[EDR Workflows] Add RunScript API route (supporting CrowdStrike) #203101

tomsonpl · 2024-12-05T13:26:21Z

Summary

This PR introduces support for the CrowdStrike runscript API route. Below are detailed highlights of the changes.

Key Changes

Introduced runscript route at /api/endpoint//action/run_script
Currently runscript is only enabled for CrowdStrike hosts
Validated and ensured type safety for the following parameters:
- --Raw
- --HostPath
- --CloudFile
- --CommandLine
- --Timeout

Previous Steps

Next Steps

Connector changes to execute runscript on CrowdStrike host
CrowdStrike Actions Client changes to save Action and Responses
UI Results Component for Response Console
Get and display CloudFiles (custom scripts)
Document examples of adding new commands and agent integrations.

tomsonpl · 2024-12-05T13:26:27Z

/ci

tomsonpl · 2024-12-05T14:09:46Z

/ci

tomsonpl · 2024-12-05T15:28:57Z

/ci

tomsonpl · 2024-12-06T11:50:43Z

/ci

tomsonpl · 2024-12-06T13:35:29Z

/ci

tomsonpl · 2024-12-09T10:28:58Z

/ci

elasticmachine · 2024-12-09T14:55:21Z

Pinging @elastic/security-defend-workflows (Team:Defend Workflows)

szwarckonrad

I’ve reviewed the code but will leave the design/implementation review to Paul since I’m not too familiar with the response actions part of our codebase. Overall, it looks good -I’ve left some comments for you to consider.

szwarckonrad · 2024-12-10T08:30:38Z

...gins/security_solution/common/api/endpoint/actions/response_actions/run_script/run_script.ts

+          schema.string({
+            minLength: 1,
+            validate: (value) => {
+              if (!value.trim().length) {
+                return 'Raw cannot be an empty string';
+              }
+            },
+          })


nit: extract to const nullableNonEmptyString = schema.maybe(schema.string...). We have those defined in multiple places too, maybe try looking for existing one

szwarckonrad · 2024-12-10T08:34:00Z

...ent/components/endpoint_responder/lib/integration_tests/console_commands_definition.test.tsx

@@ -73,7 +74,9 @@ describe('When displaying Endpoint Response Actions', () => {
        HELP_GROUPS.responseActions.label
      );

-      const expectedCommands: string[] = [...CONSOLE_RESPONSE_ACTION_COMMANDS];
+      const expectedCommands: string[] = [
+        ...CONSOLE_RESPONSE_ACTION_COMMANDS.filter((command) => command !== 'runscript'),


filter returns new array, I don`t see the need to spread

szwarckonrad · 2024-12-10T08:39:49Z

...gins/security_solution/common/api/endpoint/actions/response_actions/run_script/run_script.ts

+        /**
+         * The script to run
+         */
+        Raw: schema.maybe(


I believe the other side expects properties with capital letters, but that’s not how we handle things. Since this endpoint is maintained by us, I’d suggest sticking to our standards and introducing a mapper or transformation to align with the standards of the next API we’ll be calling.

szwarckonrad · 2024-12-10T08:41:41Z

...lution/public/management/components/endpoint_responder/lib/endpoint_action_response_codes.ts

@@ -299,6 +299,13 @@ const CODES = Object.freeze({
    'xpack.securitySolution.endpointActionResponseCodes.scan.success',
    { defaultMessage: 'Scan complete' }
  ),
+
+  // Dev:
+  // runscript success/competed


Suggested change

// runscript success/competed

// runscript success/completed

# Conflicts: # x-pack/plugins/security_solution/common/endpoint/data_generators/endpoint_action_generator.ts # x-pack/plugins/security_solution/public/management/components/endpoint_responder/lib/integration_tests/console_commands_definition.test.tsx # x-pack/plugins/security_solution/public/management/cypress/screens/responder.ts # x-pack/plugins/security_solution/server/endpoint/services/actions/action_list.test.ts

tomsonpl · 2024-12-10T16:12:18Z

@szwarckonrad thanks for the review, I applied all the suggestions - besides the CapitalCase change to lowerCase in API params. We discussed this offline and it would be requiring transformations multiple times to reflect CrowdStrike UI and API, eg. UI Capital > Kibana API camel > CS Capital.

