cortex XDR run_script and execute_commands

cancel
Showing results for 
Search instead for 
Did you mean: 

cortex XDR run_script and execute_commands

L0 Member

I've being testing some of the built in scripts that come with cortex.  i.e the #list_directories and #file_exists are working nicely.

Im having difficulty using similar parameters running the execute_commands script.

example of list_directories which works:

data='{"request_data":{"filters":[{"field":"endpoint_id_list","operator":"in","value":["REDACTED"]}],"script_uid":"REDACTED","parameters_values":{"path":"/Users/","number_of_levels":1}}}'

 

So on the server side, the script takes in the two parameters:
def run(path, number_of_levels):

and we get the expected results back successfully

 

for the execute_commands script. Im using:
data='{"request_data":{"filters":[{"field":"endpoint_id_list","operator":"in","value":["REDACTED"]}],"script_uid":"REDACTED","parameters_values":{"commands_list":["pwd","ls"]}}}'

 

On the server side I see the function takes in a list, and runs through a for loop on it:
def run(commands_list):
result = {}
for command in commands_list:

 

although the error returned shows:
{'reply': {'err_code': 500, 'err_msg': 'Got an invalid input while processing XDR public API', 'err_extra': 'commands_list must be of type: str'}}

 

I've tested the actual function on my own laptop, and it does work fine when passing it a list of commands:

i.e
Screenshot 2021-04-22 at 09.24.29.png

 

 

If anyone has any pointers, thanks

 

 

1 REPLY 1

L0 Member

passing in different parameters Im finding that if I pass in a list:

"parameters_values":{"commands_list":["ls"]}
{'err_code': 500,
'err_extra': 'commands_list must be of type: str',
'err_msg': 'Got an invalid input while processing XDR public API'}}
Although if I pass in as a string:
"parameters_values":{"commands_list":"ls"}

It does get though to the function, but then gets split apart into "l" and "s" in the function:

Output:

'standard_output': 'Running command <l>\n'
'stderr: \n'
'/bin/sh: l: command not found\n'
'\n'
'Running command <s>\n'
'stderr: \n'
'/bin/sh: s: command not found\n'}],
 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!