The "Real Time Responder – Read Only Analyst" role is specifically designed for this purpose. It grants access to the Real Time Response (RTR) feature, allowing an analyst to connect to a host and run commands to view files and system information (e.g., ls, cat, ps). Crucially, this role restricts access to commands that could alter the host or exfiltrate data, such as the get command, which is used to retrieve files. This perfectly aligns with the CISO's requirement to view file contents locally without taking them off the host.

A. Remediation Manager: This role is for performing active remediation tasks like network containment or killing processes, not for read-only investigation of file contents.

C. Falcon Analyst – Read Only: This role provides read-only access to the Falcon user interface (detections, hosts, etc.) but does not grant access to the Real Time Response feature required to interact with a host.

D. Real Time Responder – Active Responder: This role provides full RTR access, including the get command, which would allow the analyst to take files off the host, violating the CISO's specific constraint.

1. CrowdStrike Falcon Documentation

"Host and User Management

" Section: Falcon User Roles. This document details the permissions for each predefined role. It specifies that the "Real Time Responder – Read Only Analyst" role grants access to a limited set of non-destructive RTR commands

explicitly excluding get

put

and runscript. In contrast

the "Real Time Responder – Active Responder" role has access to the full command set.

2. CrowdStrike

"Real Time Response: Available Commands and Access

" Falcon Product Guide

Rev. B

pg. 112-114. This section outlines the command sets available to different RTR roles. It confirms that the read-only role can use commands like cat to view file contents but is blocked from using the get command

which is reserved for the Active Responder role.