The "QuickAction - Run Command on CrowdStrike Host" workflow template streamlines endpoint management by enabling users to execute common commands on a host associated with a case using CrowdStrike Real Time Response. This workflow enhances device and user compliance and bolsters Endpoint Detection and Response (EDR) capabilities. It efficiently collects command outputs and appends them as notes to the case, ensuring comprehensive documentation and facilitating swift incident resolution.
Use Cases
Device \u0026 User Compliance , Endpoint Detection and Response (EDR) , Function
Workflow Breakdown
Query the user for commands to be executed (options include netstat, ps, mount, ipconfig, env)
The device ID is extracted from the corresponding case or it can be provided in the user query
An RTR session is created and the device queried to check its online state
The commands given are iterated over and the results collected
The results are added as a note to the case
Vendors
Utils, HTTP, CrowdStrike, Torq Cases