Recent RTR Sessions

# --- Query Metadata ---
# Human-readable name for the query. Will be displayed as the title.
name: Recent RTR Sessions

# Description of what the query does and its purpose.
description: List of the recent Real Time Response sessions that were started.

# The author or team that created the query.
author: CrowdStrike

# The required log sources to run this query successfully in Next-Gen SIEM.
# This will be displayed in the UI to inform the user.
log_sources:
  - Endpoint

# The CrowdStrike modules required to run this query.
cs_required_modules:
  - Insight

# Tags for filtering and categorization.
# Include relevant techniques, tactics, or platforms.
tags:
  - Monitoring

# --- Query Content ---
# The actual CrowdStrike Query Language (CQL) code.
# Using the YAML block scalar `|` allows for multi-line strings.
cql: |
  // Get RTR Start events
  #repo=detections #event_simpleName=Event_RemoteResponseSessionStartEvent
  
  // Rename Agent ID value
  | rename(field="AgentIdString", as="aid")
  
  // Display results in table
  | table([StartTimestamp, UserName, aid], limit=20000)
  
  // Bring in data from AID Master lookup file
  | aid=~match(file="aid_master_main.csv", column=[aid], strict=false)
  
  // Convert timestamp to human-readable value
  | formatTime(format="%F %T %Z", as=StartTimestamp, field=StartTimestamp)