Deploy CrowdStrike Falcon sensors across Windows, macOS, and Linux endpoints. Configure threat prevention and response policies, verify installation and detection, troubleshoot sensor issues, and connect events to SIEM platforms, which collect security logs for analysis.
中文简介正在准备中。当前显示英语简介。
Deploys and configures CrowdStrike Falcon EDR agents across enterprise endpoints to enable real-time threat detection, behavioral analysis, and automated response. Use when onboarding endpoints to EDR coverage, configuring detection policies, or integrating Falcon telemetry with SIEM platforms. Activates for requests involving CrowdStrike deployment, Falcon sensor installation, EDR policy configuration, or endpoint detection and response.
安装前可以查看交给 AI 代理的指令内容。
Use this skill when:
Do not use this skill for deploying other EDR solutions (Carbon Black, SentinelOne) or for Falcon cloud workload protection (use cloud-specific deployment guides).
1. Log into Falcon Console: https://falcon.crowdstrike.com
2. Navigate: Host setup and management → Sensor downloads
3. Download the appropriate installer:
- Windows: WindowsSensor_<version>.exe
- macOS: FalconSensorMacOS_<version>.pkg
- Linux: falcon-sensor_<version>_amd64.deb / .rpm
4. Copy the Customer ID (CID) from the Sensor downloads page
- CID format: <32-char-hex>-<2-char-checksum>
Silent installation via command line:
WindowsSensor_7.18.17106.exe /install /quiet /norestart CID=<YOUR_CID>
SCCM deployment:
1. Create an Application in SCCM
2. Deployment type: Script Installer
3. Install command: WindowsSensor_7.18.17106.exe /install /quiet /norestart CID=<CID>
4. Detection method: Registry key exists
- HKLM\SYSTEM\CrowdStrike\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\{16e0423f-7058-48c9-a204-725362b67639}\Default
5. Deploy to target collection
6. Deployment purpose: Required (for mandatory installation)
Microsoft Intune deployment:
1. Navigate: Devices → Windows → Configuration profiles
2. Create Win32 app deployment
3. Upload .intunewin package (wrapped sensor installer)
4. Install command: WindowsSensor_7.18.17106.exe /install /quiet /norestart CID=<CID>
5. Detection rule: File exists C:\Windows\System32\drivers\CrowdStrike\csagent.sys
6. Assign to device group
GPO deployment:
# Create startup script that checks for existing installation
$sensorPath = "C:\Windows\System32\drivers\CrowdStrike\csagent.sys"
if (-not (Test-Path $sensorPath)) {
Start-Process -FilePath "\\fileserver\CrowdStrike\WindowsSensor.exe" `
-ArgumentList "/install /quiet /norestart CID=<CID>" -Wait
}
# Debian/Ubuntu
sudo dpkg -i falcon-sensor_7.18.0-17106_amd64.deb
sudo /opt/CrowdStrike/falconctl -s -f --cid=<YOUR_CID>
sudo systemctl start falcon-sensor
sudo systemctl enable falcon-sensor
# RHEL/CentOS
sudo yum install falcon-sensor-7.18.0-17106.el8.x86_64.rpm
sudo /opt/CrowdStrike/falconctl -s -f --cid=<YOUR_CID>
sudo systemctl start falcon-sensor
sudo systemctl enable falcon-sensor
# Verify sensor is running and connected
sudo /opt/CrowdStrike/falconctl -g --rfm-state
# Expected output: rfm-state=false (sensor is communicating with cloud)
# Install sensor package
sudo installer -pkg FalconSensorMacOS_7.18.pkg -target /
# Set CID
sudo /Applications/Falcon.app/Contents/Resources/falconctl license <YOUR_CID>
# Grant Full Disk Access and System Extension via MDM profile
# Required for macOS Ventura+ (manual approval or MDM PPPC profile)
# MDM payload: com.crowdstrike.falcon.Agent → SystemExtension + Full Disk Access
# Verify sensor status
sudo /Applications/Falcon.app/Contents/Resources/falconctl stats
In Falcon Console, navigate to Configuration → Prevention Policies:
Recommended prevention policy settings:
Machine Learning:
- Cloud ML: Aggressive (extra protection, may increase false positives)
- Sensor ML: Moderate
- Adware & PUP: Moderate
Behavioral Protection:
- On Write: Enabled (detect malware on file creation)
- On Sensor ML: Enabled
- Interpreter-Only: Enabled (detect script-based attacks)
Exploit Mitigation:
- Exploit behavior protection: Enabled
- Memory scanning: Enabled (detects in-memory attacks)
- Code injection: Enabled
Ransomware:
- Ransomware protection: Enabled
- Shadow copy protection: Enabled
- MBR protection: Enabled
Create separate policies for:
Real-Time Response:
- Enable RTR for all sensor groups
