@gillesvilleneuve/crowdstrike-falcon/src/actions/rtr/get-file-contents.ts

CrowdStrike Falcon integration for Active Pieces with incident management, host isolation, and real-time response capabilities

import { createAction, Property } from '@activepieces/pieces-framework';
import { makeAuthenticatedApiCall, formatErrorResponse, validateRequiredParams } from '../../common/utils';
import { API_ENDPOINTS } from '../../common/constants';

/**
 * Action to get file contents from a Real-Time Response session in CrowdStrike
 */
export const getRtrFileContents = createAction({
  name: 'get_rtr_file_contents',
  displayName: 'Get RTR File Contents',
  description: 'Retrieve file contents extracted during a Real-Time Response session',
  
  props: {
    session_id: Property.ShortText({
      displayName: 'Session ID',
      description: 'RTR session ID',
      required: true,
    }),
    sha256: Property.ShortText({
      displayName: 'SHA256',
      description: 'SHA256 hash of the file to retrieve',
      required: true,
    }),
    filename: Property.ShortText({
      displayName: 'Filename',
      description: 'Name of the file to retrieve',
      required: false,
    }),
  },
  
  async run(context) {
    try {
      const { auth, propsValue } = context;
      
      // Validate required parameters
      validateRequiredParams(propsValue, ['session_id', 'sha256']);
      
      // Make API call to get file contents
      const response = await makeAuthenticatedApiCall(
        auth,
        API_ENDPOINTS.RTR_FILE_GET,
        'GET',
        undefined,
        {
          session_id: propsValue.session_id,
          sha256: propsValue.sha256,
          filename: propsValue.filename || '',
        }
      );
      
      return {
        success: true,
        session_id: propsValue.session_id,
        sha256: propsValue.sha256,
        filename: propsValue.filename,
        file_contents: response.resources || [],
      };
    } catch (error) {
      return formatErrorResponse(error);
    }
  },
});