Scalable RTR sample Foundry app

The Scalable RTR sample Foundry app is a community-driven, open source project which serves as an example of an app which can be built using CrowdStrike's Foundry ecosystem. foundry-sample-scalable-rtr is an open source project, not a CrowdStrike product. As such, it carries no formal support, expressed or implied.

This app is one of several App Templates included in Foundry that you can use to jumpstart your development. It comes complete with a set of preconfigured capabilities aligned to its business purpose. Deploy this app from the Templates page with a single click in the Foundry UI, or create an app from this template using the CLI.

Please complete the Foundry Quickstart before deploying this sample. You can find it in Falcon under Foundry > Learn: US-1 | US-2 | EU.

Description

The Scalable RTR sample Foundry app provides a way to orchestrate the verification of files and registry keys across Windows-based systems, either by targeting specific hosts or by targeting the host groups.

This app illustrates the following functionality amongst other components:

• use of saved searches
• use of RTR script orchestration via workflows, including scheduling and recurrence
• use of UI components and extensions
• use of functions

Prerequisites

• The Foundry CLI (instructions below).
• Go v1.21+ (needed if modifying the app's functions). See https://go.dev/learn for installation instructions.
• Yarn (needed if modifying the app's UI). See https://yarnpkg.com/getting-started for installation instructions.

Install the Foundry CLI

You can install the Foundry CLI with Scoop on Windows or Homebrew on Linux/macOS.

Windows:

Install Scoop. Then, add the Foundry CLI bucket and install the Foundry CLI.

scoop bucket add foundry https://github.com/crowdstrike/scoop-foundry-cli.git
scoop install foundry

Or, you can download the latest Windows zip file, expand it, and add the install directory to your PATH environment variable.

Linux and macOS:

Install Homebrew. Then, add the Foundry CLI repository to the list of formulae that Homebrew uses and install the CLI:

brew tap crowdstrike/foundry-cli
brew install foundry

Run foundry version to verify it's installed correctly.

Getting Started

Clone this sample to your local system, or download as a zip file.

git clone https://github.com/CrowdStrike/foundry-sample-scalable-rtr
cd foundry-sample-scalable-rtr

Log in to Foundry:

foundry login

Select the following permissions:

• Run RTR Scripts
• Run, execute, and test Workflows
• Run, execute, and test API integrations
• Run, execute, and test LogScale queries
• (optional) Generate mock data to test your app

Deploy the app:

foundry apps deploy

Tip

If you get an error that the name already exists, change the name to something unique to your CID in manifest.yml.

Once the deployment has finished, you can release the app:

foundry apps release

Next, go to Foundry > App catalog, find your app, and install it. Select the Open App button in the success dialog.

Tip

If the app doesn't load, reload the page.

You should be able to create a job and save it. After the job executes, you'll receive an email with the execution information.

About this sample app

Foundry capabilities used

• Collections. Used by the app to store state information, such as metadata about created jobs, execution history, and an audit log.
• Functions. Backend business logic for invoking workflows, normalizing and aggregating data to be returned to the UI, and modifying the state of the collections.
• Queries. Query results of RTR script execution to extract metadata about on which hosts the scripts successfully executed.
• RTR scripts. Verifies files and registry keys on a target system.
• UI navigation. Adds the app to the Falcon navigation for easy access.
• UI pages. Custom UI pages to display results and manage the app.
• Workflow templates. Workflows for orchestrating the execution of the jobs against individual hosts and host groups.

Languages and frameworks used

• Functions
  • Go
  • CrowdStrike Foundry Function Go SDK (https://github.com/CrowdStrike/foundry-fn-go)
• RTR scripts
  • PowerShell
• UI
  • HTML, CSS
  • TypeScript, React

Directory structure

• collections. Schemas used in the collections used by this app.
• functions
  • Func_Jobs: Creates and updates jobs, invokes workflows, and manages the audit log.
  • job_history: Manages the job execution history.
• rtr-scripts
  • check_file_or_registry_exist: RTR script which checks if a file or registry key is present on a Windows system.
  • Check_Registry_Exist: RTR script which checks if a registry key with a specific value is present on a Windows system.
• saved-searches/Query_By_WorkflowRootExecutionID: Saved search for retrieving events by a workflow execution ID.
• ui/pages/scalable-rtr-react: Single Page Application which serves as the frontend of the app.
• workflows: Workflow template definitions. Fusion workflows are created from the templates in this directory.
  • Check_if_files_or_registry_key_exist.yml: Workflow to invoke the check_file_or_registry_exist RTR script against a collection of hosts. Results are written to LogScale.
  • Check_if_Registry_key_Value_Exist.yml: Workflow to invoke the Check_Registry_Exist RTR script against a collection of hosts. Results are written to LogScale.
  • Notify_status.yml: Workflow which notifies the job_history function to report results of the Check_if_files_or_registry_key_exist and Check_if_Registry_key_Value_Exist.yml.

Foundry resources

• Foundry documentation: US-1 | US-2 | EU
• Foundry learning resources: US-1 | US-2 | EU

---

WE STOP BREACHES