> ## Documentation Index
> Fetch the complete documentation index at: https://docs.blinkops.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Run Command On A Single Host

Executes a RTR active-responder command on the given host.
Note that an active session for the host is required - you can use the [Create Batch Session](https://docs.blinkops.com/docs/integrations/crowdstrike/actions/create-batch-session) action for the wanted host.
Use this endpoint to run these [real time response commands](https://falcon.crowdstrike.com/support/documentation/11/getting-started-guide#rtr_commands):

* `cat`
* `cd`
* `clear`
* `cp`
* `encrypt`
* `env`
* `eventlog`
* `filehash`
* `get`
* `getsid`
* `help`
* `history`
* `ipconfig`
* `kill`
* `ls`
* `map`
* `memdump`
* `mkdir`
* `mount`
* `mv`
* `netstat`
* `ps`
* `reg query`
* `reg set`
* `reg delete`
* `reg load`
* `reg unload`
* `restart`
* `rm`
* `runscript`
* `shutdown`
* `unmap`
* `update history`
* `update install`
* `update list`
* `update query`
* `xmemdump`
* `zip`

<Note>
  External Documentation

  To learn more, visit the [CrowdStrike documentation](https://falcon.us-2.crowdstrike.com/documentation/page/f00d6af5/real-time-response-apis#e2e7d467).
</Note>

## Parameters

<div className="integrations-table">
  | Parameter      | Description                                                                                                                                                                                                                                                                  |
  | -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
  | Base Command   | Active-Responder command type we are going to execute, for example: `get` or `cp`.<br />Refer to the [RTR documentation](https://falcon.us-2.crowdstrike.com/documentation/71/real-time-response-and-network-containment#rtr-additional-info) for the full list of commands. |
  | Command String | Command's input. For example `get some_file.txt`.                                                                                                                                                                                                                            |
  | Session ID     | The ID of the RTR Session to run the command on. You can find the Session ID in the response of the [Create Batch Session](https://docs.blinkops.com/docs/integrations/crowdstrike/actions/create-batch-session) action for the wanted host.                                 |
</div>

## Example Output

```json theme={"dark"}
{
	"meta": {
		"query_time": 1,
		"powered_by": "<string>",
		"trace_id": "<string>"
	},
	"resources": [
		{
			"session_id": "<string>",
			"cloud_request_id": "<string>",
			"queued_command_offline": false
		}
	],
	"errors": null
}
```

## Workflow Library Example

[Run Command on a Single Host with Crowdstrike and Send Results Via Email](https://library.blinkops.com/workflows/run-command-on-a-single-host-with-crowdstrike-and-send-results-via-email)

<div className="iframe-wrapper">
  <div className="iframe-media">
    <img src="https://mintcdn.com/blinkops-2/ojHYuDeYX5FWuN8a/img/Icons/play-box.svg?fit=max&auto=format&n=ojHYuDeYX5FWuN8a&q=85&s=b8af968e71438a9499c3223c9bd29fb2" alt="Workflow Library" width="16" height="16" data-path="img/Icons/play-box.svg" />

    Preview this Workflow on desktop
  </div>

  <iframe className="iframe" src="https://library.blinkops.com/workflows/run-command-on-a-single-host-with-crowdstrike-and-send-results-via-email/canvas" />
</div>