RTR session activity is viewed under Activity > Real Time Response, but the level of detail exposed depends on the RTR role. CrowdStrike documents that only users with the Real Time Response - Administrator (or Active Responder) role can see the full session details, including the upload status of files retrieved with the get command, whereas the Read-Only Analyst is limited to basic reconnaissance and does not see all session artifacts. The Administrator role sits at the top of the RTR hierarchy and can view every analyst's complete session detail, making D the role that grants full visibility. Falcon Administrator (A) is a platform-admin role that, by default, has no RTR capability at all unless an RTR role is added, so it does not qualify.
Community Discussion