Skip to content

[EDR Workflows] CrowdStrike RunScript: Log Actions and UI Output#204044

Merged
tomsonpl merged 18 commits intoelastic:mainfrom
tomsonpl:runscript-cs-logs
Dec 17, 2024
Merged

[EDR Workflows] CrowdStrike RunScript: Log Actions and UI Output#204044
tomsonpl merged 18 commits intoelastic:mainfrom
tomsonpl:runscript-cs-logs

Conversation

@tomsonpl
Copy link
Copy Markdown
Contributor

@tomsonpl tomsonpl commented Dec 12, 2024 •
edited by kibanamachine
Loading

Summary

This PR enhances CrowdStrike RTR functionality by refining command support, improving the UI, and aligning with CrowdStrike prerequisites for handling runscript commands.

Key Changes

  • Save Action and Response:

    • Added functionality to save both actions and responses for CrowdStrike RTR commands and display them in the UI.

  • Fix --Raw Parameter Handling:

    • Updated the --Raw parameter to accept both "string" and ```multi-line strings enclosed in triple backticks```, as required by CrowdStrike for scripts with more than one word.

  • Adjust RTR Subaction:

    • Enhanced the RTR subaction to support additional commands in the future.

  • UI Output for runscript:

    • Integrated ExecuteActionHostResponse as the output component for the runscript command, which meets current requirements effectively.

  • History Log:

    • Updated the logic to include runscript results in the history log for better traceability.

  • Removed overwriteUrl Flag:

    • Removed the overwriteUrl functionality since it is safer to always use the admin permissions URL for the runscript command.

  • Rename API Parameters:

    • Renamed API parameters from CapitalCase to camelCase - thanks @szwarckonrad for making the suggestion:
      • Raw → raw
      • CloudFile → cloudFile
      • HostPath → hostPath
      • CommandLine → commandLine
      • Timeout → timeout

UI

Zrzut ekranu 2024-12-16 o 11 40 39 Zrzut ekranu 2024-12-16 o 11 44 58

Previous Steps

Next Steps

  • Integrate the dropdown functionality and fetch CloudFiles (custom scripts) in the Response Console input.
  • Continue to extend support for additional RTR commands.
  • Update documentation to reflect these changes and include examples.

@tomsonpl tomsonpl added Team:Defend Workflows “EDR Workflows” sub-team of Security Solution release_note:feature Makes this part of the condensed release notes backport:version Backport to applied version labels v8.18.0 labels Dec 12, 2024
@tomsonpl tomsonpl self-assigned this Dec 12, 2024
@tomsonpl
Copy link
Copy Markdown
Contributor Author

tomsonpl commented Dec 16, 2024

/ci

@tomsonpl tomsonpl changed the title [EDR Workflows] [WIP] CrowdStrike RunScript logs and output [EDR Workflows] CrowdStrike RunScript: Log Actions and Improve UI Output Dec 16, 2024
@tomsonpl tomsonpl changed the title [EDR Workflows] CrowdStrike RunScript: Log Actions and Improve UI Output [EDR Workflows] CrowdStrike RunScript: Log Actions and UI Output Dec 16, 2024
@tomsonpl
Copy link
Copy Markdown
Contributor Author

tomsonpl commented Dec 16, 2024

/ci

@tomsonpl
Copy link
Copy Markdown
Contributor Author

tomsonpl commented Dec 16, 2024

/ci

@tomsonpl
Copy link
Copy Markdown
Contributor Author

tomsonpl commented Dec 16, 2024

/ci

@tomsonpl tomsonpl marked this pull request as ready for review December 16, 2024 17:03
@tomsonpl tomsonpl requested a review from a team as a code owner December 16, 2024 17:03
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Dec 16, 2024

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)

@tomsonpl
Merge branch 'main' into runscript-cs-logs
62a9869 
# Conflicts:
#	x-pack/solutions/security/plugins/security_solution/public/management/components/endpoint_responder/command_render_components/run_script_action.tsx
#	x-pack/solutions/security/plugins/security_solution/public/management/hooks/response_actions/use_send_run_script_endpoint_request.ts
@tomsonpl
fix
0b96a3f
szwarckonrad
szwarckonrad approved these changes Dec 17, 2024
View reviewed changes
Copy link
Copy Markdown
Contributor

@szwarckonrad szwarckonrad left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code LGTM 🚀

@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Dec 17, 2024

💚 Build Succeeded

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id before after diff
securitySolution 6412 6414 +2

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 14.7MB 14.8MB +6.6KB

History

cc @tomsonpl

@tomsonpl tomsonpl merged commit a7addba into elastic:main Dec 17, 2024
@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Dec 17, 2024