For now we decided to go with the CapitalCase. Hope this is fine 👍

tomsonpl · 2024-12-10T16:15:34Z

/ci

elasticmachine · 2024-12-10T18:36:13Z

💚 Build Succeeded

Buildkite Build
Commit: 15ff68d

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	14.7MB	14.7MB	-12.0B

Unknown metric groups

References to deprecated APIs

id	before	after	diff
`securitySolution`	463	464	+1

History

💔 Build #258873 failed 1189441
💚 Build #258683 succeeded 0bccfe2
💔 Build #258615 failed 9977e5a
💔 Build #258383 failed fc956df
💔 Build #258301 failed 02d1cae
💔 Build #258138 failed 5c9873e

cc @tomsonpl

kibanamachine · 2024-12-11T08:19:17Z

Starting backport for target branches: 8.x

https://github.com/elastic/kibana/actions/runs/12272304321

kibanamachine · 2024-12-11T08:24:13Z

💔 All backports failed

Status	Branch	Result
❌	8.x	Backport failed because of merge conflicts

Manual backport

To create the backport manually run:

node scripts/backport --pr 203101

Questions ?

Please refer to the Backport tool documentation

tomsonpl · 2024-12-11T08:56:58Z

💚 All backports created successfully

Status	Branch	Result
✅	8.x

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

…stic#203101) (cherry picked from commit e993f23) # Conflicts: # x-pack/plugins/security_solution/server/endpoint/routes/actions/response_actions.ts

kibanamachine · 2024-12-12T08:49:09Z

Looks like this PR has a backport PR but it still hasn't been merged. Please merge it ASAP to keep the branches relatively in sync.

…stic#203101)

kibanamachine · 2024-12-13T09:48:40Z

Looks like this PR has a backport PR but it still hasn't been merged. Please merge it ASAP to keep the branches relatively in sync.

#203101) (#203722) # Backport This will backport the following commits from `main` to `8.x`: - [[EDR Workflows] Add RunScript API route (supporting CrowdStrike) (#203101)](#203101)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport)

added route and schemas

3d3625d

tomsonpl added Team:Defend Workflows “EDR Workflows” sub-team of Security Solution release_note:feature Makes this part of the condensed release notes backport:version Backport to applied version labels v8.18.0 labels Dec 5, 2024

tomsonpl self-assigned this Dec 5, 2024

tomsonpl mentioned this pull request Dec 5, 2024

[EDR Workflows] Add CrowdStrike runscript API and Refactor Response Actions API for Extensibility #202198

Closed

fix types

46b3bd0

fix types

7986c13

fix tests

d0cec6e

runscript test fix

c27d8cc

tomsonpl added 2 commits December 9, 2024 11:28

fix cypress test

47d92e9

Merge branch 'main' into runscript-cs-api

5c9873e

fix test

02d1cae

tomsonpl marked this pull request as ready for review December 9, 2024 14:55

tomsonpl requested review from a team as code owners December 9, 2024 14:55

tomsonpl requested review from pzl and parkiino December 9, 2024 14:55

tomsonpl requested review from szwarckonrad and paul-tavares and removed request for pzl and parkiino December 9, 2024 15:00

fix

fc956df

szwarckonrad approved these changes Dec 10, 2024

View reviewed changes

tomsonpl added 5 commits December 10, 2024 11:11

fix test

9977e5a

fix

0bccfe2

fix

824baca

fix

1189441

fix

15ff68d

tomsonpl merged commit e993f23 into elastic:main Dec 11, 2024
8 checks passed

kibanamachine added the v9.0.0 label Dec 11, 2024

tomsonpl mentioned this pull request Dec 11, 2024

[8.x] [EDR Workflows] Add RunScript API route (supporting CrowdStrike) (#203101) #203722

