Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[EDR Workflows] CrowdStrike RunScript: Log Actions and UI Output #204044

Merged
merged 18 commits into from
Dec 17, 2024
Merged

[EDR Workflows] CrowdStrike RunScript: Log Actions and UI Output #204044

merged 18 commits into from
Dec 17, 2024

Conversation

tomsonpl
Copy link
Contributor

@tomsonpl tomsonpl commented Dec 12, 2024 •
edited by kibanamachine
Loading

Summary

This PR enhances CrowdStrike RTR functionality by refining command support, improving the UI, and aligning with CrowdStrike prerequisites for handling runscript commands.

Key Changes

  • Save Action and Response:

    • Added functionality to save both actions and responses for CrowdStrike RTR commands and display them in the UI.

  • Fix --Raw Parameter Handling:

    • Updated the --Raw parameter to accept both "string" and ```multi-line strings enclosed in triple backticks```, as required by CrowdStrike for scripts with more than one word.

  • Adjust RTR Subaction:

    • Enhanced the RTR subaction to support additional commands in the future.

  • UI Output for runscript:

    • Integrated ExecuteActionHostResponse as the output component for the runscript command, which meets current requirements effectively.

  • History Log:

    • Updated the logic to include runscript results in the history log for better traceability.

  • Removed overwriteUrl Flag:

    • Removed the overwriteUrl functionality since it is safer to always use the admin permissions URL for the runscript command.

  • Rename API Parameters:

    • Renamed API parameters from CapitalCase to camelCase - thanks @szwarckonrad for making the suggestion:
      • Raw → raw
      • CloudFile → cloudFile
      • HostPath → hostPath
      • CommandLine → commandLine
      • Timeout → timeout

UI

Zrzut ekranu 2024-12-16 o 11 40 39 Zrzut ekranu 2024-12-16 o 11 44 58

Previous Steps

Next Steps

  • Integrate the dropdown functionality and fetch CloudFiles (custom scripts) in the Response Console input.
  • Continue to extend support for additional RTR commands.
  • Update documentation to reflect these changes and include examples.

@tomsonpl tomsonpl added Team:Defend Workflows “EDR Workflows” sub-team of Security Solution release_note:feature Makes this part of the condensed release notes backport:version Backport to applied version labels v8.18.0 labels Dec 12, 2024
@tomsonpl tomsonpl self-assigned this Dec 12, 2024
@tomsonpl
Copy link
Contributor Author

/ci

@tomsonpl tomsonpl changed the title [EDR Workflows] [WIP] CrowdStrike RunScript logs and output [EDR Workflows] CrowdStrike RunScript: Log Actions and Improve UI Output Dec 16, 2024
@tomsonpl tomsonpl changed the title [EDR Workflows] CrowdStrike RunScript: Log Actions and Improve UI Output [EDR Workflows] CrowdStrike RunScript: Log Actions and UI Output Dec 16, 2024
@tomsonpl
Copy link
Contributor Author

/ci

@tomsonpl
Copy link
Contributor Author

/ci

@tomsonpl
Copy link
Contributor Author

/ci

@tomsonpl tomsonpl marked this pull request as ready for review December 16, 2024 17:03
@tomsonpl tomsonpl requested a review from a team as a code owner December 16, 2024 17:03
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)

@tomsonpl
Merge branch 'main' into runscript-cs-logs
62a9869 
# Conflicts:
#	x-pack/solutions/security/plugins/security_solution/public/management/components/endpoint_responder/command_render_components/run_script_action.tsx
#	x-pack/solutions/security/plugins/security_solution/public/management/hooks/response_actions/use_send_run_script_endpoint_request.ts
@tomsonpl
fix
0b96a3f
szwarckonrad
szwarckonrad approved these changes Dec 17, 2024
View reviewed changes
Copy link
Contributor

@szwarckonrad szwarckonrad left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code LGTM 🚀

@elasticmachine
Copy link
Contributor

💚 Build Succeeded

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id before after diff
securitySolution 6412 6414 +2

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 14.7MB 14.8MB +6.6KB

History

cc @tomsonpl

@tomsonpl tomsonpl merged commit a7addba into elastic:main Dec 17, 2024
8 checks passed
@kibanamachine
Copy link
Contributor

