Update README and option descriptions

polarityio · Oct 30, 2024 · 62cfd00 · 62cfd00
1 parent cc2f121
commit 62cfd00
Show file tree

Hide file tree

Showing 3 changed files with 30 additions and 10 deletions.
diff --git a/README.md b/README.md
@@ -23,7 +23,8 @@ Before using the Polarity CrowdStrike Integration you will need to create a Clie
 | Detections       | Read        | Required to search detections                                                                                                                  |
 | Hosts            | Read, Write | Read access is required to search hosts by IP Address. Write permission is required if the "Allow Containment Status Change" option is checked |
 | IOC Manager APIs | Read        | Required if the "Search CrowdStrike IOCs" option is enabled                                                                                    | 
-| Workflow         | Read, Write | Required for execution of On-Demand Playbooks                                                                                                  | 
+| Real time response (admin) | Write | Required to fetch RTR Script Information                                                                                                       |
+ | Real time response | Read | Required to execute RTR scripts                                                                                                        
 
 6. Click `Add`. Record the Client ID and Client Secret (Client secret will only be shown once for security purpose, so make sure to store it in a secure place).
 
@@ -67,6 +68,25 @@ If checked, the integration will search IOCs detected in your environment. IOCs
 ### Allow Containment Status Change
 If checked, users will be able to change the Containment Status of Devices via the integration. The provided API key must have 'Read' and 'Write' access to the 'Hosts' scope for this option to work.
 
+### Enable Real Time Response
+If checked, users will be able to connect to hosts and run commands, and Custom and Falcon Real Time Response scripts.
+
+### Enabled Real Time Response Commands
+Comma delimited list of enabled RTR commands by command name.  Listed commands must be accessible to the configured Client ID. Command names are case-sensitive. The `Enable Real Time Response` option must be checked for this setting to have an effect. This setting must be locked for all users.
+
+### Enabled Falcon Real Time Response Scripts
+Comma delimited list of enabled Falcon scripts by script name.  Listed Falcon scripts must be accessible to the configured Client ID. Script names are case-sensitive. The `Enable Real Time Response` option must be checked for this setting to have an effect.  This setting must be locked for all users.
+
+Default Value:
+
+```
+LocalUser, RegisteredAV, PowerShellEnv, Monitor, LocalGroup, LastBootUpTime, FirewallRule, EventSource, EventLog, BitLocker, FileInfo, ScheduledTask, Service, SSID, Printer, NetworkShare, Process, RegistryKey, Prefetch, InstalledProgram
+```
+
+### Enabled Custom Real Time Response Scripts
+Comma delimited list of enabled Custom scripts by script name. Listed Custom scripts must be accessible to the configured Client ID. Script names are case-sensitive. The `Enable Real Time Response` option must be checked for this setting to have an effect. This setting must be locked for all users.
+
+
 ### Max Concurrent Search Requests
 Maximum number of concurrent search requests (defaults to 20). Integration must be restarted after changing this option.
 

