[EDR Workflows] Add runscript from Microsoft Defender for Endpoint support to Response Console by tomsonpl · Pull Request #222377 · elastic/kibana

tomsonpl · 2025-06-03T15:08:27Z

Overview

This PR adds support for custom script execution functionality in the Microsoft Defender Endpoint (MDE) response actions client, including the ability to run scripts and retrieve custom script libraries.

Previous PRs

Script's picker component: [EDR Workflows] Scripts selector component in Response Console #204965
Connector changes: [EDR Workflows] Add Microsoft Defender for Endpoint Custom scripts and runscript subactions #223085

New Features

1. Run Script Action Support

Method: runscript()
Functionality: Execute custom PowerShell and Python scripts on Microsoft Defender Endpoint agents
Parameters: Supports scriptName and optional args parameters
API Integration: Uses RUN_SCRIPT sub-action to communicate with Microsoft Defender API
Error Handling: Comprehensive error handling for API failures and missing machine action IDs

2. Custom Scripts Library Management

Method: getCustomScripts()
Functionality: Retrieve available custom scripts from Microsoft Defender's script library
API Integration: Uses GET_LIBRARY_FILES sub-action
Response Format: Transforms MDE API response to standardized CustomScriptsResponse format

3. Script Result Download Support

Methods: getFileInfo() and getFileDownload()
Functionality: Enables downloading of script execution results from MDE
Supported Actions: Currently supports runscript outputs
File Format: Downloads JSON streams containing script output
Status Tracking: Tracks file availability status (AWAITING_UPLOAD, READY)

Technical Changes

Core Implementation (`ms_defender_endpoint_actions_client.ts`)

Added runscript() method with proper parameter validation and error handling
Added getCustomScripts() method with response transformation
Enhanced processPendingActions() to handle script execution results
Fixed TypeScript interface compatibility issue between implementation and interface

Processing MDE completion (`microsoft_defender_endpoint.ts`)

Enhanced pending actions processor to download script execution results
Added special handling for runscript actions (unlike isolate/release which don't fetch results)

File Download Support (`microsoft_defender_endpoint.ts`)

Added support for downloading runscript execution results directly from Microsoft Defender Endpoint
Integrated new methods:
- getFileInfo() – retrieves metadata and checks file availability status from response documents
- getFileDownload() – streams JSON output directly from Defender’s API using readable streams
Implemented support for status tracking: AWAITING_UPLOAD, READY
Auto-generates filenames using the format: runscript-output-{machineActionId}.json

Feature Flag

Introduced microsoftDefenderEndpointRunScriptEnabled

UI

Downloaded file example:

runscript-output-3887e24e-4185-493d-a139-1cf4fa6a106c.json

How to test

Use x-pack/solutions/security/plugins/security_solution/scripts/endpoint/run_microsoft_defender_host.js to setup MDE env and generate alert
Turn on the feature flag
use runscript command through Response Console

Closes: https://github.com/elastic/security-team/issues/12318
Closes: https://github.com/elastic/security-team/issues/12350
Closes: https://github.com/elastic/security-team/issues/12319
Closes: https://github.com/elastic/security-team/issues/12320
Closes: https://github.com/elastic/security-team/issues/12417

tomsonpl · 2025-06-03T15:08:35Z

/ci

tomsonpl · 2025-06-04T13:57:13Z

/ci

tomsonpl · 2025-06-04T14:24:44Z

/ci

…-fix'

tomsonpl · 2025-06-04T15:40:35Z

/ci

…tom-scripts

tomsonpl · 2025-06-04T19:39:11Z

/ci

tomsonpl · 2025-06-05T06:54:12Z

/ci

tomsonpl · 2025-06-05T07:21:30Z

/ci

tomsonpl · 2025-06-06T09:39:52Z

.../services/actions/clients/microsoft/defender/endpoint/ms_defender_endpoint_actions_client.ts

+                );
+
+              additionalData = {
+                output: {


Note for reviewers:

this code is here as a temporary solution to help me verify if the value coming in is valid

it will be refactored in a following PR that will address showing this value as a downloadable link in the response console

possibly it won't be returned as stdout but differently - more similar to how we do it in s1

…tom-scripts

…-fix'

…tom-scripts

tomsonpl · 2025-06-17T10:16:06Z

And I think this UX might be frustrating to a user where they can't easily pick another script and have to clear out the search input in the popup.

@raqueltabuyo any opinion? I think you've played with Script picker recently, should we change the behavior to what @ashokaditya is suggesting?

ashokaditya

Thanks for the changes with the schemas. the conditional schema needs a small update besides clean up of redundant schemas and type exports. Let me know if you need help with any of it.