- Configure RTR admin vs. RTR responder roles
- Enable script execution (for IR teams)
- Enable file extraction (for forensics)
Network Containment:
- Pre-authorize containment for specific host groups
- Configure containment exclusions (allow management traffic)
Automated Response:
- Enable automated remediation for high-confidence detections
- Configure kill process action for ransomware detections
- Enable quarantine for malware file detections
# Windows: Check Falcon sensor status
sc query csagent
# Expected: RUNNING
# Check sensor version
reg query "HKLM\SYSTEM\CrowdStrike\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\{16e0423f-7058-48c9-a204-725362b67639}\Default" /v AgentVersion
# Verify cloud connectivity
# In Falcon Console: Host Management → Hosts → search for hostname
# Status should show "Online" with last seen timestamp < 5 minutes
Test detection capability:
# CrowdStrike provides test detection samples
# Download CsTestDetect.exe from Falcon Console → Host setup
# Run on endpoint to generate a test detection
.\CsTestDetect.exe
# Verify detection appears in Falcon Console within 60 seconds
# Falcon SIEM Connector (Streaming API)
# Configure in Falcon Console: Support → API Clients and Keys
# Create API client with scope: Event Streams → Read
# Use falcon-siem-connector or Falcon Data Replicator (FDR)
# Splunk integration:
# Install CrowdStrike Falcon Event Streams Technical Add-on from Splunkbase
# Configure: Settings → Data inputs → CrowdStrike Falcon Event Streams
# Enter API Client ID and Secret
# Index: crowdstrike_events
# Elastic integration:
# Use Elastic Agent with CrowdStrike module
# Configure: Fleet → Agent policies → Add integration → CrowdStrike
| Term | Definition |
|---|---|
| Falcon Sensor | Lightweight kernel-mode agent (25-30 MB) that collects endpoint telemetry and enforces prevention policies |
| CID (Customer ID) | Unique identifier that associates the sensor with your CrowdStrike Falcon tenant |
| RFM (Reduced Functionality Mode) | State where sensor operates with limited capability due to cloud connectivity loss |
| Sensor Grouping Tags | Labels applied during installation to auto-assign hosts to groups and policies |
| RTR (Real-Time Response) | Remote shell capability for incident responders to interact with endpoints through Falcon |
| IOA (Indicators of Attack) | Behavioral detections based on adversary techniques rather than static signatures |
/install /quiet CID=<CID> APP_PROXYNAME=proxy.corp.com APP_PROXYPORT=8080.还没有评价。欢迎分享你的使用感受。
无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。
还没有评论。来写第一条吧。
Assess exposure of Windows secrets protected by DPAPI, the operating system’s data protection service, during authorized security tests. Guide examination and decryption of saved credentials and browser data using available user sessions, credentials, or backup keys.
中文简介正在准备中。当前显示英语简介。
Assess Shadow Credentials account takeover during authorized Active Directory testing. Examine permissions that allow public key registration, validate authentication without a password reset, and document credential cleanup, detection opportunities, and access control changes needed for remediation.
中文简介正在准备中。当前显示英语简介。
Prepare for CMMC Level 2, a cybersecurity certification for defense contractors. Define the systems handling controlled information, review security requirements, calculate the SPRS assessment score, and organize remediation plans and evidence into a readiness report.
中文简介正在准备中。当前显示英语简介。
Create disk images for investigations using dd or dcfldd on Linux. The workflow covers write protection, bit-for-bit copying, hash checks to verify integrity, and documentation of the acquisition process.
中文简介正在准备中。当前显示英语简介。
Review Active Directory permissions with ldap3, a Python library for directory queries. Identify excessive access granted to non-administrative accounts, explain potential privilege escalation paths, and produce a JSON report with affected objects and remediation recommendations.
中文简介正在准备中。当前显示英语简介。
Inspect suspicious Android APK files without running them. Analyze permissions, app components, suspicious code patterns, and network indicators, then produce a JSON risk report to support malware triage and detection rule development.
中文简介正在准备中。当前显示英语简介。