Real Time Response

Using the Real Time Response service collection

This service collection has code examples posted to the repository.

Table of Contents

Operation ID	Description
RTR_AggregateSessions PEP 8 aggregate_sessions	Get aggregates on session data.
BatchActiveResponderCmd PEP 8 batch_active_responder_command	Batch executes a RTR active-responder command across the hosts mapped to the given batch ID.
BatchCmd PEP 8 batch_command	Batch executes a RTR read-only command across the hosts mapped to the given batch ID.
BatchGetCmdStatus PEP 8 batch_get_command_status	Retrieves the status of the specified batch get command. Will return successful files when they are finished processing.
BatchGetCmd PEP 8 batch_get_command	Batch executes get command across hosts to retrieve files. After this call is made BatchGetCmdStatusis used to query for the results.
BatchInitSessions PEP 8 batch_init_sessions	Batch initialize a RTR session on multiple hosts. Before any RTR commands can be used, an active session is needed on the host.
BatchRefreshSessions PEP 8 batch_refresh_sessions	Batch refresh a RTR session on multiple hosts. RTR sessions will expire after 10 minutes unless refreshed.
RTR_CheckActiveResponderCommandStatus PEP 8 check_active_responder_command_status	Get status of an executed active-responder command on a single host.
RTR_ExecuteActiveResponderCommand PEP 8 execute_active_responder_command	Execute an active responder command on a single host.
RTR_CheckCommandStatus PEP 8 check_command_status	Get status of an executed command on a single host.
RTR_ExecuteCommand PEP 8 execute_command	Execute a command on a single host.
RTR_GetExtractedFileContents PEP 8 get_extracted_file_contents	Get RTR extracted file contents for specified session and sha256.
RTR_ListFiles PEP 8 list_files	Get a list of files for the specified RTR session.
RTR_ListFilesV2 PEP 8 list_files_v2	Get a list of files for the specified RTR session. (Expanded output detail.)
RTR_DeleteFile PEP 8 delete_file	Delete a RTR session file.
RTR_DeleteFileV2 PEP 8 delete_file_v2	Delete a RTR session file. (Expanded output detail, use with RTR_ListFilesV2.)
RTR_ListQueuedSessions PEP 8 list_queued_sessions	Get queued session metadata by session ID.
RTR_DeleteQueuedSession PEP 8 delete_queued_session	Delete a queued session command
RTR_PulseSession PEP 8 pulse_session	Refresh a session timeout on a single host.
RTR_ListSessions PEP 8 list_sessions	Get session metadata by session id.
RTR_InitSession PEP 8 init_session	Initialize a new session with the RTR cloud.
RTR_DeleteSession PEP 8 delete_session	Delete a session.
RTR_ListAllSessions PEP 8 list_all_sessions	Get a list of session_ids.

RTR_AggregateSessions

Get aggregates on session data.

PEP8 method name

aggregate_sessions

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
body			body	dictionary	Full body payload in JSON format.
date_ranges			body	list of dictionaries
field			body	string
filter			body	string	FQL syntax
interval			body	string
min_doc_count			body	integer	Minimum number of documents required to match.
missing			body	string
name			body	string
q			body	string	FQL syntax
ranges			body	list of dictionaries
size			body	integer
sort			body	string	FQL syntax
time_zone			body	string
type			body	string

Usage

Service class example (PEP8 syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

response = falcon.aggregate_sessions(date_ranges=date_ranges,
                                     field="string",
                                     filter="string",
                                     interval="string",
                                     min_doc_count=integer,
                                     missing="string",
                                     name="string",
                                     q="string",
                                     ranges=ranges,
                                     size=integer,
                                     sort="string",
                                     time_zone="string",
                                     type="string"
                                     )

print(response)

Service class example (Operation ID syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

response = falcon.RTR_AggregateSessions(date_ranges=date_ranges,
                                        field="string",
                                        filter="string",
                                        interval="string",
                                        min_doc_count=integer,
                                        missing="string",
                                        name="string",
                                        q="string",
                                        ranges=ranges,
                                        size=integer,
                                        sort="string",
                                        time_zone="string",
                                        type="string"
                                        )
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )
date_ranges = [
    {
        "from": "2021-05-15T14:55:21.892315096Z",
        "to": "2021-05-17T13:42:16.493180643Z"
    }
]

ranges = [
    {
        "From": 1,
        "To": 100
    }
]

BODY = {
    "date_ranges": date_ranges,
    "field": "string",
    "filter": "string",
    "interval": "string",
    "min_doc_count": 0,
    "missing": "string",
    "name": "string",
    "q": "string",
    "ranges": ranges,
    "size": 0,
    "sort": "string",
    "time_zone": "string",
    "type": "string"
}

response = falcon.command("RTR_AggregateSessions", body=BODY)
print(response)

BatchActiveResponderCmd

Batch executes a RTR active-responder command across the hosts mapped to the given batch ID.

