14 DAY FREE TRIAL

No Search Results

No Search Results

14 DAY FREE TRIAL
  1. Help Center
  2. Managing Mac Devices
  3. Security

Category filter

How to deploy CrowdStrike Falcon to your Macs using Hexnode UEM?

Jump To

What is CrowdStrike Falcon?

CrowdStrike Falcon is a cloud-based endpoint security system that provides an industry-leading anti-virus solution for your macOS and Windows devices. The Falcon is powered by the latest technologies in AI and ML to ensure that security breaches and malware are neutralized before they cause significant damage to your devices.

The capabilities of the CrowdStrike Falcon platform are:

  • Industry-leading next-generation anti-virus (NGAV) solution
  • Endpoint detection and response (EDR) system
  • Cyber threat intelligence
  • Managed threat hunting
  • Security hygiene

Once the Falcon sensor gets installed on your device, you can monitor all your devices from the Falcon console.

Steps to deploy the CrowdStrike Falcon sensor

Upload the Falcon sensor PKG file to Hexnode’s app inventory

The Falcon sensor PKG file can be downloaded from the Crowdstrike console under Host setup and management > Sensor downloads. Follow the steps below to upload the PKG file to Hexnode’s app inventory:

  1. Navigate to the Apps tab, click on the +Add Apps dropdown, and select Enterprise App.
  2. Select macOS, enter the application’s required details, and upload the PKG file.
  3. Click on Add.

Create a policy to deploy CrowdStrike Falcon sensor along with the required configurations

You need to configure System Extensions, Kernel Extensions and PPPC settings for the CrowdStrike Falcon sensor to operate flawlessly on your devices. Kernel Extensions must be configured only if your Mac runs on macOS 10.14 and below. Follow the steps given below to create a policy with all the required configurations to deploy the CrowdStrike Falcon sensor:

  1. Navigate to Policies > New Policy > macOS.
  2. To deploy the CrowdStrike Falcon sensor,
    1. Select Mandatory Apps from the left menu and click on Configure.
    2. Click on +Add > Add App and select the CrowdStrike sensor PKG file.
    3. Click on Done.
    4. Once the app is added, click Configure next to the app under the Scripts column to add pre-install script, post-install script or audit script to customize app deployment based on the requirements.
  3. To configure System Extensions,
    1. Select System Extensions from the left menu and click on Configure.
    2. Under Team Identifier, enter X9E956P446 as the Team ID and click on Add.
  4. To configure Kernel Extensions,
    1. Select Kernel Extensions from the left menu and click on Configure.
    2. Under Team Identifier, enter X9E956P446 as the Team ID and click on Add.
  5. To configure PPPC,
    1. Select Privacy Preferences from the left menu and click on Configure.
    2. Select +Add new preferences.
    3. Set the All Files option to Allow.
    4. Click on Specify Bundle IDs/Path.

    6. Full Disk Access needs to be given for the following components:

    Sl No Identifier Type Identifier Code Requirement
    1. Bundle ID com.crowdstrike.falcon.Agent identifier "com.crowdstrike.falcon.Agent" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = X9E956P446
    2. Bundle ID com.crowdstrike.falcon.App identifier "com.crowdstrike.falcon.App" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = X9E956P446
  6. To configure third-party Plugin web content filter and Notification Settings, select Deploy Custom Configuration and upload your configuration profile. Here’s a sample configuration profile:
  7. To associate the policy with your devices, navigate to Policy Targets, select all your required devices, and click on Save.
Disclaimer:

The sample configuration profile given above is subject to OS or application updates. It is recommended to verify the configuration profile on the targeted OS versions using third-party profile editors before deploying it in bulk.

What happens once the policy is associated?

After associating the policy with the device, the following processes are initiated, depending on the configurations specified in the policy.

  1. The CrowdStrike sensor PKG gets installed on the device, consisting of two apps: the Crowdstrike agent app and the Crowdstrike sensor app.
  2. The system extensions and kernel extensions configurations allocate the necessary permissions to the applications accordingly.
  3. The Crowdstrike agent and Crowdstrike sensor apps are granted Full Disk Access. The apps may or may not appear in list under Privacy & Security > Full Disk Access with the toggle button on/off on the device end. Rest assured that the permissions have been successfully granted to them.
  4. Third-party Plugin web content filtering and Notification Settings are configured.

License the Product using Custom Scripting

Execute the following script to license your CrowdStrike Falcon agent using Custom Scripts or Live Terminal:

Uninstalling the Falcon Sensor

If maintenance protection is disabled, run the following script using Custom Scripts or Live Terminal:

Follow the below steps when the maintenance protection is enabled:

  1. In the CrowdStrike cloud console, find the endpoint on the Host Management screen and click on it to access further details about the host.
  2. Click the Reveal maintenance token button.
  3. Write a reason for using the token and click the Reveal Token button. Note the maintenance token.
  4. Start the Live Terminal from the device management tab and run the following script:
  5. Enter the maintenance token when prompted.

The CrowdStrike Falcon will be uninstalled.

Need more help?
Raise a Ticket Raise a Ticket
Ask Community Ask Community
Chat With us Chat With us
  • Managing Mac Devices