Skip to content

Latest commit

 

History

History
148 lines (104 loc) · 6.44 KB

README.md

File metadata and controls

148 lines (104 loc) · 6.44 KB
Raw

CrowdStrike Falcon

Rapid Response sample Foundry app

The Rapid Response sample Foundry app is a community-driven, open source project which serves as an example of an app which can be built using CrowdStrike's Foundry ecosystem. foundry-sample-rapid-response is an open source project, not a CrowdStrike product. As such, it carries no formal support, expressed or implied.

This app is one of several App Templates included in Foundry that you can use to jumpstart your development. It comes complete with a set of preconfigured capabilities aligned to its business purpose. Deploy this app from the Templates page with a single click in the Foundry UI, or create an app from this template using the CLI.

Description

The Rapid Response sample Foundry app provides a way to orchestrate execution of executables and removal of files across Windows-based systems, either by targeting specific hosts or by targeting the host groups.

This app illustrates the following functionality amongst other components:

  • use of saved searches
  • use of RTR script orchestration via workflows, including scheduling
  • use of UI components and extensions
  • use of file uploads
  • use of functions

Prerequisites

Install the Foundry CLI

You can install the Foundry CLI with Scoop on Windows or Homebrew on Linux/macOS.

Windows:

Install Scoop. Then, add the Foundry CLI bucket and install the Foundry CLI.

scoop bucket add foundry https://github.com/crowdstrike/scoop-foundry-cli.git
scoop install foundry

Or, you can download the latest Windows zip file, expand it, and add the install directory to your PATH environment variable.

Linux and macOS:

Install Homebrew. Then, add the Foundry CLI repository to the list of formulae that Homebrew uses and install the CLI:

brew tap crowdstrike/foundry-cli
brew install foundry

Run foundry version to verify it's installed correctly.

Getting Started

Clone this sample to your local system, or download as a zip file.

git clone https://github.com/CrowdStrike/foundry-sample-rapid-response
cd foundry-sample-rapid-response

Log in to Foundry:

foundry login

Select the following permissions:

  • Run RTR Scripts
  • Run, execute, and test Workflows
  • Run, execute, and test API integrations
  • Run, execute, and test LogScale queries
  • (optional) Generate mock data to test your app

Deploy the app:

foundry apps deploy

Tip

If you get an error that the name already exists, change the name to something unique to your CID in manifest.yml.

Once the deployment has finished, you can release the app:

foundry apps release

Next, go to Foundry > App catalog, find your app, and install it. Select the Open App button in the success dialog.

Tip

If the app doesn't load, reload the page.

You should be able to create a job and save it.

About this sample app

Foundry capabilities used

  • Collections. Used by the app to store state information, such as metadata about created jobs, execution history, and an audit log.
  • Functions. Backend business logic for invoking workflows, normalizing and aggregating data to be returned to the UI, and modifying the state of the collections.
  • Queries. Query results of RTR script execution to extract metadata about on which hosts the scripts successfully executed.
  • RTR scripts. Executes executables on a target system. Removes files from a targeted system.
  • UI navigation. Adds the app to the Falcon navigation for easy access.
  • UI pages. Custom UI pages to display results and manage the app.
  • Workflow templates. Workflows for orchestrating the execution of the jobs against individual hosts and host groups.

Languages and frameworks used

Directory structure

  • collections. Schemas used in the collections used by this app.
  • functions
    • Func_Jobs: Creates and updates jobs, invokes workflows, and manages the audit log.
    • job_history: Manages the job execution history.
  • rtr-scripts
    • check_file_exist: RTR script which checks if an executable or file is present on a Windows system.
    • remove_file: RTR script which removes a file or executable if the file is present on a Windows system.
  • saved-searches/Query_By_WorkflowRootExecutionID: Saved search for retrieving events by a workflow execution ID.
  • ui/pages/rapid-response-react: Single Page Application which serves as the frontend of the app.
  • workflows: Workflow template definitions. Fusion workflows are created from the templates in this directory.
    • Install_software_Job_Template.yml: Workflow to upload and invoke an executable via RTR on hosts. Results are written to LogScale.
    • Notify_job_execution_template.yml: Workflow which notifies the job_history function to report results of the Install_software_Job_Template and Remove_file_template.yml.
    • Remove_file_template.yml: Workflow to remove files from targeted hosts. Results are written to LogScale.

Foundry resources


WE STOP BREACHES