PEP8 method name

batch_active_responder_command

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
body			body	dictionary	Full body payload in JSON format.
base_command			body	string	Active Responder base command to perform. For example: get or cp. Refer to this list for a complete listing of available commands.
batch_id			body	string	RTR Batch ID to execute the command against. Received from batch_init_session.
command_string			body	string	Full command line of the command to execute. Example: get some_file.txt.
host_timeout_duration			body	string	Timeout duration for how long a host has time to complete processing. Default value is a bit less than the overall timeout value. It cannot be greater than the overall request timeout. Maximum is < 10 minutes. Example, 10s. Valid units: ns, us, ms, s, m, h.
optional_hosts			body	string or list of strings	List of the subset of hosts we want to impact by this command. Allows for filtering of hosts from execution within the same batch.
persist_all			body	boolean	Flag indicating if this command should be executed when the host returns to service.
timeout			query	integer	Timeout for how long to wait for the request in seconds, default timeout is 30 seconds. Maximum is 10 minutes.
timeout_duration			query	string	Timeout duration for for how long to wait for the request in duration syntax. Example, 10s. Valid units: ns, us, ms, s, m, h. Maximum is 10 minutes.
parameters			query	dictionary	Full query string parameters payload in JSON format.

Available base commands

Command	Description	Operating System
cat	View file contents
cd	Change directory
clear	Clear the screen
cp	Copy a file
encrypt	Encrypt a file
env	Display environment variables
eventlog	Inspect the event log. Subcommands: list view export backup eventlog backup is the recommended solution as opposed to eventlog export, as this method is faster and follows industry-standard file format.
filehash	Calculate a file hash (MD5 or SHA256)
get	Retrieve a file
getsid	Retrieve the current SID
help	Access help for a specific command or sub-command
history	Review command history for the current user
ipconfig	Review TCP configuration
kill	Kill a running process
ls	List the contents of a directory
map	Map a UNC (SMB) path to a drive letter
memdump	Dump memory of a running process
mkdir	Create a directory
mount	Mount a file system (MacOS, Linux) or list available drives (Windows)
mv	Move a file
netstat	Retrieve network connection detail
ps	List running processes
reg	Registry operations. Subcommands: query - Query the registry set - Set a registry key or value delete - Delete a registry key or value load - Load a registry hive unload - Unload a registry hive
restart	Restart the system
rm	Remove a file
runscript	Run a script
shutdown	Shutdown the system
unmap	Unmap a UNC (SMB) path from a drive letter
update	Install patches through Windows Update. Subcommands: history - Check update history for this host install - Installs a patch by specifying the KB ID. 'Optional' KBs are not available. list - show all available updates for this host query - Show metadata about a specific KB
xmemdump	Dump complete memory (kernel) for the system
zip	Create a zip archive

Usage

Service class example (PEP8 syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

target_hosts = ["ID1", "ID2", "ID3"]

response = falcon.batch_active_responder_command(base_command="string",
                                                 batch_id="string",
                                                 command_string="string",
                                                 optional_hosts=target_hosts,
                                                 persist_all=boolean,
                                                 timeout=integer,
                                                 timeout_duration="string"
                                                 )
print(response)

Service class example (Operation ID syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

target_hosts = ["ID1", "ID2", "ID3"]

response = falcon.BatchActiveResponderCmd(base_command="string",
                                          batch_id="string",
                                          command_string="string",
                                          optional_hosts=target_hosts,
                                          persist_all=boolean,
                                          timeout=integer,
                                          timeout_duration="string"
                                          )
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

target_hosts = ["ID1", "ID2", "ID3"]

BODY = {
    "base_command": "string",
    "batch_id": "string",
    "command_string": "string",
    "optional_hosts": target_hosts,
    "persist_all": boolean
}

response = falcon.command("BatchActiveResponderCmd",
                          timeout=integer,
                          timeout_duration="string",
                          body=BODY
                          )
print(response)

BatchCmd

Batch executes a RTR read-only command across the hosts mapped to the given batch ID.

