Run Command On Batch Session - BlinkOps Documentation

Batch executes a RTR active-responder command across the hosts mapped to the given batch ID. The following permission is required to run this action:

Real Time Response: Write access OR RTR Active Responder role.

External DocumentationTo learn more, visit the CrowdStrike documentation.

Parameters

Parameter	Description
Base Command	Active-Responder command type we are going to execute, for example: `get` or `cp`. Refer to the RTR documentation for the full list of commands.
Batch ID	The ID of the batch to run the command on. You can find the batch ID in the response of the `Create Batch Session` action.
Command String	Command’s input. For example `get some_file.txt`.

Example Output

{
	"meta": {
		"query_time": 2,
		"powered_by": "<string>",
		"trace_id": "<string>"
	},
	"combined": {
		"resources": {
			"9be1424f2c8545f39d8bc28896a0cc75": {
				"session_id": "<string>",
				"complete": false,
				"stdout": "<string>",
				"stderr": "<string>",
				"aid": "<string>",
				"errors": [
					{
						"code": 68638,
						"message": "<string>"
					}
				],
				"query_time": 2,
				"offline_queued": false
			}
		}
	},
	"errors": []
}

Workflow Library Example

Run Command on Batch Session with Crowdstrike and Send Results Via Email

Preview this Workflow on desktop

Run Command On A Single Host Schedule YARA Hunt

⌘I

​Parameters

​Example Output

​Workflow Library Example

Parameters

Example Output

Workflow Library Example