How to deploy CrowdStrike Falcon Sensor with SimpleMDM

CrowdStrike is a cloud-based software solution that provides endpoint protection, threat intelligence, and incident response services to help sysadmins monitor cyberattacks.

To deploy CrowdStrike on macOS via MDM, download CrowdStrike's provided .mobileconfig profile. Then add it as a custom profile in your MDM solution. As your last step, push the Falcon Sensor application as a custom application to Mac endpoints.

The order in which you complete these steps is imperative to achieving a silent deployment.

The deployment process should follow this order:

1. Download CrowdStrike's custom .mobileconfig profile.

2. Upload CrowdStrike's custom .mobileconfig.

3. Deploy CrowdStrike's custom .mobileconfig profile through your MDM.

4. Download the CrowdStrike Falcon Sensor application.

5. Upload the CrowdStrike Falcon Sensor application to your MDM as a custom application.

6. Create a personalized after-install script to your custom application for licensing.

7. Auto-deploy the CrowdStrike Falcon Sensor application after the profile has synced to endpoints.

8. Test your deployment to confirm connectivity.

1. Download CrowdStrike's custom .mobileconfig profile

CrowdStrike has created an MDM deployment profile customized to give you a fully touchless deployment. The trick is that you must deploy this profile to your Macs before you deploy the CrowdStrike application for the deployment to be fully touchless.

If you've decided to deploy CrowdStrike, you may have encountered the expansive universe of CrowdStrike Support. Lucky for you, I already waded into the waters of the CrowdStrike support pages to find you all the configuration profiles, pkgs, and deployment guides you'll need for this deployment. (You're welcome. I love you, too.)

XML

Here's the current XML payload for the CrowdStrike profile. (The contents of this payload are subject to change.)

Where to find the profile

Follow these steps to find the profile:

1. Navigate to https://supportportal.CrowdStrike.com/s/article/ka16T000000wtMWQAY.

2. Click Login with Falcon.

3. Select your login type (in my case, I had to log in with US-2).

4. Enter Xcreds provided to you from CrowdStrike upon initiating an account or trial.

5. Click this link once more to auto-populate the webpage, or search for the page title:

   Using Mobile Device Management (MDM) to sync profiles before installing or upgrading the Falcon sensor for Mac. 

6. Scroll all the way down to the bottom of the support page.

7. You should see a downloadable file under Additional Information titled Falcon Profile – no Kext.

8. Click Preview and Download.

9. Locate the document file under the name Falcon Profile – no Kext and have it ready for the next section.

2. Upload CrowdStrike's configuration profile as a custom config

Once you've downloaded CrowdStrike's custom .mobileconfig profile, it's time to upload it to your MDM as a custom configuration profile. Let's walk through how to tackle this step in SimpleMDM.

To upload the profile to SimpleMDM, follow these steps:

1. Navigate to Configs > Profiles.  

2. Click Create Profile. 

3. Click Custom Configuration Profile. 

4. Name your profile. 

5. Click Choose File and select Falcon Profile – no Kext file (or copy and paste XML payload). 

6. Check the box for macOS devices, deploy as a device profile instead of a user profile. 

7. Check the box for Re-install profile automatically after macOS software updates are detected. 

8. Click Save.
   

3. Deploy CrowdStrike's custom .mobileconfig through your MDM

To assign the profile you just created to Device Groups, follow these steps:

1. Go to Devices > Groups.

2. Select the predefined group that you would like to push the profile to.

3. Click the Profiles tab on the Group Details page.

4. Click Assign Profile.

5. Search the name of the Custom Profile you just created.

6. Click Assign.

7. You should now see your Custom Profile listed under Profiles on the Group Details page.

(Pssst: You may want to brush up on creating a custom profile in SimpleMDM.)

4. Download Falcon Sensor through MDM as a custom app

CrowdStrike uses a proprietary application called Falcon Sensor to deploy its agent. At the time of publication, this application cannot be found on the App Store or within SimpleMDM Shared Apps. But no worries! I'll show you where to find this priceless .pkg. (You can also follow along with CrowdStrike's instructional video.)

