Skip to content

Document external EDR script picker for CrowdStrike in serverless #1650

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Jun 11, 2025
Merged

Document external EDR script picker for CrowdStrike in serverless #1650

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
97a3d36
Document external EDR script picker for CrodwStrike in serverless
natasha-moore-elastic Jun 9, 2025
8b834c9
Add runscript API priv
natasha-moore-elastic Jun 10, 2025
c6107bf
clarifies access
natasha-moore-elastic Jun 11, 2025
50ef0ae
Merge branch 'main' into issue-1498-script-picker-cwd
natasha-moore-elastic Jun 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions solutions/security/endpoint-response-actions.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -252,6 +252,9 @@ Run a script on a host. You must include one of the following parameters to iden

* `--Raw`: The full script content provided directly as a string.
* `--CloudFile`: The name of the script stored in a cloud storage location.

{applies_to}`serverless: ga` When using this parameter, select from a list of saved custom scripts.

* `--HostPath`: The absolute or relative file path of the script located on the host machine.

You can also use these optional parameters:
Expand Down
4 changes: 3 additions & 1 deletion ...ns/security/endpoint-response-actions/configure-third-party-response-actions.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,9 @@ Expand a section below for your endpoint security system:

* Give the API client the minimum privilege required to read CrowdStrike data and perform actions on enrolled hosts. Consider creating separate API clients for reading data and performing actions, to limit privileges allowed by each API client.

* To isolate and release hosts, the API client must have `Read` access for Alerts, and `Read` and `Write` access for Hosts.
* To isolate and release hosts: `Read` access for `Alerts`, and `Read` and `Write` access for `Hosts`.

* To run a script on a host: `Read` and `Write` access for `Real time response`, and `Write` access for `Real time response (admin)`.

* Take note of the client ID, client secret, and base URL; you’ll need them in later steps when you configure {{elastic-sec}} components to access CrowdStrike.
* The base URL varies depending on your CrowdStrike account type:
Expand Down
Loading