PEP8 method name

batch_command

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
body			body	dictionary	Full body payload in JSON format.
base_command			body	string	Active Responder base command to perform. For example: get or cp. Refer to this list for a complete listing of available commands.
batch_id			body	string	RTR Batch ID to execute the command against. Received from batch_init_session.
command_string			body	string	Full command line of the command to execute. Example: cat some_file.txt.
host_timeout_duration			body	string	Timeout duration for how long a host has time to complete processing. Default value is a bit less than the overall timeout value. It cannot be greater than the overall request timeout. Maximum is < 10 minutes. Example, 10s. Valid units: ns, us, ms, s, m, h.
optional_hosts			body	string or list of strings	List of the subset of hosts we want to impact by this command. Allows for filtering of hosts from execution within the same batch.
persist_all			body	boolean	Flag indicating if this command should be executed when the host returns to service.
timeout			query	integer	Timeout for how long to wait for the request in seconds, default timeout is 30 seconds. Maximum is 10 minutes.
timeout_duration			query	string	Timeout duration for for how long to wait for the request in duration syntax. Example, 10s. Valid units: ns, us, ms, s, m, h. Maximum is 10 minutes.
parameters			query	dictionary	Full query string parameters payload in JSON format.

Available base commands (Read only)

Command	Description	Operating System
cat	View file contents
cd	Change directory
clear	Clear the screen
csrutil	Get system integrity protection status
env	Display environment variables
eventlog	Inspect the event log. Subcommands: list view
filehash	Calculate a file hash (MD5 or SHA256)
getsid	Retrieve the current SID
help	Access help for a specific command or sub-command
history	Review command history for the current user
ipconfig	Review TCP configuration
ls	List the contents of a directory
mount	Mount a file system (MacOS, Linux) or list available drives (Windows)
netstat	Retrieve network connection detail
ps	List running processes
reg	Registry operations. Subcommands: query - Query the registry

Usage

Service class example (PEP8 syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

target_hosts = ["ID1", "ID2", "ID3"]

response = falcon.batch_command(base_command="string",
                                batch_id="string",
                                command_string="string",
                                optional_hosts=target_hosts,
                                persist_all=boolean,
                                timeout=integer,
                                timeout_duration="string"
                                )
print(response)

Service class example (Operation ID syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

target_hosts = ["ID1", "ID2", "ID3"]

response = falcon.BatchCmd(base_command="string",
                           batch_id="string",
                           command_string="string",
                           optional_hosts=target_hosts,
                           persist_all=boolean,
                           timeout=integer,
                           timeout_duration="string"
                           )
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

target_hosts = ["ID1", "ID2", "ID3"]

BODY = {
    "base_command": "string",
    "batch_id": "string",
    "command_string": "string",
    "optional_hosts": target_hosts,
    "persist_all": boolean
}

response = falcon.command("BatchCmd",
                          timeout=integer,
                          timeout_duration="string",
                          body=BODY
                          )
print(response)

BatchGetCmdStatus

Retrieves the status of the specified batch get command. Will return successful files when they are finished processing.

PEP8 method name

batch_get_command_status

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
batch_get_cmd_req_id			query	string	Batch Get Command Request ID (usually retrieved when making a call to BatchGetCmd).
parameters			query	dictionary	Full query string parameters payload in JSON format.
timeout			query	integer	Timeout for how long to wait for the request in seconds, default timeout is 30 seconds. Maximum is 10 minutes.
timeout_duration			query	string	Timeout duration for for how long to wait for the request in duration syntax. Example, 10s. Valid units: ns, us, ms, s, m, h. Maximum is 10 minutes.

Usage

Service class example (PEP8 syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

response = falcon.batch_get_command_status(timeout=integer,
                                           timeout_duration="string",
                                           batch_get_cmd_req_id="string"
                                           )
print(response)

Service class example (Operation ID syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

response = falcon.BatchGetCmdStatus(timeout=integer,
                                    timeout_duration="string",
                                    batch_get_cmd_req_id="string"
                                    )
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

response = falcon.command("BatchGetCmdStatus",
                          timeout=integer,
                          timeout_duration="string",
                          batch_get_cmd_req_id="string"
                          )
print(response)

BatchGetCmd

Batch executes a get command across hosts to retrieve files. After this call is made BatchGetCmdStatus is used to query for the results.

