Do not attempt to install the package directly.

On Linux the name will be like CrowdStrike_LinuxDeb_ or CrowdStrike_LinuxRPM_ depending on the distribution.

On OSX the name will be like FalconSensorMacOSX.pkg.

On Windows the name will be like FalconSensorWinOS.exe.

Do not attempt to download directly from CrowdStrike.)

Get an installer from our MIT IS&T CrowdStrike Falcon product page (This installer is provisioned for use at MIT.

The list of operating systems that CrowdStrike supports can be found on their FAQ.

Your device must be running a supported operating system.

You must have administrator rights to install the CrowdStrike Falcon Host Sensor.

Uninstall protection prevents unauthorized users from uninstalling the Falcon Agent, but also streamlines the workflow for helpdesk teams to uninstall the Falcon Agent in the case of necessary maintenance. Additionally the Sensor Update Policies can be modified over the Falcon API in the event that you already integrate with the Sensor Update Policy modifications. For example, Maintenance tokens can be accessed programmatically over the Falcon API in conjunction with your internal ticketing system. Through use of the Falcon API’s, the Uninstall Protection workflow can be integrated into any existing processes to make things easier. If you are interested in enabling uninstall protection but also require manual updates of the Falcon Agent, please see: our article on How to configure Manual Updates. INPUT_YOUR_TOKEN Further Reading on Uninstall Stepsįor a full listing of commands and scenarios, see the Deployment guide for Windows and Mac OS. Sudo /Applications/Falcon.app/Contents/Resources/falconctl uninstall -maintenance-token Open add/remove programs and select the Falcon Agent, and click uninstall:

When Uninstall Protection is enabled and an uninstall is initiated, users are presented with the setup dialog and are required to input the token obtained from the Falcon UI. Navigate to Host App > Host Management, then select the host of interest and click “Reveal maintenance token” and you are presented with the one-time maintenance token, which can be given to the end-user/technician updating or uninstalling the Falcon Agent.Įven if the device is offline, the token will allow the uninstall/update to proceed. To simplify the management of protected Falcon Agent installations, maintenance tokens can be accessed from the Hosts app. With this policy applied to our devices, an uninstall will now require a token to complete.įalcon Uninstall Workflow with Protection Enabled Within the Falcon Update Policy, Sensor Uninstall Protection is configurable (Configuration > Sensor Update Policies > Sensor Protection). This role must be enabled against the Falcon user’s account in order to obtain maintenance tokens or manage policy related to Uninstall Protection. The “Maintenance Manager” role is available which grants permission to access the maintenance tokens. Uninstall Protection also adds a layer of protection that prevents unauthorized users from removing the sensor. Once enabled in the policy, helpdesk teams can provide one-time device-specific maintenance tokens as needed. Uninstall Protection can be controlled by policy, making it easier to lock down sensitive devices. IntroductionĬrowdstrike offers an easy to use Uninstall Protection process for the Falcon Agent.

Register now to build skills at hands-on workshops and learn from skilled threat hunters. The greatest minds in cybersecurity are at Fal.Con in Las Vegas, Sept.

Crowdstrike falcon maintenance token