I tested out the flow again with windows and ubuntu and everything works as expected. I'm still not seeing an OS icon for my VMs for some reason even after several hours. Not sure if there is a issue with the alert data that is being ingested via connectors.

windows

ubuntu

ashokaditya · 2025-06-17T07:48:57Z

x-pack/solutions/security/plugins/security_solution/common/endpoint/schema/actions.test.ts

+    });
+
+    describe('Common validation', () => {
+      it('should reject when no endpoint_ids are provided', () => {


Consider using it.each for tests that should cover both MDE and Crowdstrike.

ashokaditya · 2025-06-17T08:05:06Z

...gins/security_solution/common/api/endpoint/actions/response_actions/run_script/run_script.ts

+// export type RunScriptActionRequestBody = Omit<BaseRunScriptActionRequest, 'parameters'> & {
+//   parameters:
+//   | MSDefenderRunScriptActionRequestBody['parameters']
+//   | CrowdStrikeRunScriptActionRequestBody['parameters'];
+// };


Should remove this before merging.

ashokaditya · 2025-06-17T08:26:43Z

...gins/security_solution/common/api/endpoint/actions/response_actions/run_script/run_script.ts

-            return 'At least one of Raw, HostPath, or CloudFile must be provided';
+    parameters: schema.oneOf([
+      // CrowdStrike schema
+      schema.conditional(


The conditional schema should work like a nested ternary operator

boolean condition 1 ? do something : boolean 2 ? do else : never true `.

So RunScriptActionRequestSchema should be something like this, where the next conditional check is nested within the outer one

export const RunScriptActionRequestSchema = { body: schema.object({ ...restBaseSchema, parameters: schema.oneOf([ // CrowdStrike schema schema.conditional( schema.siblingRef('agent_type'), 'crowdstrike', CrowdStrikeRunScriptActionRequestParamsSchema, schema.conditional( schema.siblingRef('agent_type'), 'microsoft_defender_endpoint', // Microsoft Defender Endpoint schema MSDefenderEndpointRunScriptActionRequestParamsSchema, schema.never() ) ), ]), }), };

ashokaditya · 2025-06-17T08:33:25Z

...gins/security_solution/common/api/endpoint/actions/response_actions/run_script/run_script.ts

+export type MSDefenderRunScriptActionRequestBody = TypeOf<
+  typeof MSDefenderEndpointRunScriptActionRequestSchema.body
+>;
+export type CrowdStrikeRunScriptActionRequestBody = TypeOf<
+  typeof CrowdStrikeRunScriptActionRequestSchema.body
+>;


I think for both MS defend and Crowdstrike you just need parameter schemas. I don't see the base schema body being used anywhere. So essentially neither CrowdStrikeRunScriptActionRequestBody or MSDefenderRunScriptActionRequestBody can be removed.

You should instead export the type for MSDefenderEndpointRunScriptActionRequestParamsSchema and replace with MSDefenderRunScriptActionRequestBody['parameters'] where ever used. Same for CrowdStrikeRunScriptActionRequestBody['parameters']

ashokaditya · 2025-06-17T08:38:29Z

x-pack/solutions/security/plugins/security_solution/common/endpoint/schema/actions.test.ts

+            },
+          });
+        }).toThrow(
+          '[parameters.1.scriptName]: expected value of type [string] but got [undefined]'


That error looks odd. I think it is because the parameters conditional check is not nested correctly.

ashokaditya · 2025-06-17T08:39:07Z

x-pack/solutions/security/plugins/security_solution/common/endpoint/schema/actions.test.ts

+            parameters: {},
+          });
+        }).toThrow(
+          '[parameters.1.scriptName]: expected value of type [string] but got [undefined]'


Same here. schema.conditonal should be nested. See my earlier comment.

ashokaditya · 2025-06-17T09:26:28Z

...gins/security_solution/common/api/endpoint/actions/response_actions/run_script/run_script.ts

+  scriptName: NonEmptyString,
+  args: schema.maybe(NonEmptyString),


You can't use the NonEmptyString schema for MDE here cause the error thrown by it is specific to CS parameter schema.

ashokaditya · 2025-06-17T09:30:10Z

x-pack/solutions/security/plugins/security_solution/common/endpoint/schema/actions.test.ts

+      it('should accept optional comment field', () => {
+        expect(() => {
+          RunScriptActionRequestSchema.body.validate({
+            endpoint_ids: ['endpoint_id'],
+            agent_type: 'crowdstrike',
+            parameters: {
+              raw: 'Get-Process',
+            },
+            comment: 'Running process enumeration',
+          });
+        }).not.toThrow();
+      });
+
+      it('should accept optional case_ids field', () => {
+        expect(() => {
+          RunScriptActionRequestSchema.body.validate({
+            endpoint_ids: ['endpoint_id'],
+            agent_type: 'crowdstrike',
+            parameters: {
+              raw: 'Get-Process',
+            },
+            case_ids: ['case-id-1', 'case-id-2'],
+          });
+        }).not.toThrow();
+      });
+
+      it('should accept optional alert_ids field', () => {


These three tests look agent specific cause of the parameters.raw or parameters.scriptName values. You can make a copy of each within the agent type specific scopes above.