diff --git a/config/config.js b/config/config.js
@@ -95,7 +95,7 @@ module.exports = {
       key: 'enableRealTimeResponse',
       name: 'Enable Real Time Response',
       description:
-        'If checked, users will be able to connect to hosts and run custom and Falcon Real Time Response scripts.',
+        'If checked, users will be able to connect to hosts and run commands, and Custom and Falcon Real Time Response scripts.',
       default: false,
       type: 'boolean',
       userCanEdit: false,
@@ -105,7 +105,7 @@ module.exports = {
       key: 'enabledCommands',
       name: 'Enabled Real Time Response Commands',
       description:
-        'Comma delimited list of enabled RTR commands by command name.  Listed commands must be accessible to the configured Client ID. Command names are case sensitive. The `Enable Real Time Response` option must be checked for this setting to have an effect. This setting must be locked for all users.',
+        'Comma delimited list of enabled RTR commands by command name.  Listed commands must be accessible to the configured Client ID. Command names are case-sensitive. The `Enable Real Time Response` option must be checked for this setting to have an effect. This setting must be locked for all users.',
       default: 'cat, cd, env, getsid, ipconfig, ls, netstat, ps',
       type: 'text',
       userCanEdit: false,
@@ -115,7 +115,7 @@ module.exports = {
       key: 'enabledFalconScripts',
       name: 'Enabled Falcon Real Time Response Scripts',
       description:
-        'Comma delimited list of enabled Falcon scripts by script name.  Listed Falcon scripts must be accessible to the configured Client ID. Script names are case sensitive. The `Enable Real Time Response` option must be checked for this setting to have an effect.  This setting must be locked for all users.',
+        'Comma delimited list of enabled Falcon scripts by script name.  Listed Falcon scripts must be accessible to the configured Client ID. Script names are case-sensitive. The `Enable Real Time Response` option must be checked for this setting to have an effect.  This setting must be locked for all users.',
       default:
         'LocalUser, RegisteredAV, PowerShellEnv, Monitor, LocalGroup, LastBootUpTime, FirewallRule, EventSource, EventLog, BitLocker, FileInfo, ScheduledTask, Service, SSID, Printer, NetworkShare, Process, RegistryKey, Prefetch, InstalledProgram',
       type: 'text',
@@ -126,7 +126,7 @@ module.exports = {
       key: 'enabledCustomScripts',
       name: 'Enabled Custom Real Time Response Scripts',
       description:
-        'Comma delimited list of enabled Custom scripts by script name. Listed Custom scripts must be accessible to the configured Client ID. Script names are case sensitive. The `Enable Real Time Response` option must be checked for this setting to have an effect. This setting must be locked for all users.',
+        'Comma delimited list of enabled Custom scripts by script name. Listed Custom scripts must be accessible to the configured Client ID. Script names are case-sensitive. The `Enable Real Time Response` option must be checked for this setting to have an effect. This setting must be locked for all users.',
       default: '',
       type: 'text',
       userCanEdit: false,
@@ -230,4 +230,4 @@ module.exports = {
       adminOnly: true
     }
   ]
-};
+};
diff --git a/config/config.json b/config/config.json
@@ -96,7 +96,7 @@
     {
       "key": "enableRealTimeResponse",
       "name": "Enable Real Time Response",
-      "description": "If checked, users will be able to connect to hosts and run custom and Falcon Real Time Response scripts.",
+      "description": "If checked, users will be able to connect to hosts and run commands, and Custom and Falcon Real Time Response scripts.",
       "default": false,
       "type": "boolean",
       "userCanEdit": false,
@@ -105,7 +105,7 @@
     {
       "key": "enabledCommands",
       "name": "Enabled Real Time Response Commands",
-      "description": "Comma delimited list of enabled RTR commands by command name.  Listed commands must be accessible to the configured Client ID. Command names are case sensitive. The `Enable Real Time Response` option must be checked for this setting to have an effect. This setting must be locked for all users.",
+      "description": "Comma delimited list of enabled RTR commands by command name.  Listed commands must be accessible to the configured Client ID. Command names are case-sensitive. The `Enable Real Time Response` option must be checked for this setting to have an effect. This setting must be locked for all users.",
       "default": "cat, cd, env, getsid, ipconfig, ls, netstat, ps",
       "type": "text",
       "userCanEdit": false,
@@ -114,7 +114,7 @@
     {
       "key": "enabledFalconScripts",
       "name": "Enabled Falcon Real Time Response Scripts",
-      "description": "Comma delimited list of enabled Falcon scripts by script name.  Listed Falcon scripts must be accessible to the configured Client ID. Script names are case sensitive. The `Enable Real Time Response` option must be checked for this setting to have an effect.  This setting must be locked for all users.",
+      "description": "Comma delimited list of enabled Falcon scripts by script name.  Listed Falcon scripts must be accessible to the configured Client ID. Script names are case-sensitive. The `Enable Real Time Response` option must be checked for this setting to have an effect.  This setting must be locked for all users.",
       "default": "LocalUser, RegisteredAV, PowerShellEnv, Monitor, LocalGroup, LastBootUpTime, FirewallRule, EventSource, EventLog, BitLocker, FileInfo, ScheduledTask, Service, SSID, Printer, NetworkShare, Process, RegistryKey, Prefetch, InstalledProgram",
       "type": "text",
       "userCanEdit": false,
@@ -123,7 +123,7 @@
     {
       "key": "enabledCustomScripts",
       "name": "Enabled Custom Real Time Response Scripts",
-      "description": "Comma delimited list of enabled Custom scripts by script name. Listed Custom scripts must be accessible to the configured Client ID. Script names are case sensitive. The `Enable Real Time Response` option must be checked for this setting to have an effect. This setting must be locked for all users.",
+      "description": "Comma delimited list of enabled Custom scripts by script name. Listed Custom scripts must be accessible to the configured Client ID. Script names are case-sensitive. The `Enable Real Time Response` option must be checked for this setting to have an effect. This setting must be locked for all users.",
       "default": "",
       "type": "text",
       "userCanEdit": false,