[Request] Response Console external EDR scripts picker

[tomsonpl]

Description

What:
With 9.1 we introduce support to picking saved custom scripts from the list - for now just for External EDR -Crowdstrike. Work on MS Defender support will start today as well, which is the top priority now.
Why:
This will enable users access scripts list and choose from it instead of writing manually.
How:
In Response console with specific actions we support adding a SelectorArgument component that renders additional pickers in popovers.
In this particular example when user uses runscript command, and after they use --CloudFile (for Crowdstrike) the popover with the list appears that enables to pick a specific saved script.

Thanks!

Background & resources

• PRs: [EDR Workflows] Scripts selector component in Response Console kibana#204965
• Issues/metas: https://github.com/elastic/security-team/issues/11684
• Point of contact: @raqueltabuyo @dasansol92 @tomsonpl
• Test environments: n/a

Which documentation set does this change impact?

ESS and serverless

ESS release

9.1, 8.19

Serverless release

CrowdStrike when merged - around End of May, MS Defender Around 9.1 release

Feature differences

They do not differ

API docs impact

Internal API only

Prerequisites, privileges, feature flags

No response

[nicpenning]

What about for the internal EDR, Elastic Defend? It's sort of painful to see external response actions getting more attention and capabilities then native Elastic Defend.

[raqueltabuyo]

@nicpenning we are finishing with external EDRs, there are two tasks pending regarding running scripts for MDE and S1. After that, we will retake Elastic Defend response actions, mainly focusing on forensics 🤓

[nicpenning]

Thank you, @raqueltabuyo for the response! 👋

I would be curious on the forensics capabilities and how they align with the console. Elastic Defend is still missing critical and fundamental response capabilities such as a remote shell, and even scripts from a library as this PR entails :)

No need to hijack this thread, but just wanted to voice my initial concern seeing more and more work on the third party be first party the could real my use it.

Good to hear more work going into the Elastic Defend side. We can take this conversation to the community slack for further discussion if you see fit.

Thank you!