PEP8 method name

batch_get_command

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
body			body	dictionary	Full body payload in JSON format.
batch_id			body	string	RTR Batch ID to execute the get command against. Received from batch_init_session.
file_path			body	string	Full path to the file that is to be retrieved from each host in the batch.
host_timeout_duration			body	string	Timeout duration for how long a host has time to complete processing. Default value is a bit less than the overall timeout value. It cannot be greater than the overall request timeout. Maximum is < 10 minutes. Example, 10s. Valid units: ns, us, ms, s, m, h.
optional_hosts			body	string or list of strings	List of the subset of hosts we want to impact by this command. Allows for filtering of hosts from execution within the same batch.
parameters			query	dictionary	Full query string parameters payload in JSON format.
timeout			query	integer	Timeout for how long to wait for the request in seconds, default timeout is 30 seconds. Maximum is 10 minutes.
timeout_duration			query	string	Timeout duration for for how long to wait for the request in duration syntax. Example, 10s. Valid units: ns, us, ms, s, m, h. Maximum is 10 minutes.

Usage

Service class example (PEP8 syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

target_hosts = ["ID1", "ID2", "ID3"]

response = falcon.batch_get_command(batch_id="string",
                                    file_path="string",
                                    optional_hosts=target_hosts,
                                    timeout=integer,
                                    timeout_duration="string"
                                    )
print(response)

Service class example (Operation ID syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

target_hosts = ["ID1", "ID2", "ID3"]

response = falcon.BatchGetCmd(batch_id="string",
                              file_path="string",
                              optional_hosts=target_hosts,
                              timeout=integer,
                              timeout_duration="string"
                              )
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

target_hosts = ["ID1", "ID2", "ID3"]

BODY = {
    "batch_id": "string",
    "file_path": "string",
    "optional_hosts": target_hosts
}

response = falcon.command("BatchGetCmd",
                          timeout=integer,
                          timeout_duration="string",
                          body=BODY
                          )
print(response)

BatchInitSessions

Batch initialize a RTR session on multiple hosts. Before any RTR commands can be used, an active session is needed on the host.

PEP8 method name

batch_init_sessions

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
body			body	dictionary	Full body payload in JSON format.
existing_batch_id			body	string	Optional existing RTR batch ID. Use this to initialize new hosts and add them to the existing batch.
host_ids			body	string or list of strings	List of host agent IDs to initialize a RTR session on.
host_timeout_duration			body	string	Timeout duration for how long a host has time to complete processing. Default value is a bit less than the overall timeout value. It cannot be greater than the overall request timeout. Maximum is < 10 minutes. Example, 10s. Valid units: ns, us, ms, s, m, h.
parameters			query	dictionary	Full query string parameters payload in JSON format.
queue_offline			body	boolean	Flag indicating if the command should be queued for execution when the host returns to service.
timeout			query	integer	Timeout for how long to wait for the request in seconds, default timeout is 30 seconds. Maximum is 10 minutes.
timeout_duration			query	string	Timeout duration for for how long to wait for the request in duration syntax. Example, 10s. Valid units: ns, us, ms, s, m, h. Maximum is 10 minutes.

Usage

Service class example (PEP8 syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

target_hosts = ["ID1", "ID2", "ID3"]

response = falcon.batch_init_sessions(existing_batch_id="string",
                                      host_ids=target_hosts,
                                      queue_offline=boolean,
                                      timeout=integer,
                                      timeout_duration="string"
                                      )
print(response)

Service class example (Operation ID syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

target_hosts = ["ID1", "ID2", "ID3"]

response = falcon.BatchInitSessions(existing_batch_id="string",
                                    host_ids=target_hosts,
                                    queue_offline=boolean,
                                    timeout=integer,
                                    timeout_duration="string"
                                    )
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

target_hosts = ["ID1", "ID2", "ID3"]

BODY = {
    "existing_batch_id": "string",
    "host_ids": target_hosts,
    "queue_offline": boolean
}

response = falcon.command("BatchInitSessions",
                          timeout=integer,
                          timeout_duration="string"
                          body=BODY
                          )
print(response)

BatchRefreshSessions

Batch refresh a RTR session on multiple hosts. RTR sessions will expire after 10 minutes unless refreshed.

