Run CrowdStrike Real Time Response commands on a host
Build a reusable workflow that accepts a CrowdStrike host ID and an RTR command/script. Initialize an RTR session on the host, execute the command (supporting default RTR scripts), poll for completion, and capture stdout/stderr. Handle offline hosts, session init failures, and command timeouts with clear errors and retries. Require approval for high-impact commands. Return the command output and execution status to the caller.
What this prompt builds
Execute a CrowdStrike RTR command against a host ID and return the output.
The problem
During an incident, responders need to run commands on an endpoint fast, but doing it through the CrowdStrike console is clunky and hard to automate or chain into larger playbooks. That friction slows containment.
Solution and impact
This workflow runs a given CrowdStrike RTR command (including default scripts) against a provided host ID and returns the result. It becomes a reusable response building block that other playbooks can call to act on endpoints instantly.