cortex XDR run_script and execute_commands

cheesy_dibbles — Thu, 22 Apr 2021 08:26:29 GMT

I've being testing some of the built in scripts that come with cortex. i.e the #list_directories and #file_exists are working nicely.

Im having difficulty using similar parameters running the execute_commands script.

example of list_directories which works:

data='{"request_data":{"filters":[{"field":"endpoint_id_list","operator":"in","value":["REDACTED"]}],"script_uid":"REDACTED","parameters_values":{"path":"/Users/","number_of_levels":1}}}'

So on the server side, the script takes in the two parameters:
def run(path, number_of_levels):

and we get the expected results back successfully

for the execute_commands script. Im using:
data='{"request_data":{"filters":[{"field":"endpoint_id_list","operator":"in","value":["REDACTED"]}],"script_uid":"REDACTED","parameters_values":{"commands_list":["pwd","ls"]}}}'

On the server side I see the function takes in a list, and runs through a for loop on it:
def run(commands_list):
result = {}
for command in commands_list:

although the error returned shows:
{'reply': {'err_code': 500, 'err_msg': 'Got an invalid input while processing XDR public API', 'err_extra': 'commands_list must be of type: str'}}

I've tested the actual function on my own laptop, and it does work fine when passing it a list of commands:

i.e

If anyone has any pointers, thanks

Re: cortex XDR run_script and execute_commands

cheesy_dibbles — Thu, 22 Apr 2021 14:38:59 GMT

passing in different parameters Im finding that if I pass in a list:

"parameters_values":{"commands_list":["ls"]}
{'err_code': 500,
'err_extra': 'commands_list must be of type: str',
'err_msg': 'Got an invalid input while processing XDR public API'}}
Although if I pass in as a string:
"parameters_values":{"commands_list":"ls"}

It does get though to the function, but then gets split apart into "l" and "s" in the function:

Output:

'standard_output': 'Running command <l>\n'
'stderr: \n'
'/bin/sh: l: command not found\n'
'\n'
'Running command <s>\n'
'stderr: \n'
'/bin/sh: s: command not found\n'}],

topic cortex XDR run_script and execute_commands in Automation/API Discussions

cortex XDR run_script and execute_commands

Re: cortex XDR run_script and execute_commands