Moved them to CS 👍

tomsonpl · 2025-06-17T12:36:40Z

Thanks @ashokaditya, again good comments — I applied all of them, let me know what you think 👍

ashokaditya

Thanks for all the changes! I'm approving so this can be merged after another review. Do remember to remove the redundant tests as I mentioned.

I still think that the script picker UX needs improvement and would frustrate users with its current behaviour.

ashokaditya · 2025-06-17T12:42:06Z

...gins/security_solution/common/api/endpoint/actions/response_actions/run_script/run_script.ts

-    }
-  },
-});
+const getNonEmptyString = (fieldName: string) =>


ashokaditya · 2025-06-17T12:43:42Z

...gins/security_solution/common/api/endpoint/actions/response_actions/run_script/run_script.ts

-
 // Microsoft Defender Endpoint schemas
-const MSDefenderEndpointRunScriptActionRequestParamsSchema = schema.object({
+export const MSDefenderEndpointRunScriptActionRequestParamsSchema = schema.object({


No need to rename this yet. Or rename it later when we might use a params schema for newer MDE actions.

Hmm, it was not renamed, just the export added, right?

ashokaditya · 2025-06-17T13:01:16Z

x-pack/solutions/security/plugins/security_solution/common/endpoint/schema/actions.test.ts

        endpoint_ids: ['endpoint_id'],
        agent_type: 'crowdstrike' as const,
      };
+      describe('Common fields validation', () => {


You can actually remove the entire common fields validation as it is already tested above for the base schema. Let's keep CS, MDE schema specific test in here.

Removed 👍

pmuellr

ResponseOps changes LGTM

elasticmachine · 2025-06-18T08:09:50Z

💛 Build succeeded, but was flaky

Buildkite Build
Commit: a115a5f

Failed CI Steps

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	9.4MB	9.4MB	+3.7KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
`securitySolution`	93.3KB	93.4KB	+45.0B

History

💔 Build #309596 failed 7554043
💔 Build #309497 failed 4ac616e
💔 Build #309400 failed 9c43e68
💚 Build #308845 succeeded d2eb09b

cc @tomsonpl

kibanamachine · 2025-06-18T09:35:46Z

Starting backport for target branches: 8.19

https://github.com/elastic/kibana/actions/runs/15729292273

kibanamachine · 2025-06-18T09:41:50Z

💔 All backports failed

Status	Branch	Result
❌	8.19	Backport failed because of merge conflicts

Manual backport

To create the backport manually run:

node scripts/backport --pr 222377

Questions ?

Please refer to the Backport tool documentation

tomsonpl · 2025-06-18T09:48:06Z

💚 All backports created successfully

Status	Branch	Result
✅	8.19

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

…pport to Response Console (elastic#222377) (cherry picked from commit 18f606e) # Conflicts: # x-pack/solutions/security/plugins/security_solution/common/endpoint/types/microsoft_defender_endpoint.ts # x-pack/solutions/security/plugins/security_solution/public/management/components/endpoint_responder/lib/console_commands_definition.ts # x-pack/solutions/security/plugins/security_solution/server/endpoint/services/actions/clients/crowdstrike/mocks.ts # x-pack/solutions/security/plugins/security_solution/server/endpoint/services/actions/clients/microsoft/defender/endpoint/mocks.ts # x-pack/solutions/security/plugins/security_solution/server/endpoint/services/actions/clients/microsoft/defender/endpoint/ms_defender_endpoint_actions_client.test.ts # x-pack/solutions/security/plugins/security_solution/server/endpoint/services/actions/clients/microsoft/defender/endpoint/ms_defender_endpoint_actions_client.ts

kibanamachine · 2025-06-20T09:49:01Z

Looks like this PR has a backport PR but it still hasn't been merged. Please merge it ASAP to keep the branches relatively in sync.
cc: @tomsonpl

