How To Install Crowdstrike On Windows

CrowdStrike Falcon - Installation Instructions

On this page:

Prerequisites
Manual Installation
Normal operation
Tin can information technology be uninstalled?
More information

Prerequisites

You must have ambassador rights to install the CrowdStrike Falcon Host Sensor.
Your device must be running a supported operating arrangement. The list of operating systems that CrowdStrike supports can be found on their FAQ.

Transmission Installation

Become an installer from our MIT IS&T CrowdStrike Falcon product page (This installer is provisioned for utilise at MIT. Do not attempt to download directly from CrowdStrike.)
Launch the downloaded file
- On Windows the proper name volition exist similar FalconSensorWinOS.exe
- On OSX the name will be like FalconSensorMacOSX.pkg
- On Linux the name will be similar CrowdStrike_LinuxDeb_x86.tar.gz or CrowdStrike_LinuxRPM_x86.tar.gz depending on the distribution
  - Do not endeavour to install the package directly. Extract the package and use the provided installer.
  - For example:
    $ sudo tar xvzf CrowdStrike_LinuxDeb_<version>.tar.gz
    $ cd CrowdStrike; sudo ./MIT-CrowdStrike-Install-Deb.sh
Accept the Falcon License Agreement
When prompted, click Yes or enter your computer countersign, to give the installer permission to run.
- On macOS ten.thirteen Loftier Sierra and greater, you lot may become a "System Extension Blocked" bulletin. To enable CrowdStrike, y'all must approve the kernel extension from CrowdStrike in the Security & Privacy pane of the Mac OS System Preferences.
- On macOS ten.14 Mojave and greater, you lot will need to provide full disk access to the installer to function properly. Open System Preferences -> Security & Privacy -> Privacy -> Full Deejay Admission. Click the plus sign.

You are done! Afterwards installation, the sensor volition run silently.

Normal functioning

When installation is finished,(on Windows y'all will not be notified when the install is finished) the sensor runs silently. If it sees clearly malicious programs, it tin terminate the bad programs from running. If information technology sees suspicious programs, IS&T'due south Security team will contact you.

To confirm the sensor is installed and running properly:

Windows
- Navigate to the command line and type:
  sc query csagent
  Wait for the State: RUNNING statement in the response:
  
  SERVICE_NAME: csagent
  Type : 2FILE_SYSTEM_DRIVER
  Land : 4 RUNNING
  (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
  WIN32_EXIT_CODE : 0 (0x0)
  SERVICE_EXIT_CODE : 0 (0x0)
  CHECKPOINT : 0x0
  WAIT_HINT : 0x0
Mac Bone
- Navigate to the Terminal command line and type:
  sysctl cs
  You should meet a lot of useful information, including:
  - cs.version - your currently installed sensor version
  - cs.sensorid - your unique sensor id
- Version four.xviii.8013 and above:
  - Network information previously obtained by executing sysctl cs.comms is now obtained past executing sudo /Library/CS/falconctl stats
  - The output of sudo /Library/CS/falconctl stats will provide more detailed information including connection land to the CrowdStrike cloud.
    
    Cloud Info
    Host: ts01-b.cloudsink.net
    Port: 443
    Country: connected
- Version vi.xi and above:
  - The Falcon binary now lives in the applications binder at /Applications/Falcon.app
  - The output of sudo /Applications/Falcon.app/Contents/Resources/falconctl stats volition provide more detailed information including connection state to the CrowdStrike cloud.

Linux
- Use 1 of the post-obit commands to verify the service is running
  - $ sudo ps -e | grep falcon-sensor
    108019 ? 00:00:58 falcon-sensor
  - $ sudo systemctl is-active falcon-sensor
    active
  - $ sudo service falcon-sensor condition
    Redirecting to /bin/systemctl condition falcon-sensor.service
    ? falcon-sensor.service - CrowdStrike Falcon Sensor
    Loaded: loaded (/usr/lib/systemd/system/falcon-sensor.service; enabled; vendor preset: disabled)
    Active: active (running) since Thu 2019-10-31 11:00:47 EDT; 11min ago
    Process: 108012 ExecStart=/opt/CrowdStrike/falcond (code=exited, condition=0/SUCCESS)
    Process: 108010 ExecStartPre=/opt/CrowdStrike/falconctl -1000 --cid (code=exited, status=0/SUCCESS)
    Main PID: 108016 (falcond)
    CGroup: /arrangement.slice/falcon-sensor.service
    ??108016 /opt/CrowdStrike/falcond
    ??108019 falcon-sensor

Can information technology be uninstalled?

In order to uninstall current versions of CrowdStrike, yous will need to obtain a maintenance token, which is unique to each organization. To obtain this token, email security@mit.edu from your MIT account stating that you lot need a maintenance token to uninstall CrowdStrike. Y'all will besides need to provide your unique agent ID equally described below. The Security Team may be able to notice your host past a combination of hostname, IP address and/or MAC accost.

You can retrieve the host's device ID or AID (agent ID) locally past running the following commands at a Command Prompt/Terminal.

Windows:
reg query HKLM\Organization\CurrentControlSet\services\CSAgent\Sim\ /f AG

Mac sensor version 6.x:
sudo /Applications/Falcon.app/Contents/Resource/falconctl stats | grep agentID

Mac sensor version 5.10 (obsolete):
sudo /Library/CS/falconctl stats | grep agentID

Once the Security Squad provides this maintenance token, you may proceed with the below instructions.

Windows
- Get to the Command Panels, select Uninstall a Plan, and select CrowdStrike Falcon Sensor
Mac OS
This depends on the version of the sensor you are running. You can check using the sysctl cs command mentioned in a higher place, merely unless you are still using Yosemite you should be on half dozen.x at this betoken. Note for those unfamiliar with sudo that you will be prompted for a password, which is the password for the account yous are logged in as, to permit the command to run with elevated privilege.
- Sensor version 5.ten and below, navigate to the Terminal command line and type:
  sudo /Library/CS/falconctl uninstall -t token-from-security-team
- Sensor version 6.10 and above, navigate to the Concluding control line and type:
  sudo /Applications/Falcon.app/Contents/Resources/falconctl uninstall -t token-from-security-team
- You can also unload/load the sensor if you retrieve you are having bug:
  sudo /Library/CS/falconctl load
  sudo /Library/CS/falconctl unload -t token-from-security-squad
Linux
- sudo service falcon-sensor stop
- Remove the bundle using the appropriate rpm or deb parcel command. The package name volition be like falcon-sensor-4.eighteen.0-6403.el7.x86_64