Best way to get contents of a file with RTR

[Emarples]

Hi!
I'm trying to transition my team from using the GUI to RTR and download windows event logs, to doing through the API to speed up the process. We have a script that writes the logs onto a file on the host, but I'm having trouble getting them from there. I've tried the get command and even though it succeeded I'm not sure how to actually download the file without the GUI. That leaves me with the following questions.

1. how does using the get command work with the API and is there anyway to download the file after running it (without using the CS GUI)?

2. If that's not possible, do you have any suggestions for getting the contents of a file on a host through the RTR API?

Any help is greatly appreciated, thanks!

[jshcodes]

Hi @Emarples!

1. Get retrieves the file off of the host and stores it within the CrowdStrike cloud for retrieval. An example of how to use this functionality can be found in the "PID dump" sample located here.

2. You should be able to download the file, but if you are just interested in retrieving the contents of the file, you could try something similar to what is performed in the My Little RTR example.

Check these out and let us know if there are any questions! 😃

[Emarples]

Awesome, thank you!!