Starting backport for target branches: 8.x

https://github.com/elastic/kibana/actions/runs/12376598966

@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Dec 17, 2024

💔 All backports failed

Status Branch Result
❌ 8.x Backport failed because of merge conflicts

You might need to backport the following PRs to 8.x:
- [Discover] Fix console warning for invalid DOM property (#204417)
- [Fleet] Bump install version after removal of deprecated _source.mode… (#204471)
- [inference] Add cancelation support for chatComplete and output (#203108)
- [Security Solution][SIEM migrations] Onboarding UI improvements (#204320)
- Update data archives for SO integration tests (#204561)
- SKA: Relocate script v5.1 (#204563)
- [Search] Deprecate canDeployEntSearch config value (#204272)
- [devx] Create script to stage files by CODEOWNER (#203940)
- [ai][assistant] Refactor o11y to use new Assistant logo and beacon (#204289)
- [Security Solution] Preview navigation in document details flyout (#204292)

Manual backport

To create the backport manually run:

node scripts/backport --pr 204044

Questions ?

Please refer to the Backport tool documentation

@tomsonpl tomsonpl mentioned this pull request Dec 18, 2024
Merged
@tomsonpl
Copy link
Copy Markdown
Contributor Author

tomsonpl commented Dec 18, 2024

💚 All backports created successfully

Status Branch Result
✅ 8.x

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

tomsonpl added a commit to tomsonpl/kibana that referenced this pull request Dec 18, 2024
@tomsonpl
[EDR Workflows] CrowdStrike RunScript: Log Actions and UI Output (ela…
dccee64 
…stic#204044)

(cherry picked from commit a7addba)
tomsonpl added a commit that referenced this pull request Dec 18, 2024
@tomsonpl
[8.x] [EDR Workflows] CrowdStrike RunScript: Log Actions and UI Output (
8e8fdee 
#204044) (#204693)

# Backport

This will backport the following commits from `main` to `8.x`:
- [[EDR Workflows] CrowdStrike RunScript: Log Actions and UI Output
(#204044)](#204044)

<!--- Backport version: 8.9.8 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Tomasz
Ciecierski","email":"tomasz.ciecierski@elastic.co"},"sourceCommit":{"committedDate":"2024-12-17T15:53:03Z","message":"[EDR
Workflows] CrowdStrike RunScript: Log Actions and UI Output
(#204044)","sha":"a7addbadd394b33fa3212e57f55be251c1a3a371","branchLabelMapping":{"^v9.0.0$":"main","^v8.18.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["v9.0.0","Team:Defend
Workflows","release_note:feature","backport:version","v8.18.0"],"number":204044,"url":"https://github.com/elastic/kibana/pull/204044","mergeCommit":{"message":"[EDR
Workflows] CrowdStrike RunScript: Log Actions and UI Output
(#204044)","sha":"a7addbadd394b33fa3212e57f55be251c1a3a371"}},"sourceBranch":"main","suggestedTargetBranches":["8.x"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","labelRegex":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/204044","number":204044,"mergeCommit":{"message":"[EDR
Workflows] CrowdStrike RunScript: Log Actions and UI Output
(#204044)","sha":"a7addbadd394b33fa3212e57f55be251c1a3a371"}},{"branch":"8.x","label":"v8.18.0","labelRegex":"^v8.18.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->
@tomsonpl tomsonpl mentioned this pull request Dec 19, 2024
Closed
JoseLuisGJ pushed a commit to JoseLuisGJ/kibana that referenced this pull request Dec 19, 2024
@tomsonpl @JoseLuisGJ
[EDR Workflows] CrowdStrike RunScript: Log Actions and UI Output (ela…
143063a 
…stic#204044)
benakansara pushed a commit to benakansara/kibana that referenced this pull request Jan 2, 2025
@tomsonpl @benakansara
[EDR Workflows] CrowdStrike RunScript: Log Actions and UI Output (ela…
eb47bd7 
…stic#204044)
viduni94 pushed a commit to viduni94/kibana that referenced this pull request Jan 23, 2025
@tomsonpl @viduni94
[EDR Workflows] CrowdStrike RunScript: Log Actions and UI Output (ela…
07927cd 
…stic#204044)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@szwarckonrad szwarckonrad szwarckonrad approved these changes

@ashokaditya ashokaditya Awaiting requested review from ashokaditya

Assignees

@tomsonpl tomsonpl

Labels

backport:version Backport to applied version labels release_note:feature Makes this part of the condensed release notes Team:Defend Workflows “EDR Workflows” sub-team of Security Solution v8.18.0 v9.0.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@tomsonpl @elasticmachine @kibanamachine @szwarckonrad