with the strange EUI issue @ashokaditya, appreciate the help 👍

elasticmachine · 2024-12-10T12:23:19Z

💚 Build Succeeded

Buildkite Build
Commit: d3c067e

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	14.6MB	14.7MB	+10.4KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`securitySolution`	87.8KB	87.9KB	+31.0B

History

💛 Build #258378 was flaky 7f87374
💛 Build #258151 was flaky aed126a
💚 Build #257778 succeeded e0c9c44
💛 Build #257305 was flaky 0075942
💔 Build #256939 failed 8302bc9
💚 Build #256608 succeeded f1293fb

cc @tomsonpl

paul-tavares

Thanks for all the follow ups. Left some more comments, but am 👍 it. You can address it later if needed.

paul-tavares · 2024-12-10T13:39:34Z

..._solution/public/management/components/endpoint_responder/lib/console_commands_definition.ts

+        capabilities: endpointCapabilities,
+        privileges: endpointPrivileges,
+      },
+      exampleUsage: `runscript --Raw=\`\`\`Get-ChildItem .\`\`\` -CommandLine=""`,


FYI - I still see the use of ` here for the --Raw value. I'm guessing thats intentional.

Yes, we want --, I mistakenly omitted the -CommandLine - will adjust

Not sure you understood my comment (although, I did not notice the single - the CommandLine so good call).

Look at the value of --Raw.... Why is it using 3 backtick characters (`) to enclose the value of Get-ChildItem .?

Right... well, apparently an example I copied over from CS. But indeed it makes no sense, will remove! thx

paul-tavares · 2024-12-10T13:45:00Z

..._solution/public/management/components/endpoint_responder/lib/console_commands_definition.ts

+          allowMultiples: false,
+          about: CROWDSTRIKE_CONSOLE_COMMANDS.runscript.args.hostPath.about,
+          mustHaveValue: 'non-empty-string',
+        },


Ok. Sorry about this - I do now remember that we discussed that they can use multiples, but at least one of them must be present. In that case, you are correct in that we can't use exclusiveOr because that limits the options for the user to having to only pick one.

The main issue I saw when testing this is that there was no validations in place. Realizing now that all three could be used, and that at least 1 must be defined, I think the perhaps the command should be setup as:

Remove exclusiveOr from the arguments

Set the command's mustHaveArgs to false

Add a command level validate callback and add the validation there (that at least one if being used)

Removing the mustHaveArgs (or setting it to false) will also address the visual issue where the help was showing runscript --

paul-tavares · 2024-12-10T13:47:10Z

...ublic/management/components/endpoint_response_actions_list/components/actions_log_filter.tsx

    isFlyout: boolean;
    onChangeFilterOptions?: (selectedOptions: string[]) => void;
    'data-test-subj'?: string;
+    'data-test-height'?: number;


Ahhhhh. Ok - so used only for testing so that we don't have to trigger a "scroll" of the popup's content. Got it. I was initially thinking this was a fix that would be visible in the UI and that concerned me because it would not scale as we add more items.

kibanamachine · 2024-12-10T14:02:29Z

Starting backport for target branches: 8.x

https://github.com/elastic/kibana/actions/runs/12257730007

tomsonpl · 2024-12-10T14:03:31Z

Merged, the following will be coming in a separate PR:

fix triple backticks in the example
change -CommandLine single dash into --
think whether it's needed to provide all 3 arguments at a time - maybe it's just quite loose validation on CS that we don't really need to follow.

(cherry picked from commit 9b27804)

kibanamachine · 2024-12-10T14:07:23Z

💚 All backports created successfully

Status	Branch	Result
✅	8.x

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

# Backport This will backport the following commits from `main` to `8.x`: - [[EDR Workflows] Add RunScript CS Command - UI (#202012)](#202012)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport)  Co-authored-by: Tomasz Ciecierski <tomasz.ciecierski@elastic.co>

add console command

01e79af

tomsonpl self-assigned this Nov 27, 2024

tomsonpl added Team:Defend Workflows “EDR Workflows” sub-team of Security Solution release_note:feature Makes this part of the condensed release notes v8.18.0 labels Nov 27, 2024

fix

ac4fdec

tomsonpl added 2 commits November 28, 2024 09:06

remove new lines

61743fc

fix

bf9766d

[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…

0acea0f

…-fix'

