¶ Introduction
Real Time Responder (RTR) is a specialty role for users in CrowdStrike, this role is not assigned to any user by default & its permissions are not even found in the Falcon Admin roles. RTR allows the user to be able to remotely connect to any device in the CID that has the CrowdStrike agent installed on it.
RTR has pre-built “quick actions”, the ability to create/upload custom Command Line scripts, and for files to be placed or pulled from device. RTR can also be initiated by a custom workflows, i.e., a workflow that initiates an RTR session with a device to run a custom script to force update a piece of software.
More information about RTR can be found here:
¶ Creating the Workflow
- Login to CrowdStrike
- Next-Gen SIEM > Fusion SOAR > Workflows
- All Workflows > Create Workflow
- Specify the CID(s) if you multiple CIDs otherwise > Create workflow from scratch > Next
- Endpoint Security > ‘Audit event > RTR Session’ > Type = All > next
- Action > Send Email > Set the Subject, Message, Recipients, and Data to include > Next > Save
- Recommended 'Data to include' is: User, Hostname, Created At, Connected From, and Source to be able to get all pertinent information in a single email. This is will give you the who, when, & what machine. You'll need to audit the RTR Logs to see exactly what was done!
¶ How to Audit RTR Logs
- Go to: https://falcon.us-2.crowdstrike.com/real-time-response/sessions/audit-logs
- You can see when the session was started/ended, who initiated the session, what device was accessed, where in CrowdStrike the were able to initiate the session, what commands/scripts were used, how long the session was, and if any files were placed or pulled from the device.
