Skip to content

[EDR Workflows] CrowdStrike RTR connector's sub actions#203420

Merged
tomsonpl merged 6 commits intoelastic:mainfrom
tomsonpl:runscript-cs-subaction
Dec 11, 2024
Merged

[EDR Workflows] CrowdStrike RTR connector's sub actions#203420
tomsonpl merged 6 commits intoelastic:mainfrom
tomsonpl:runscript-cs-subaction

Conversation

@tomsonpl
Copy link
Copy Markdown
Contributor

@tomsonpl tomsonpl commented Dec 9, 2024 •
edited by kibanamachine
Loading

Summary

This PR introduces key enhancements and fixes for CrowdStrike RTR functionality, including support for multiple RTR subactions, temporary additions, and improved session management.

Key Changes

1. Support for RTR Subactions

  • Added three main subactions to support various levels of RTR:
    • Normal RTR
    • Active Responder RTR
    • Admin RTR

2. Temporary getScripts SubAction

  • Introduced a getScripts subaction to retrieve cloud file names and details.
  • This functionality will be further implemented in a follow-up PR.

3. Dynamic Access Handling for RTR Commands

  • Certain RTR commands, such as runscript, require different access levels depending on the arguments:
    • CloudFile requires Active Responder access rights.
    • Raw or HostPath requires Admin access rights.
  • Introduced an overwriteUrl functionality to dynamically manage the API URL used within Kibana based on the command arguments and access requirements.

4. Session Manager Fix

  • Resolved an issue where this was not bound correctly in the sessionManager, leading to unexpected behavior during CrowdStrike requests.

Previous Steps

Previous Steps

Next Steps

  • Update the CrowdStrike Actions Client to store both actions and their corresponding responses.
  • Develop a dedicated UI Results Component for the Response Console.
  • Implement functionality to fetch and display CloudFiles (custom scripts).
  • Create documentation showcasing how to add new commands and integrate additional agents.

@tomsonpl tomsonpl added Team:Defend Workflows “EDR Workflows” sub-team of Security Solution release_note:feature Makes this part of the condensed release notes backport:version Backport to applied version labels v8.18.0 labels Dec 9, 2024
@tomsonpl tomsonpl self-assigned this Dec 9, 2024
@tomsonpl
Copy link
Copy Markdown
Contributor Author

tomsonpl commented Dec 9, 2024

/ci

@tomsonpl
Copy link
Copy Markdown
Contributor Author

tomsonpl commented Dec 10, 2024

/ci

@tomsonpl tomsonpl marked this pull request as ready for review December 11, 2024 09:15
@tomsonpl tomsonpl requested a review from a team as a code owner December 11, 2024 09:15
@tomsonpl tomsonpl requested review from parkiino, pzl and szwarckonrad and removed request for parkiino December 11, 2024 09:15
@tomsonpl
Copy link
Copy Markdown
Contributor Author

tomsonpl commented Dec 11, 2024

/ci

szwarckonrad
szwarckonrad approved these changes Dec 11, 2024
View reviewed changes
Copy link
Copy Markdown
Contributor

@szwarckonrad szwarckonrad left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code LGTM! 👍

x-pack/plugins/stack_connectors/common/crowdstrike/constants.ts Outdated
EXECUTE_RTR_COMMAND = 'executeRTRCommand',
EXECUTE_ACTIVE_RESPONDER_RTR = 'batchActiveResponderExecuteRTR',
EXECUTE_ADMIN_RTR = 'batchAdminExecuteRTR',
GET_SCRIPTS = 'getScripts',
Copy link
Copy Markdown
Contributor

@szwarckonrad szwarckonrad Dec 11, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are these general scripts, or are they specific to RTR? If they’re specific to RTR, consider including ‘RTR’ in the name for clarity.

Copy link
Copy Markdown
Contributor Author

@tomsonpl tomsonpl Dec 11, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

They're related to RTR, added the prefix - thanks 👍

@tomsonpl tomsonpl enabled auto-merge (squash) December 11, 2024 10:48
@tomsonpl tomsonpl merged commit 5be7182 into elastic:main Dec 11, 2024
@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Dec 11, 2024

Starting backport for target branches: 8.x

https://github.com/elastic/kibana/actions/runs/12276197507

@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Dec 11, 2024

💚 Build Succeeded

Metrics [docs]

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id before after diff
stackConnectors 58.4KB 58.5KB +152.0B

History

cc @tomsonpl

kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Dec 11, 2024
@tomsonpl
[EDR Workflows] CrowdStrike RTR connector's sub actions (elastic#203420)
8e3a08c 
(cherry picked from commit 5be7182)
@kibanamachine kibanamachine mentioned this pull request Dec 11, 2024
Merged
@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Dec 11, 2024

💚 All backports created successfully

Status Branch Result
✅ 8.x

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

kibanamachine added a commit that referenced this pull request Dec 11, 2024
@kibanamachine @tomsonpl
[8.x] [EDR Workflows] CrowdStrike RTR connector's sub actions (#…
0bdab97 
…203420) (#203782)

# Backport

This will backport the following commits from `main` to `8.x`:
- [[EDR Workflows] CrowdStrike RTR connector's sub actions
(#203420)](#203420)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Tomasz
Ciecierski","email":"tomasz.ciecierski@elastic.co"},"sourceCommit":{"committedDate":"2024-12-11T12:18:14Z","message":"[EDR
Workflows] CrowdStrike RTR connector's sub actions
(#203420)","sha":"5be7182bd44f4cdf98cd3f06bc5b0c1755a13a97","branchLabelMapping":{"^v9.0.0$":"main","^v8.18.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["v9.0.0","Team:Defend
Workflows","release_note:feature","backport:version","v8.18.0"],"title":"[EDR
Workflows] CrowdStrike RTR connector's sub
actions","number":203420,"url":"https://github.com/elastic/kibana/pull/203420","mergeCommit":{"message":"[EDR
Workflows] CrowdStrike RTR connector's sub actions
(#203420)","sha":"5be7182bd44f4cdf98cd3f06bc5b0c1755a13a97"}},"sourceBranch":"main","suggestedTargetBranches":["8.x"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/203420","number":203420,"mergeCommit":{"message":"[EDR
Workflows] CrowdStrike RTR connector's sub actions
(#203420)","sha":"5be7182bd44f4cdf98cd3f06bc5b0c1755a13a97"}},{"branch":"8.x","label":"v8.18.0","branchLabelMappingKey":"^v8.18.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Tomasz Ciecierski <tomasz.ciecierski@elastic.co>
CAWilson94 pushed a commit to CAWilson94/kibana that referenced this pull request Dec 12, 2024
@tomsonpl @CAWilson94
[EDR Workflows] CrowdStrike RTR connector's sub actions (elastic#203420)
d4a8b18
This was referenced Dec 16, 2024
Merged
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@szwarckonrad szwarckonrad szwarckonrad approved these changes

@pzl pzl Awaiting requested review from pzl pzl was automatically assigned from elastic/security-defend-workflows

Assignees

@tomsonpl tomsonpl

Labels

backport:version Backport to applied version labels release_note:feature Makes this part of the condensed release notes Team:Defend Workflows “EDR Workflows” sub-team of Security Solution v8.18.0 v9.0.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@tomsonpl @kibanamachine @elasticmachine @szwarckonrad