-
Notifications
You must be signed in to change notification settings - Fork 0
/
play_run_script.yml
62 lines (62 loc) · 2.24 KB
/
play_run_script.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
---
- hosts: localhost
connection: local
gather_facts: false
tasks:
- name: Authenticate
include_tasks: task_auth.yml
- name: Get Device
include_tasks: task_get_device.yml
vars:
token: "{{ response.json.access_token }}"
- name: Print the device
ansible.builtin.debug:
msg: "{{ device }}"
- name: Initialize a session with a device
uri:
url: "{{ CSAPIURL | default('https://api.crowdstrike.com') }}/real-time-response/entities/sessions/v1"
method: POST
headers:
accept: application/json
Authorization: "Bearer {{ response.json.access_token }}"
body_format: json
body:
device_id: "{{ device.json.resources[0] }}"
"queue_offline": true
status_code: 201
register: session
- name: Print the session
ansible.builtin.debug:
msg: "{{ session.json.resources[0].session_id }}"
- name: Get a JWT token to authenticate API requests
uri:
url: "{{ CSAPIURL | default('https://api.crowdstrike.com') }}/real-time-response/entities/admin-command/v1"
method: POST
headers:
accept: application/json
Authorization: "Bearer {{ response.json.access_token }}"
body_format: json
body:
base_command: runscript
session_id: "{{ session.json.resources[0].session_id }}"
command_string: "runscript -Raw=```{{ COMMAND }}```"
status_code: 201
register: response
- name: Print the session
ansible.builtin.debug:
msg: "{{ response }}"
#- name: Delete the session
# uri:
# url: "{{ CSAPIURL | default('https://api.crowdstrike.com') }}/real-time-response/entities/sessions/v1"
# method: DELETE
# headers:
# accept: application/json
# Authorization: "Bearer {{ response.json.access_token }}"
# body_format: json
# body:
# session_id: "{{ session.json.resources[0].session_id }}"
# status_code: 201
# register: delsession
#- name: Print the session
# ansible.builtin.debug:
# msg: "{{ delsession }}"