[Jan 28] Adds new runscript Crowdstrike response action

docs/management/admin/response-actions.asciidoc

@@ -192,6 +192,25 @@ Example: `scan --path "/Users/username/Downloads" --comment "Scan Downloads fold
 
 NOTE: Scanning can take longer for directories containing a lot of files.
 
+[discrete]
+[[runscript]]
+=== `runscript`
+
+Run a script on a host. You must include one of the following parameters to identify the script you want to run:
+
+* `--Raw`: The full script content provided directly as a string.
+* `--CloudFile`: The name of the script stored in a cloud storage location.
+* `--HostPath`: The absolute or relative file path of the script located on the host machine.
+
+You can also use these optional parameters:
+
+* `--CommandLine`: Additional command-line arguments passed to the script to customize its execution.
+* `--Timeout`: The maximum duration, in seconds, that the script can run before it's forcibly stopped. If no timeout is specified, it defaults to 60 seconds.
+
+Required privilege: **Execute Operations**
+
+Example: `runscript --CloudFile="CloudScript1.ps1" --CommandLine="-Verbose true" --Timeout=180` 
+
 [discrete]
 [[supporting-commands-parameters]]
 == Supporting commands and parameters

docs/management/admin/third-party-actions.asciidoc

@@ -35,6 +35,8 @@ These response actions are supported for CrowdStrike-enrolled hosts:
 +
 Refer to the instructions on <<isolate-a-host,isolating>> and <<release-a-host,releasing>> hosts for more details.
 
+* **Run a script on a host** with the <<runscript,`runscript` response action>>.
+
 [discrete]
 [[sentinelone-response-actions]]
 == SentinelOne response actions

docs/serverless/endpoint-response-actions/response-actions.asciidoc

@@ -241,6 +241,27 @@ Example: `scan --path "/Users/username/Downloads" --comment "Scan Downloads fold
 Scanning can take longer for directories containing a lot of files.
 ====
 
+[discrete]
+[[runscript]]
+=== `runscript`
+
+Run a script on a host. You must include one of the following parameters to identify the script you want to run:
+
+* `--Raw`: The full script content provided directly as a string.
+* `--CloudFile`: The name of the script stored in a cloud storage location.
+* `--HostPath`: The absolute or relative file path of the script located on the host machine.
+
+You can also use these optional parameters:
+
+* `--CommandLine`: Additional command-line arguments passed to the script to customize its execution.
+* `--Timeout`: The maximum duration, in seconds, that the script can run before it's forcibly stopped. If no timeout is specified, it defaults to 60 seconds.
+
+Predefined role: **Tier 3 analyst**, **SOC manager**, or **Endpoint operations analyst**
+
+Custom role privilege: **Execute Operations**
+
+Example: `runscript --CloudFile="CloudScript1.ps1" --CommandLine="-Verbose true" --Timeout=180` 
+
 [discrete]
 [[supporting-commands-parameters]]
 == Supporting commands and parameters

docs/serverless/endpoint-response-actions/third-party-actions.asciidoc

@@ -44,6 +44,8 @@ These response actions are supported for CrowdStrike-enrolled hosts:
 +
 Refer to the instructions on <<isolate-a-host,isolating>> and <<release-a-host,releasing>> hosts for more details.
 
+* **Run a script on a host** with the <<runscript,`runscript` response action>>.
+
 ++++
   </div>
   <div tabindex="0" role="tabpanel" id="endpoint-response-actions-third-party-actions-sentinelone-panel" aria-labelledby="endpoint-response-actions-third-party-actions-sentinelone-button" hidden="">