Batch executes a RTR active-responder command across the hosts mapped to the given batch ID.

The following permission is required to run this action:

  • Real Time Response: Write access OR RTR Active Responder role.

External Documentation

To learn more, visit the CrowdStrike documentation.

​
Parameters

ParameterDescription
Base CommandActive-Responder command type we are going to execute, for example: get or cp.Refer to the RTR documentation for the full list of commands.
Batch IDThe ID of the batch to run the command on. You can find the batch ID in the response of the Create Batch Session action.
Command StringCommand’s input. For example get some_file.txt.

​
Example Output

{
	"meta": {
		"query_time": 6.029080792,
		"powered_by": "empower-api",
		"trace_id": "1234567-1234-1234-12345-1234567"
	},
	"combined": {
		"resources": {
			"12345678912345678913245678": {
				"session_id": "1234-1234-1234-1234-1234",
				"task_id": "5555555-555-555-234-312456",
				"complete": true,
				"stdout": "",
				"stderr": "",
				"base_command": "runscript",
				"aid": "1234567891234567892345678",
				"errors": [],
				"query_time": 6.027706742,
				"offline_queued": false
			}
		}
	},
	"errors": []
}

​
Workflow Library Example

Run Command on Batch Session with Crowdstrike and Send Results Via Email

Workflow Library

Preview this Workflow on desktop

Was this page helpful?