Planisphere: If a device is communicating with the CrowdStrike cloud, Planisphere will collect information about that device on its regular polling of CrowdStrike.

You can verify that the host is connected to the cloud using Planisphere or a command line on the host.

(Note: The ' Sensor operational' value is not present on macOS 10.15.) Verifying the sensor is connected to the CrowdStrike cloud

The output shows a list of details about the sensor, including its agent ID (AID), version, customer ID, and more, similar to the following:ĪgentID: 96A00E4A-64E5-43B7-95A6-703939F7CB7CĬustomerID: F858934F-17DC-46B6-A1BF-A69994AF93F8 Sudo /Applications/Falcon.app/Contents/Resources/falconctl stats agent_info To verify that the Falcon Sensor for macOS is running, run this command in Terminal: Sudo /Applications/Falcon.app/Contents/Resources/falconctl load Troubleshooting general sensor issues Verifying that the sensor is running If the system extension is not installed, manually load the sensor again to show the prompts for approval by running the following command: To verify the Falcon system extension is enabled and activated by the operating system, run the following command in Terminal:Īmongst the output, you should see something similar to the following line: Verifying that sensor components were installed If you need a maintenance token to uninstall an operating sensor or to attempt upgrading a non-functional sensor, please contact your Security Office for assistance. With Tamper Protection enabled, the CrowdStrike Falcon Sensor for macOS cannot be uninstalled or manually updated without providing a computer-specific 'maintenance token'. Duke's CrowdStrike Falcon Sensor for macOS policies have Tamper Protection enabled by default. If you do experience issues during the installation of the software, confirm that CrowdStrike software is not already installed. The actual installation of the CrowdStrike Falcon Sensor for macOS is fairly simple and rarely has issues, with issues generally stemming from the configuration of the software after installation. If you have questions or issues that this document doesn't address, please submit a ServiceNow case to 'Device Engineering - OIT' or send an email to Troubleshooting Sensor Installation Installation fails Full Documentation and Further AssistanceĪ recent copy of the full CrowdStrike Falcon Sensor for macOS documentation (from which most of this information is taken) can be found at (Duke NetID required).

Installing this software on a personally-owned will place the device under Duke policies and under Duke control. Please do NOT install this software on personally-owned devices. NOTE: This software is NOT intended for use on computers that are NOT owned by Duke University or Duke Health. Troubleshooting the CrowdStrike Falcon Sensor for macOS

Falcon macos