Starting backport for target branches: 8.x

https://github.com/elastic/kibana/actions/runs/12376598966

@kibanamachine
Copy link
Contributor

💔 All backports failed

Status Branch Result
❌ 8.x Backport failed because of merge conflicts

You might need to backport the following PRs to 8.x:
- [Discover] Fix console warning for invalid DOM property (#204417)
- [Fleet] Bump install version after removal of deprecated _source.mode… (#204471)
- [inference] Add cancelation support for chatComplete and output (#203108)
- [Security Solution][SIEM migrations] Onboarding UI improvements (#204320)
- Update data archives for SO integration tests (#204561)
- SKA: Relocate script v5.1 (#204563)
- [Search] Deprecate canDeployEntSearch config value (#204272)
- [devx] Create script to stage files by CODEOWNER (#203940)
- [ai][assistant] Refactor o11y to use new Assistant logo and beacon (#204289)
- [Security Solution] Preview navigation in document details flyout (#204292)

Manual backport

To create the backport manually run:

node scripts/backport --pr 204044

Questions ?

Please refer to the Backport tool documentation

@tomsonpl tomsonpl mentioned this pull request Dec 18, 2024
Merged
@tomsonpl
Copy link
Contributor Author

💚 All backports created successfully

Status Branch Result
✅ 8.x

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

tomsonpl added a commit to tomsonpl/kibana that referenced this pull request Dec 18, 2024
@tomsonpl
[EDR Workflows] CrowdStrike RunScript: Log Actions and UI Output (ela…
dccee64 
…stic#204044)

(cherry picked from commit a7addba)
tomsonpl added a commit that referenced this pull request Dec 18, 2024
@tomsonpl
[8.x] [EDR Workflows] CrowdStrike RunScript: Log Actions and UI Output (
8e8fdee 
#204044) (#204693)

# Backport

This will backport the following commits from `main` to `8.x`:
- [[EDR Workflows] CrowdStrike RunScript: Log Actions and UI Output
(#204044)](#204044)

<!--- Backport version: 8.9.8 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Tomasz
Ciecierski","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-12-17T15:53:03Z","message":"[EDR
Workflows] CrowdStrike RunScript: Log Actions and UI Output
(#204044)","sha":"a7addbadd394b33fa3212e57f55be251c1a3a371","branchLabelMapping":{"^v9.0.0$":"main","^v8.18.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["v9.0.0","Team:Defend
Workflows","release_note:feature","backport:version","v8.18.0"],"number":204044,"url":"https://github.com/elastic/kibana/pull/204044","mergeCommit":{"message":"[EDR
Workflows] CrowdStrike RunScript: Log Actions and UI Output
(#204044)","sha":"a7addbadd394b33fa3212e57f55be251c1a3a371"}},"sourceBranch":"main","suggestedTargetBranches":["8.x"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","labelRegex":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/204044","number":204044,"mergeCommit":{"message":"[EDR
Workflows] CrowdStrike RunScript: Log Actions and UI Output
(#204044)","sha":"a7addbadd394b33fa3212e57f55be251c1a3a371"}},{"branch":"8.x","label":"v8.18.0","labelRegex":"^v8.18.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->
@tomsonpl tomsonpl mentioned this pull request Dec 19, 2024
Open
JoseLuisGJ pushed a commit to JoseLuisGJ/kibana that referenced this pull request Dec 19, 2024
@tomsonpl @JoseLuisGJ
[EDR Workflows] CrowdStrike RunScript: Log Actions and UI Output (ela…
143063a 
…stic#204044)
benakansara pushed a commit to benakansara/kibana that referenced this pull request Jan 2, 2025
@tomsonpl @benakansara
[EDR Workflows] CrowdStrike RunScript: Log Actions and UI Output (ela…
eb47bd7 
…stic#204044)
CAWilson94 pushed a commit to CAWilson94/kibana that referenced this pull request Jan 13, 2025
@tomsonpl @CAWilson94
[EDR Workflows] CrowdStrike RunScript: Log Actions and UI Output (ela…
e22e0e9 
…stic#204044)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@szwarckonrad szwarckonrad szwarckonrad approved these changes

@ashokaditya ashokaditya Awaiting requested review from ashokaditya

Assignees

@tomsonpl tomsonpl

Labels
backport:version Backport to applied version labels release_note:feature Makes this part of the condensed release notes Team:Defend Workflows “EDR Workflows” sub-team of Security Solution v8.18.0 v9.0.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@tomsonpl @elasticmachine @kibanamachine @szwarckonrad