…oint support to Response Console (#222377) (#224394)

tomsonpl added 2 commits June 3, 2025 11:49

add custom scripts

2120f49

add runscript

f4ac160

tomsonpl self-assigned this Jun 3, 2025

tomsonpl added Team:Defend Workflows “EDR Workflows” sub-team of Security Solution release_note:feature Makes this part of the condensed release notes v9.1.0 v8.19.0 labels Jun 3, 2025

tomsonpl added 3 commits June 4, 2025 12:50

fix types

a6589fc

fix types

b0ed7ae

fix types

a512883

fix

1e5bd18

[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…

c539e6e

…-fix'

tomsonpl added 2 commits June 4, 2025 21:38

fix tests

e9ea856

Merge remote-tracking branch 'origin/mde-custom-scripts' into mde-cus…

15ef33d

…tom-scripts

fix

00a3c11

fix

fb2a520

tomsonpl added 5 commits June 6, 2025 12:21

feature flag

cc33315

fix

6b9efc2

add tests

5d2f3f4

more tests

62e4191

Merge branch 'main' into mde-custom-scripts

3bbeede

tomsonpl commented Jun 6, 2025

View reviewed changes

tomsonpl marked this pull request as ready for review June 6, 2025 12:40

tomsonpl and others added 4 commits June 16, 2025 12:08

fix file download

79646a1

fix types

8ac0377

Merge remote-tracking branch 'origin/mde-custom-scripts' into mde-cus…

7f10728

…tom-scripts

[CI] Auto-commit changed files from 'node scripts/eslint --no-cache -…

af5a749

…-fix'

tomsonpl requested a review from ashokaditya June 16, 2025 12:09

tomsonpl added 2 commits June 16, 2025 15:41

fix test

12bdbe2

Merge remote-tracking branch 'origin/mde-custom-scripts' into mde-cus…

d2eb09b

…tom-scripts

ashokaditya reviewed Jun 17, 2025

View reviewed changes

apply cr comments

85874b6

ashokaditya approved these changes Jun 17, 2025

View reviewed changes

tomsonpl added 2 commits June 17, 2025 15:13

remove tests

9c43e68

Merge branch 'main' into mde-custom-scripts

4ac616e

pmuellr approved these changes Jun 17, 2025

View reviewed changes

tomsonpl added 2 commits June 17, 2025 20:31

Merge branch 'main' into mde-custom-scripts

7554043

fix test

a115a5f

tomsonpl enabled auto-merge (squash) June 18, 2025 09:34

tomsonpl merged commit 18f606e into elastic:main Jun 18, 2025
10 checks passed

tomsonpl mentioned this pull request Jun 18, 2025

[8.19] [EDR Workflows] Add runscript from Microsoft Defender for Endpoint support to Response Console (#222377) #224394

Merged

kibanamachine mentioned this pull request Jun 18, 2025

[ResponseOps][Alerting] Create a task to regenerate maintenance window events #219261

Merged

1 task

kibanamachine added the backport missing Added to PRs automatically when the are determined to be missing a backport. label Jun 20, 2025

tomsonpl added a commit that referenced this pull request Jun 23, 2025

[8.19] [EDR Workflows] Add runscript from Microsoft Defender for Endp…

843d96f

…oint support to Response Console (#222377) (#224394)

kibanamachine removed the backport missing Added to PRs automatically when the are determined to be missing a backport. label Jun 23, 2025

		scriptName: NonEmptyString,
		args: schema.maybe(NonEmptyString),

Conversation

tomsonpl commented Jun 3, 2025 • edited by kibanamachine Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Overview

Previous PRs

New Features

1. Run Script Action Support

2. Custom Scripts Library Management

3. Script Result Download Support

Technical Changes

Core Implementation (ms_defender_endpoint_actions_client.ts)

Processing MDE completion (microsoft_defender_endpoint.ts)

File Download Support (microsoft_defender_endpoint.ts)

Feature Flag

UI

Downloaded file example:

How to test

Uh oh!

tomsonpl commented Jun 3, 2025

Uh oh!

tomsonpl commented Jun 4, 2025

Uh oh!

tomsonpl commented Jun 4, 2025

Uh oh!

tomsonpl commented Jun 4, 2025

Uh oh!

tomsonpl commented Jun 4, 2025

Uh oh!

tomsonpl commented Jun 5, 2025

Uh oh!

tomsonpl commented Jun 5, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tomsonpl commented Jun 17, 2025

Uh oh!

ashokaditya left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tomsonpl commented Jun 17, 2025

Uh oh!

ashokaditya left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

pmuellr left a comment

Choose a reason for hiding this comment

Uh oh!

elasticmachine commented Jun 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

💛 Build succeeded, but was flaky

Failed CI Steps

Metrics [docs]

tomsonpl commented Jun 3, 2025 •

edited by kibanamachine

Loading

Core Implementation (`ms_defender_endpoint_actions_client.ts`)

Processing MDE completion (`microsoft_defender_endpoint.ts`)

File Download Support (`microsoft_defender_endpoint.ts`)

elasticmachine commented Jun 18, 2025 •

edited

Loading