PAPP-35103 added queue_offline session functionality for queueing com…

…mands if decice is offline
splunk-soar-connectors · Dec 4, 2024 · a806930 · a806930
1 parent 84a4d25
commit a806930
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 1 deletion.
diff --git a/crowdstrikeoauthapi.json b/crowdstrikeoauthapi.json
@@ -1779,6 +1779,12 @@
                     "contains": [
                         "crowdstrike device id"
                     ]
+                },
+                "queue_offline": {
+                    "data_type": "boolean",
+                    "description": "Queue commands for offline devices, will execute when system comes back online",
+                    "default": false,
+                    "order": 1
                 }
             },
             "output": [
@@ -1800,6 +1806,10 @@
                         "crowdstrike device id"
                     ]
                 },
+                {
+                    "data_path": "action_result.parameter.queue_offline",
+                    "data_type": "boolean"
+                },
                 {
                     "data_path": "action_result.data.*.errors",
                     "data_type": "string"

diff --git a/crowdstrikeoauthapi_connector.py b/crowdstrikeoauthapi_connector.py
@@ -1735,7 +1735,11 @@ def _handle_create_session(self, param):
         self.save_progress("In action handler for: {0}".format(self.get_action_identifier()))
         action_result = self.add_action_result(ActionResult(dict(param)))
 
-        params = {"device_id": param["device_id"], "origin": "phantom"}
+        params = {
+            "device_id": param["device_id"],
+            "origin": "phantom",
+            "queue_offline": param.get("queue_offline", False)  # default to False to maintain original behavior
+        }
 
         ret_val, resp_json = self._make_rest_call_helper_oauth2(action_result, CROWDSTRIKE_RTR_SESSION_ENDPOINT, json_data=params, method="post")