fix test

067fb0c

[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…

61623bd

…-fix'

tomsonpl added the backport:version Backport to applied version labels label Nov 28, 2024

fix tests

ecf0773

[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…

d833f7f

…-fix'

tomsonpl added 2 commits November 29, 2024 10:20

fix tests

9c31946

Merge remote-tracking branch 'origin/runscript-cs-input' into runscri…

d3a5ce4

…pt-cs-input

Merge branch 'main' into runscript-cs-input

992699b

Merge branch 'main' into runscript-cs-input

500697d

tomsonpl added 2 commits December 9, 2024 11:52

revert

c2c4456

Merge remote-tracking branch 'origin/runscript-cs-input' into runscri…

aed126a

…pt-cs-input

ashokaditya reviewed Dec 9, 2024

View reviewed changes

tomsonpl added 3 commits December 9, 2024 15:30

fix

924ab36

update help text

f3e1220

fix tests

c785860

ashokaditya approved these changes Dec 9, 2024

View reviewed changes

tomsonpl and others added 3 commits December 9, 2024 16:45

Update x-pack/plugins/security_solution/public/management/components/…

aa60ebc

…endpoint_response_actions_list/response_actions_log.tsx Co-authored-by: Ash <1849116+ashokaditya@users.noreply.github.com>

add note

5ab705f

Merge remote-tracking branch 'origin/runscript-cs-input' into runscri…

7f87374

…pt-cs-input

paul-tavares requested changes Dec 9, 2024

View reviewed changes

fix

d3c067e

tomsonpl requested a review from paul-tavares December 10, 2024 11:44

paul-tavares approved these changes Dec 10, 2024

View reviewed changes

tomsonpl merged commit 9b27804 into elastic:main Dec 10, 2024

kibanamachine added the v9.0.0 label Dec 10, 2024

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Dec 10, 2024

[EDR Workflows] Add RunScript CS Command - UI (elastic#202012)

812d804

(cherry picked from commit 9b27804)

kibanamachine mentioned this pull request Dec 10, 2024

[8.x] [EDR Workflows] Add RunScript CS Command - UI (#202012) #203586

Merged

tomsonpl mentioned this pull request Dec 11, 2024

[EDR Workflows] CrowdStrike RTR connector's sub actions #203420

Merged

3 tasks

CAWilson94 pushed a commit to CAWilson94/kibana that referenced this pull request Dec 12, 2024

[EDR Workflows] Add RunScript CS Command - UI (elastic#202012)

7ca5b7e

This was referenced Dec 16, 2024

[EDR Workflows] CrowdStrike RunScript: Log Actions and UI Output #204044

Merged

[Request] Crowdstrike additional third-party response actions elastic/security-docs#6365

Closed

	defaultMessage: 'Absolute or relative path of script on host machine',
	defaultMessage: 'Absolute or relative path of script file on host machine',

	defaultMessage: 'Script name in cloud storage',
	defaultMessage: 'Script file name in cloud storage',

Conversation

tomsonpl commented Nov 27, 2024 • edited by kibanamachine Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Key Changes

Future Work

Why is this needed?

Uh oh!

tomsonpl commented Nov 27, 2024

Uh oh!

tomsonpl commented Nov 28, 2024

Uh oh!

tomsonpl commented Nov 28, 2024

Uh oh!

tomsonpl commented Nov 28, 2024

Uh oh!

tomsonpl commented Nov 28, 2024

Uh oh!

tomsonpl commented Nov 28, 2024

Uh oh!

tomsonpl commented Nov 28, 2024

Uh oh!

tomsonpl commented Nov 28, 2024

Uh oh!

tomsonpl commented Nov 29, 2024

Uh oh!

tomsonpl commented Nov 29, 2024

Uh oh!

tomsonpl commented Nov 29, 2024

Uh oh!

tomsonpl commented Nov 29, 2024

Uh oh!

ashokaditya left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ashokaditya Dec 9, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tomsonpl commented Dec 9, 2024

Uh oh!

ashokaditya left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

paul-tavares left a comment

tomsonpl commented Nov 27, 2024 •

edited by kibanamachine

Loading

ashokaditya Dec 9, 2024 •

edited

Loading