@gillesvilleneuve/crowdstrike-falcon/src/actions/rtr/initialize-session.ts

CrowdStrike Falcon integration for Active Pieces with incident management, host isolation, and real-time response capabilities

import { createAction, Property } from '@activepieces/pieces-framework';
import { makeAuthenticatedApiCall, formatErrorResponse, validateRequiredParams } from '../../common/utils';
import { API_ENDPOINTS } from '../../common/constants';

/**
 * Action to initialize a Real-Time Response (RTR) session in CrowdStrike
 */
export const initializeRtrSession = createAction({
  name: 'initialize_rtr_session',
  displayName: 'Initialize RTR Session',
  description: 'Initialize a new Real-Time Response session with a host',
  
  props: {
    device_id: Property.ShortText({
      displayName: 'Device ID',
      description: 'CrowdStrike device ID to establish an RTR session with',
      required: true,
    }),
    queue_offline: Property.Checkbox({
      displayName: 'Queue Offline',
      description: 'Queue command for offline device',
      required: false,
      defaultValue: false,
    }),
  },
  
  async run(context) {
    try {
      const { auth, propsValue } = context;
      
      // Validate required parameters
      validateRequiredParams(propsValue, ['device_id']);
      
      // Make API call to initialize RTR session
      const response = await makeAuthenticatedApiCall(
        auth,
        API_ENDPOINTS.RTR_SESSION_INIT,
        'POST',
        {
          device_id: propsValue.device_id,
          queue_offline: propsValue.queue_offline || false,
        }
      );
      
      // Check if session was created successfully
      if (!response.resources || response.resources.length === 0) {
        throw new Error('Failed to initialize RTR session');
      }
      
      const session = response.resources[0];
      
      return {
        success: true,
        session_id: session.session_id,
        device_id: propsValue.device_id,
        created_at: session.created_at,
        session_details: session,
      };
    } catch (error) {
      return formatErrorResponse(error);
    }
  },
});