RTR_ListFiles returns 403 access denied

[TaihouKai]

My API Client has the following permissions recently assigned:

• Hosts - Read
• RTR - Read
• RTRAdmin - Write

And I executed hosts.query_devices_by_filter, hosts.get_online_state, hosts.get_device_details, rtr.init_session, rtr_admin.execute_admin_command, etc normally, but when I try to use rtr.RTR_ListFiles, it returns:

{'status_code': 403, 'headers': {'Server': 'nginx', 'Date': 'Wed, 18 Jan 2023 06:27:19 GMT', 'Content-Type': 'applicatio
n/json', 'Content-Length': '231', 'Connection': 'keep-alive', 'X-Content-Type-Options': 'nosniff', 'X-Cs-Traceid': '2d53
fc91-5660-4d30-8ef8-eebcdc6868c7', 'X-Ratelimit-Limit': '15', 'X-Ratelimit-Remaining': '14', 'Strict-Transport-Security'
: 'max-age=31536000; includeSubDomains'}, 'body': {'meta': {'query_time': 2.16e-07, 'powered_by': 'crowdstrike-api-gatew
ay', 'trace_id': '2d53fc91-5660-4d30-8ef8-eebcdc6868c7'}, 'errors': [{'code': 403, 'message': 'access denied, authorizat
ion failed'}]}}

Is it because RTR_ListFiles need write privilege? I don't quite understand why is that so, because it does not write anything to the host.

[jshcodes]

Hi @TalhouKai -

This feels a little counterintuitive, but you will need RTR - Write in order to use RTR_ListFiles.

This matches the permission required to PUT files.

From a generic perspective, permissions should loosely map to roles as follows:

Role	Scope	Permissions
RTR Investigator	Real Time Response	READ
RTR Active Responder	Real Time Response	WRITE
RTR Administrator	Real Time Response Admin	WRITE

Thank you for the question! 😄

[TaihouKai]

Thank you very much for your answer!