Retrieving RTR audit logs programmatically

[jkozlowicz]

Hi,
I've built a flow of several commands executed sequentially on multiple hosts. I can see the history of the execution quite neatly in the CrowdStrike UI by visiting:
falcon.us-2.crowdstrike.com/real-time-response/sessions/audit-logs?info=<uuid>

I can clearly see:

• host
• all the commands executed within the session
• timestamp
• API client used

Is there a way to obtain this piece of information via the API?

I tried searching for the relevant operation in the documentation and the closest I could get is this:
https://falconpy.io/Service-Collections/Real-Time-Response-Audit.html#rtrauditsessions

but only gives me a bunch of ids and timestamps... can one of those ids be used to fetch the actual session details or am I using a completely wrong endpoint?

Thanks!

[jkozlowicz]

Found the with_command_info param, which gets me exactly what I want.

[jkozlowicz]

@jshcodes reopening, because I got stuck trying to grab command history by host_id.

I am using the /real-time-response-audit/combined/sessions/v1 endpoint, which takes a filter param.

When I try to provide the host_id param, I get 400 with the following response:

{
 "meta": {
  "query_time": 0.000537285,
  "pagination": {
   "total": 0,
   "next": ""
  },
  "powered_by": "empower-api",
  "trace_id": "<uuid>"
 },
 "resources": [],
 "errors": [
  {
   "code": 400,
   "message": "Permission denied for FQL expression 'device_id'"
  }
 ]
}

but when it does work when I provide the hostname param. That is weird, because both are in the returned response at the same nesting level in the JSON payload so I’d expect to be able to query by that too.

I don’t want to use the hostname param, because it doesn’t guarantee uniqueness.

This is the FQL filter that is failing for me:
”filter:‘<uuid>’”

[jshcodes]

Try using filter=uuid:'value' for the filter value. Does that produce results? (May not if uuid is not an allowed filter value for this operation.)

[jkozlowicz]

Sorry, I made a mistake in the comment above as the field I want to filter by is missing.

It should be {“filter”: “device_id:’<uuid>’”}, e.g.:
{“filter”: “device_id:’c2484ccf9084421aad8f375f74bc54f8’”}.

And that doesn’t work, but {“filter”: “hostname:’linux-machine-1’”} does.

Both device_id and hostname come back in the response from that endpoint.

[David-M-Berry]

Hey @jkozlowicz - try using "aid" instead of "device_id". I was testing this out in swagger and aid works.

[jkozlowicz]

@David-M-Berry yes, it does! Thank you 🙌