Even though you are a Falcon Administrator, you discover you are unable to use the "Connect to Host" feature to gather additional information which…

The "Connect to Host" feature in the CrowdStrike Falcon console is the user interface for Real Time Response (RTR). This powerful capability allows authorized users to establish a remote shell session directly with an endpoint for deep investigation and immediate remediation actions. Access to this feature is governed by specific role-based access control (RBAC) permissions. The "Real Time Responder" role is explicitly designed to grant users the necessary privileges to initiate these RTR sessions. Even a user with the "Falcon Administrator" role does not have RTR permissions by default and must be assigned the "Real Time Responder" role separately to ensure proper segregation of duties and security oversight.

B. Endpoint Manager: This role is responsible for managing sensor deployment, sensor update policies, and host grouping, not for direct interactive access to endpoints.

C. Falcon Investigator: This role is primarily for viewing and analyzing detections, incidents, and threat intelligence data. It does not include active response capabilities like RTR.

D. Remediation Manager: This role grants permissions to perform specific remediation actions like quarantining files or containing hosts, but not the direct command-line access provided by RTR.

1. CrowdStrike Falcon Documentation

"Managing Users and Roles

" Section: "Falcon User Roles." This document outlines the permissions for each predefined role. It specifies that the "Real Time Responder" role is required to "Connect to hosts to run commands and remediate detections." The "Falcon Administrator" role is described as managing platform settings and users but does not inherently include RTR capabilities.

2. CrowdStrike Falcon Documentation

"Real Time Response

" Section: "Prerequisites for Real Time Response." This guide explicitly states that a user must have the "Real Time Responder" role (either Analyst or Administrator variant) assigned to their account to use the "Connect to Host" feature and initiate an RTR session.