PEP8 method name

batch_refresh_sessions

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
body			body	dictionary	Full body payload in JSON format.
batch_id			body	string	Existing RTR batch ID to refresh.
host_to_remove			body	string or list of strings	List of host agent IDs to remove from the batch.
parameters			query	dictionary	Full query string parameters payload in JSON format.
timeout			query	integer	Timeout for how long to wait for the request in seconds, default timeout is 30 seconds. Maximum is 10 minutes.
timeout_duration			query	string	Timeout duration for for how long to wait for the request in duration syntax. Example, 10s. Valid units: ns, us, ms, s, m, h. Maximum is 10 minutes.

Usage

Service class example (PEP8 syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

remove_hosts = ["ID1", "ID2", "ID3"]

response = falcon.batch_refresh_sessions(batch_id="string",
                                         hosts_to_remove=remove_hosts,
                                         timeout=integer,
                                         timeout_duration="string"
                                         )
print(response)

Service class example (Operation ID syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

remove_hosts = ["ID1", "ID2", "ID3"]

response = falcon.BatchRefreshSessions(batch_id="string",
                                       hosts_to_remove=remove_hosts,
                                       timeout=integer,
                                       timeout_duration="string"
                                       )
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

remove_hosts = ["ID1", "ID2", "ID3"]

BODY = {
    "batch_id": "string",
    "hosts_to_remove": remove_hosts
}

response = falcon.command("BatchRefreshSessions",
                          timeout=integer,
                          timeout_duration="string",
                          body=BODY
                          )
print(response)

RTR_CheckActiveResponderCommandStatus

Get status of an executed active-responder command on a single host.

PEP8 method name

check_active_responder_command_status

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
cloud_request_id			query	string	Cloud Request ID of the executed command to query.
parameters			query	dictionary	Full query string parameters payload in JSON format.
sequence_id			query	integer	Sequence ID that we want to retrieve. Command responses are chunked across sequences.

Usage

Service class example (PEP8 syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

response = falcon.check_active_responder_command_status(cloud_request_id="string",
                                                        sequence_id=integer
                                                        )
print(response)

Service class example (Operation ID syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

response = falcon.RTR_CheckActiveResponderCommandStatus(cloud_request_id="string",
                                                        sequence_id=integer
                                                        )
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

response = falcon.command("RTR_CheckActiveResponderCommandStatus",
                          cloud_request_id="string",
                          sequence_id=integer
                          )
print(response)

RTR_ExecuteActiveResponderCommand

Execute an active responder command on a single host.

PEP8 method name

execute_active_responder_command

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
body			body	dictionary	Full body payload in JSON format.
base_command			body	string	Active Responder base command to perform. For example: get or cp. Refer to this list for a complete listing of available commands.
command_string			body	string	Full command line of the command to execute. Example: get some_file.txt.
persist			body	boolean	Flag indicating if this command should be executed when the host returns to service. Unused
session_id			body	string	RTR Session ID.

Available base commands

Command	Description	Operating System
cat	View file contents
cd	Change directory
clear	Clear the screen
cp	Copy a file
encrypt	Encrypt a file
env	Display environment variables
eventlog	Inspect the event log. Subcommands: list view export backup eventlog backup is the recommended solution as opposed to eventlog export, as this method is faster and follows industry-standard file format.
filehash	Calculate a file hash (MD5 or SHA256)
get	Retrieve a file
getsid	Retrieve the current SID
help	Access help for a specific command or sub-command
history	Review command history for the current user
ipconfig	Review TCP configuration
kill	Kill a running process
ls	List the contents of a directory
map	Map a UNC (SMB) path to a drive letter
memdump	Dump memory of a running process
mkdir	Create a directory
mount	Mount a file system (MacOS, Linux) or list available drives (Windows)
mv	Move a file
netstat	Retrieve network connection detail
ps	List running processes
reg	Registry operations. Subcommands: query - Query the registry set - Set a registry key or value delete - Delete a registry key or value load - Load a registry hive unload - Unload a registry hive
restart	Restart the system
rm	Remove a file
runscript	Run a script
shutdown	Shutdown the system
unmap	Unmap a UNC (SMB) path from a drive letter
update	Install patches through Windows Update. Subcommands: history - Check update history for this host install - Installs a patch by specifying the KB ID. 'Optional' KBs are not available. list - show all available updates for this host query - Show metadata about a specific KB
xmemdump	Dump complete memory (kernel) for the system
zip	Create a zip archive

