QuestionQ43Verified/Policy ApplicationCopy linkReport a problemAsk AstroTutorSave questionWhich least-privilege role should be assigned to a user who must extract files using RTR?AReal Time Responder - Active ResponderBFalcon Security LeadCFalcon InvestigatorDReal Time Responder - AdministratorShow AnswerAnswerExplanationExtracting a file through RTR uses the get command, which is an Active Responder command. The Real Time Responder - Active Responder role provides file-operation capability without the additional administrative permissions granted by the Administrator role.Learn moreCrowdStrike Developer Center — RTR Scripts permission levelsCrowdStrike Developer Center — Real Time Response APIShow comments0Show commentsCommunity DiscussionNo comments yet. Be the first to start the discussion!
Community Discussion