Collect endpoint CPU and RAM usage via CrowdStrike RTR
Build a workflow triggered with a target host ID. Open a CrowdStrike RTR session to the endpoint, run the provided CPU/RAM collection script, and capture stdout. Parse the metrics into a structured result, close the session, handle offline hosts and RTR session failures with retries, and respect command timeouts. Output the endpoint's CPU and RAM usage.
What this prompt builds
Run a CrowdStrike Real Time Response script to grab live CPU and RAM usage from an endpoint.
The problem
During triage you often need live resource data from a specific endpoint, but reaching the machine to run diagnostics is slow and intrusive. Remote performance snapshots usually require yet another agent.
Solution and impact
This workflow uses CrowdStrike Real Time Response to run a script that collects CPU and RAM usage from a target endpoint on demand. Responders get instant performance data through the EDR they already deploy.