Merged

tomsonpl mentioned this pull request Dec 11, 2024

[EDR Workflows] CrowdStrike RTR connector's sub actions #203420

Merged

3 tasks

kibanamachine added the backport missing Added to PRs automatically when the are determined to be missing a backport. label Dec 12, 2024

CAWilson94 pushed a commit to CAWilson94/kibana that referenced this pull request Dec 12, 2024

[EDR Workflows] Add RunScript API route (supporting CrowdStrike) (ela…

b861985

…stic#203101)

kibanamachine removed the backport missing Added to PRs automatically when the are determined to be missing a backport. label Dec 13, 2024

This was referenced Dec 16, 2024

[EDR Workflows] CrowdStrike RunScript: Log Actions and UI Output #204044

Merged

[Request] Crowdstrike additional third-party response actions elastic/security-docs#6365

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[EDR Workflows] Add RunScript API route (supporting CrowdStrike) #203101

[EDR Workflows] Add RunScript API route (supporting CrowdStrike) #203101

tomsonpl commented Dec 5, 2024 •

edited

Loading

tomsonpl commented Dec 5, 2024

tomsonpl commented Dec 5, 2024

tomsonpl commented Dec 5, 2024

tomsonpl commented Dec 6, 2024

tomsonpl commented Dec 6, 2024

tomsonpl commented Dec 9, 2024

elasticmachine commented Dec 9, 2024

szwarckonrad left a comment

szwarckonrad Dec 10, 2024

szwarckonrad Dec 10, 2024

szwarckonrad Dec 10, 2024

szwarckonrad Dec 10, 2024

tomsonpl commented Dec 10, 2024

tomsonpl commented Dec 10, 2024

elasticmachine commented Dec 10, 2024

References to deprecated APIs

kibanamachine commented Dec 11, 2024

kibanamachine commented Dec 11, 2024

tomsonpl commented Dec 11, 2024

kibanamachine commented Dec 12, 2024

kibanamachine commented Dec 13, 2024

[EDR Workflows] Add RunScript API route (supporting CrowdStrike) #203101

[EDR Workflows] Add RunScript API route (supporting CrowdStrike) #203101

Conversation

tomsonpl commented Dec 5, 2024 • edited Loading

Summary

Key Changes

Previous Steps

Next Steps

tomsonpl commented Dec 5, 2024

tomsonpl commented Dec 5, 2024

tomsonpl commented Dec 5, 2024

tomsonpl commented Dec 6, 2024

tomsonpl commented Dec 6, 2024

tomsonpl commented Dec 9, 2024

elasticmachine commented Dec 9, 2024

szwarckonrad left a comment

Choose a reason for hiding this comment

szwarckonrad Dec 10, 2024

Choose a reason for hiding this comment

szwarckonrad Dec 10, 2024

Choose a reason for hiding this comment

szwarckonrad Dec 10, 2024

Choose a reason for hiding this comment

szwarckonrad Dec 10, 2024

Choose a reason for hiding this comment

tomsonpl commented Dec 10, 2024

tomsonpl commented Dec 10, 2024

elasticmachine commented Dec 10, 2024

💚 Build Succeeded

Metrics [docs]

Async chunks

References to deprecated APIs

History

kibanamachine commented Dec 11, 2024

kibanamachine commented Dec 11, 2024

💔 All backports failed

Manual backport

Questions ?

tomsonpl commented Dec 11, 2024

💚 All backports created successfully

Questions ?

kibanamachine commented Dec 12, 2024

kibanamachine commented Dec 13, 2024

tomsonpl commented Dec 5, 2024 •

edited

Loading