Usage

Service class example (PEP8 syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

response = falcon.execute_active_responder_command(base_command="string",
                                                   command_string="string",
                                                   persist=boolean,
                                                   session_id="string",
                                                   timeout=integer,
                                                   timeout_duraction="string"
                                                   )
print(response)

Service class example (Operation ID syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

response = falcon.RTR_ExecuteActiveResponderCommand(base_command="string",
                                                    command_string="string",
                                                    persist=boolean,
                                                    session_id="string",
                                                    timeout=integer,
                                                    timeout_duraction="string"
                                                    )
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

BODY = {
    "base_command": "string",
    "command_string": "string",
    "persist": boolean,
    "session_id": "string"
}

response = falcon.command("RTR_ExecuteActiveResponderCommand",
                          timeout=integer,
                          timeout_duration="string",
                          body=BODY
                          )
print(response)

RTR_CheckCommandStatus

Get status of an executed command on a single host.

PEP8 method name

check_command_status

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
cloud_request_id			query	string	Cloud Request ID of the executed command to query.
parameters			query	dictionary	Full query string parameters payload in JSON format.
sequence_id			query	integer	Sequence ID that we want to retrieve. Command responses are chunked across sequences.

Usage

Service class example (PEP8 syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

response = falcon.check_command_status(cloud_request_id="string", sequence_id=integer)
print(response)

Service class example (Operation ID syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

response = falcon.RTR_CheckCommandStatus(cloud_request_id="string", sequence_id=integer)
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

response = falcon.command("RTR_CheckCommandStatus",
                          cloud_request_id="string",
                          sequence_id=integer
                          )
print(response)

RTR_ExecuteCommand

Execute a command on a single host.

PEP8 method name

execute_command

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
body			body	dictionary	Full body payload in JSON format.
base_command			body	string	Read-only base command to perform. For example: ls or ps. Refer to this list for a complete listing of available commands.
command_string			body	string	Full command line of the command to execute. Example: cat some_file.txt.
persist			body	boolean	Flag indicating if this command should be executed when the host returns to service.
session_id			body	string	RTR Session ID to execute the command against.

Available base commands (Read only)

Command	Description	Operating System
cat	View file contents
cd	Change directory
clear	Clear the screen
csrutil	Get system integrity protection status
env	Display environment variables
eventlog	Inspect the event log. Subcommands: list view
filehash	Calculate a file hash (MD5 or SHA256)
getsid	Retrieve the current SID
help	Access help for a specific command or sub-command
history	Review command history for the current user
ipconfig	Review TCP configuration
ls	List the contents of a directory
mount	Mount a file system (MacOS, Linux) or list available drives (Windows)
netstat	Retrieve network connection detail
ps	List running processes
reg	Registry operations. Subcommands: query - Query the registry

Usage

Service class example (PEP8 syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

response = falcon.execute_command(base_command="string",
                                  command_string="string",
                                  persist=boolean,
                                  session_id="string",
                                  )
print(response)

Service class example (Operation ID syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

response = falcon.RTR_ExecuteCommand(base_command="string",
                                     command_string="string",
                                     persist=boolean,
                                     session_id="string",
                                     )
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

BODY = {
  "base_command": "string",
  "command_string": "string",
  "persist": true,
  "session_id": "string"
}

response = falcon.command("RTR_ExecuteCommand", body=BODY)
print(response)

RTR_GetExtractedFileContents

Get RTR extracted file contents for specified session and sha256.

PEP8 method name

get_extracted_file_contents

Content-Type

• Produces: application/x-7z-compressed

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
parameters			query	dictionary	Full query string parameters payload in JSON format.
filename			query	string	Filename to use for the archive name and the file within the archive.
session_id			query	string	RTR Session ID.
sha256			query	string	Extracted SHA256.

Usage

Service class example (PEP8 syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

save_file = "some_file.7z"

response = falcon.get_extracted_file_contents(session_id="string",
                                              sha256="string",
                                              filename="string"
                                              )
open(save_file, 'wb').write(response)

Service class example (Operation ID syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

save_file = "some_file.7z"

response = falcon.RTR_GetExtractedFileContents(session_id="string",
                                               sha256="string",
                                               filename="string"
                                               )
open(save_file, 'wb').write(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

save_file = "some_file.7z"

response = falcon.command("RTR_GetExtractedFileContents",
                          session_id="string",
                          sha256="string",
                          filename="string"
                          )

open(save_file, 'wb').write(response)

RTR_ListFiles

Get a list of files for the specified RTR session.

