Crowdstrike - Falcon Sensor for Mac

📄 Requirements

• Supported sensors: Falcon sensor for Mac version 6.58 and later
• Supported operating systems: macOS Monterey 12 and later

⚙️ Set up the Falcon sensor for MAC

Install the Falcon sensor for Mac using the installer:

1. Download the Falcon sensor installer appropriate for your system

2. Get your Customer ID Checksum (CID)

3. Double-click to open the downloaded .pkg file.

   The Falcon sensor for Mac installer opens.

4. Click Continue.

5. Review the Privacy Policy and Terms of Use and click Continue.

6. Click Install.

7. When prompted, enter your administrative credentials and click Install Software.

8. In the macOS dialog, click OK.

9. In the installer window, enter your customer ID with checksum (CID).

10. Optional. If you also have an installation token, enter it.

11. Click Continue.

12. Click Setup and when prompted, click Allow to allow network content filtering.

13. Click Continue.

14. Click Setup and when prompted, click Open System Settings.

    The macOS Privacy & Security system settings window opens.

15. In the Security section, click Allow to allow system extension access.

16. When prompted, enter your administrator credentials and click Modify Settings.

17. Close the macOS Privacy & Security system settings window and click Continue in the installer window.

18. Click System Settings in the installer window.

    The macOS Privacy & Security > Full Disk Access system settings window opens.

19. In the Full Disk Access section, enable Falcon Sensor.

20. When prompted, enter your administrator credentials and click Modify Settings.
21. Click the Falcon notifications banner.
22. Enable to allow Falcon notifications.
23. Close the macOS System Settings window and return to the installer:
    • A completed setup with three green checks ✔️ indicates a successfully installed sensor that is registered, operational, and connected to the CrowdStrike cloud.
    • If you run into issues or see a red cross ❌, contact your system administrator or CrowdStrike Support for assistance.
24. Click Finish.
25. Click Close to exit the installer.

🛠️ Post-installation steps

Verifying sensor installation

Host

To validate that the Falcon sensor for Mac is running on a host, run this command at a terminal:

sudo /Applications/Falcon.app/Contents/Resources/falconctl stats

⛔ Uninstalling the Falcon sensor for Mac

Check with UPX whether the device from which to uninstall the sensor needs a token. Then run the followinng command at a command line:

• Without token:
  sudo /Applications/Falcon.app/Contents/Resources/falconctl uninstall
• With token:
  sudo /Applications/Falcon.app/Contents/Resources/falconctl uninstall --maintenance-token=<your-token>