Get the .pkg

Follow these steps to find the .pkg:

1. While logged into CrowdStrike, navigate to Host setup and management > Deploy > Sensor downloads.

2. Find macOS Sensor on the download list.

3. Click Download.

4. The file should download as FalconSensorMacOS.MaverickGyr.pkg

Find your CrowdStrike Customer ID

We need to grab your Customer ID for the after-install script to license the Falcon Sensor applications successfully. Since I know you're a multitasker, let's do this while we're already on the page.

Follow these steps to find the ID:

1. While still logged into CrowdStrike, copy your Customer ID checksum (CCID) from Host setup and management > Deploy > Sensor downloads.

2. Look at the gray box at the top of the page.

3. Find the ID listed under Point 2 (under HOW TO INSTALL).

5. Upload CrowdStrike Falcon Sensor app to your MDM as a custom app

Now that we have the most up-to-date application, we can perform a mass deployment of the App to our endpoints through our chosen MDM. For this step, I recommend taking the auto-deployment approach. That means the application will appear in your user's application folder without user intervention. If you follow along with SimpleMDM, we will deploy the .pkg as a Managed application through Munki.

Here's how to deploy .pkg as a custom app through Munki:

1. Navigate to Apps & Media.

2. Click Catalog.

3. Click Add App in the upper right-hand corner.

4. Select Custom App from the drop-down menu.

5. Click Browse Files or drag and drop Falcon SensorMacOS.MaverickGyr.pkg.

6. Hit Upload.

7. Check that the upload is complete.

Now the custom app should reflect this corresponding screenshot:

6. Create personalized after-install script

We must add an after-install script to the custom application we created to license each endpoint.

Here's how to create the after-install script:

1. Go to Apps & Media > Catalog > Falcon Sensor App.

2. Click the Munki tab

3. Scroll down to Scripts.

4. Find After Install box. 

5. Copy and paste the following in the After Install box:

6. Enter your Customer ID in place of {{license-key}} in the above script.

7. Set the Install Priority box to the lowest priority (10) to give the custom profile more time to deploy before the Falcon Sensor app if needed.

8. Save.

7. Auto-deploy the application to desired endpoint groups

Here's how you can auto-deploy (or assign) the application:

1. Once the after-install script has been added to the custom application, go to Apps & Media > Assignment.  

   

2. Select the desired assignment group to which you want to deploy the Falcon Sensor app. For auto-deployment, we will be choosing a Munki, Managed assignment group.

   

3. In this example, I've added the App to my managed App for auto-deployment. This means the .pkg should appear in the user's application library. This sync should typically happen within an hour if the receiving endpoints are online and reachable by SimpleMDM. 

   

4. Dictate what device groups or individual machines you'd like to deploy this managed App to.

5. Click Actions > Update Catalog after adding the App to the app group, just to be thorough.

6. Repeat these steps if you'd like to add to any other assignment groups.

8. Test your deployment

You deployed all the pieces of this CrowdStrike puzzle — way to go! But you still want to make sure that your deployment was successful.

Here are a few terminal commands you can run on your endpoints to check for agent connectivity:

1. Open the Terminal application on your test endpoint within an Admin user.

2. Copy and paste the following into Terminal:
sudo /Applications/Falcon.app/Contents/Resources/falconctl stats

The Terminal output should look like the following when successful:

3. For the second command, enter:

sudo systemextensionsctl list

The terminal output should look like the following when successful:

Additional tidbits

VPN

Successful CrowdStrike deployment requires port 443 open on VPN per CrowdStrike documentation.

Endpoint Firewalls 

If you're using an endpoint firewall on your host, it must be configured to allow access to the CrowdStrike domains. Customers have reported that these products require additional configuration when used with the Falcon sensor:

• Ad-Aware Pro Security

• Avast Internet Security

• AVG Internet Security

• BullGuard Internet Security

• Dr. Web Security Space

• MylnternetSecurity Prevention A/V + Firewall

• UnThreat Internet Security

• VIPRE Internet Security

• ZoneAlarm Internet Security Suite

• Chili Internet Security

• ESET Node32 Smart Security

• BITDEFENDER Total Security

• TrustPort Internet Security

CrowdStrike can be daunting to deploy — but it doesn't have to be! Just bring a little confidence, and SimpleMDM can help with the rest.  

If you don't have an MDM to help make your CrowdStrike Deployment Pretty Damn Quick, try SimpleMDM for free!