PEP8 method name

list_files

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
parameters			query	dictionary	Full query string parameters payload in JSON format.
session_id			query	string	RTR Session ID.

Usage

Service class example (PEP8 syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

response = falcon.list_files(session_id="string")
print(response)

Service class example (Operation ID syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

response = falcon.RTR_ListFiles(session_id="string")
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

response = falcon.command("RTR_ListFiles", session_id="string")
print(response)

RTR_ListFilesV2

Get a list of files for the specified RTR session.

PEP8 method name

list_files_v2

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
parameters			query	dictionary	Full query string parameters payload in JSON format.
session_id			query	string	RTR Session ID.

Usage

Service class example (PEP8 syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

response = falcon.list_files_v2(session_id="string")
print(response)

Service class example (Operation ID syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

response = falcon.RTR_ListFilesV2(session_id="string")
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

response = falcon.command("RTR_ListFilesV2", session_id="string")
print(response)

RTR_DeleteFile

Delete a RTR session file.

PEP8 method name

delete_file

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
parameters			query	dictionary	Full query string parameters payload in JSON format.
ids			query	string	RTR Session file ID (SHA256).
session_id			query	string	RTR Session ID.

Usage

Service class example (PEP8 syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

response = falcon.delete_file(session_id="string", ids="string")
print(response)

Service class example (Operation ID syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

response = falcon.RTR_DeleteFile(session_id="string", ids="string")
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

response = falcon.command("RTR_DeleteFile", session_id="string", ids="string")
print(response)

RTR_DeleteFileV2

Delete a RTR session file.

PEP8 method name

delete_file_v2

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
parameters			query	dictionary	Full query string parameters payload in JSON format.
ids			query	string	RTR Session file ID (SHA256).
session_id			query	string	RTR Session ID.

Usage

Service class example (PEP8 syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

response = falcon.delete_file_v2(session_id="string", ids="string")
print(response)

Service class example (Operation ID syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

response = falcon.RTR_DeleteFileV2(session_id="string", ids="string")
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

response = falcon.command("RTR_DeleteFileV2", session_id="string", ids="string")
print(response)

RTR_ListQueuedSessions

Get queued session metadata by session ID.

PEP8 method name

list_queued_sessions

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
body			body	dictionary	Full body payload in JSON format.
ids			body	string or list of strings	List of RTR sessions to retrieve. Will only return sessions created by the calling user.

Usage

Service class example (PEP8 syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

id_list = "ID1,ID2,ID3"  # Can also use a list here ['ID1','ID2','ID3']

response = falcon.list_queued_sessions(ids=id_list)
print(response)

Service class example (Operation ID syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

id_list = "ID1,ID2,ID3"  # Can also use a list here ['ID1','ID2','ID3']

response = falcon.RTR_ListQueuedSessions(ids=id_list)
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = ['ID1','ID2','ID3']

BODY = {
  "ids": id_list
}

response = falcon.command("RTR_ListQueuedSessions", body=BODY)
print(response)

RTR_DeleteQueuedSession

Delete a queued session command

PEP8 method name

delete_queued_session

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
cloud_request_id			query	string	Cloud Request ID of the executed command to query.
parameters			query	dictionary	Full query string parameters payload in JSON format.
session_id			query	string	RTR Session ID.

Usage

Service class example (PEP8 syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

response = falcon.delete_queued_session(session_id="string", cloud_request_id="string")
print(response)

Service class example (Operation ID syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

response = falcon.RTR_DeleteQueuedSession(session_id="string", cloud_request_id="string")
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

response = falcon.command("RTR_DeleteQueuedSession",
                          session_id="string",
                          cloud_request_id="string"
                          )
print(response)

RTR_PulseSession

Refresh a session timeout on a single host.

PEP8 method name

pulse_session

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
body			body	dictionary	Full body payload in JSON format.
device_id			body	string	The host agent ID to refresh the RTR session on. RTR will retrieve an existing session for the calling user on this host.
origin			body	string	Origin of the request.
queue_offline			body	boolean	Flag indicating if this should be queued to pulse after the host returns to service.

Usage

Service class example (PEP8 syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

response = falcon.pulse_session(device_id="string",
                                origin="string",
                                queue_offline=boolean
                                )
print(response)

Service class example (Operation ID syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

response = falcon.RTR_PulseSession(device_id="string",
                                   origin="string",
                                   queue_offline=boolean
                                   )
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

BODY = {
  "device_id": "string",
  "origin": "string",
  "queue_offline": boolean
}

response = falcon.command("RTR_PulseSession", body=BODY)
print(response)

RTR_ListSessions

Get session metadata by session id.

PEP8 method name

list_sessions

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
body			body	dictionary	Full body payload in JSON format.
ids			body	string or list of strings	List of RTR sessions to retrieve. Will only return sessions created by the calling user.

Usage

Service class example (PEP8 syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

id_list = "ID1,ID2,ID3"  # Can also use a list here ['ID1','ID2','ID3']

response = falcon.list_sessions(ids=id_list)
print(response)

Service class example (Operation ID syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

id_list = "ID1,ID2,ID3"  # Can also use a list here ['ID1','ID2','ID3']

response = falcon.RTR_ListSessions(ids=id_list)
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

id_list = ['ID1','ID2','ID3']

BODY = {
  "ids": id_list
}

response = falcon.command("RTR_ListSessions", body=BODY)
print(response)

RTR_InitSession

Initialize a new session with the RTR cloud.

PEP8 method name

init_session

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
body			body	dictionary	Full body payload in JSON format.
device_id			body	string	The host agent ID to refresh the RTR session on. RTR will retrieve an existing session for the calling user on this host.
origin			body	string	Origin of the request.
queue_offline			body	boolean	Flag indicating if this should be queued to pulse after the host returns to service.

Usage

Service class example (PEP8 syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

response = falcon.init_session(device_id="string",
                               origin="string",
                               queue_offline=boolean
                               )
print(response)

Service class example (Operation ID syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

response = falcon.RTR_InitSession(device_id="string",
                                  origin="string",
                                  queue_offline=boolean
                                  )
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

BODY = {
  "device_id": "string",
  "origin": "string",
  "queue_offline": boolean
}

response = falcon.command("RTR_InitSession", body=BODY)
print(response)

RTR_DeleteSession

Delete a session.

PEP8 method name

delete_session

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
parameters			query	dictionary	Full query string parameters payload in JSON format.
session_id			query	string	RTR Session ID.

Usage

Service class example (PEP8 syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

response = falcon.delete_session(session_id="string")
print(response)

Service class example (Operation ID syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

response = falcon.RTR_DeleteSession(session_id="string")
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

response = falcon.command("RTR_DeleteSession", session_id="string")
print(response)

RTR_ListAllSessions

Get a list of session_ids.

You will only be able to retrieve sessions that were created using the same API credentials.

PEP8 method name

list_all_sessions

Content-Type

• Produces: application/json

Keyword Arguments

Name	Service	Uber	Type	Data type	Description
filter			query	string	FQL query expression that should be used to limit the results. user_id can accept a special value ‘@me’ which will restrict results to records with current user’s ID.
limit			query	integer	Maximum number of records to return. Max: 5000.
offset			query	string	Starting index of overall result set from which to return ids.
sort			query	string	The property to sort by.
parameters			query	dictionary	Full query string parameters payload in JSON format.

Usage

Service class example (PEP8 syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

response = falcon.list_all_sessions(offset="string",
                                    limit=integer,
                                    sort="string",
                                    filter="string"
                                    )
print(response)

Service class example (Operation ID syntax)

from falconpy import RealTimeResponse

falcon = RealTimeResponse(client_id="API_CLIENT_ID_HERE",
                          client_secret="API_CLIENT_SECRET_HERE"
                          )

response = falcon.RTR_ListAllSessions(offset="string",
                                      limit=integer,
                                      sort="string",
                                      filter="string"
                                      )
print(response)

Uber class example

from falconpy import APIHarness

falcon = APIHarness(client_id="API_CLIENT_ID_HERE",
                    client_secret="API_CLIENT_SECRET_HERE"
                    )

response = falcon.command("RTR_ListAllSessions",
                          offset="string",
                          limit=integer,
                          sort="string",
                          filter="string"
                          )
print(response)