Extension Attribute Falcon Host

Thanks so much Mike, this worked perfectly!

You are correct that Falcon Host , which is a next generation endpoint protection platform, doesn't install an application in the applications folder. That would have made this a LOT easier.

I really want to thank you for taking the time to explain the process as well as providing the code, it's amazingly helpful to both see the code as well as an explanation of what is happening. I truly appreciate it!!

#!/bin/bash

crowdstrikeVersion=`sysctl cs | grep "version" | awk '{print $2}'` 

if [ "$crowdstrikeVersion" != " " ]; then
    echo "<result>$crowdstrikeVersion</result>"
else
    echo "<result>Not Installed</result>"
fi

That's what I do.

Thank you @macbentosh ! This worked for the version we are deploying. It seems there are differences in how this is pulled from version 36 vs version 34. Now I need to figure out how to get the CS UUID.

Would that be the sensorID or the CustomerID?

Same thing just change the first line

sysctl cs | grep "cs.customerid" | awk '{print $2}'

You can sub this from whatever comes out of sysctl cs

FYI couple of tips

sysctl -n will return just the value, no need to grep or awk. Also, in the new release all of this is moving to falconctl which now has plist type output, here is a python 3 script I wrote playing around with the new binary output

#!/opt/snowflake/bin/python3
​
import subprocess
import plistlib
​
cmd = ['/Library/CS/falconctl', 'stats', '-p']
proc = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
out, err = proc.communicate()
data = plistlib.loads(out)
​
agentid = data['agent_info']['agentID'].replace('-','').lower()
version = data['agent_info']['version']
​
print(f'Agent ID: {agentid}')
print(f'CS Version: {version}')

is there any extension attribue for this to support big sure, Catalina, Mojave, highsierra

I believe these two EA's I use will work for any version of CrowdStrike, as they've changed where the binary/falconctl can be called from a few times.

This checks for version:

#!/bin/sh
# Conditional check based on version
if [ -e /Library/CS/falconctl ]; then
    falconHostVersion=$(sysctl cs.version 2>/dev/null | awk '{print $2}')
    if [ -z "$falconHostVersion" ]
    then
        falconHostVersion=$(/Library/CS/falconctl stats 2>/dev/null | grep version | awk '{print $2}')
    fi
elif [ -e /Applications/Falcon.app/Contents/Resources/falconctl ]; then

    falconHostVersion=$(/Applications/Falcon.app/Contents/Resources/falconctl stats 2>/dev/null | grep version | awk '{print $2}')
else
  falconHostVersion="Not Installed"
fi
echo "<result>$falconHostVersion</result>"

This checks for connection state:

#!/bin/sh
# Conditional check based on connection state
if [ -e /Library/CS/falconctl ]; then
    falconHostState=$(/Library/CS/falconctl stats | grep -i "State: " | awk '{print $2}')
    if [ -z "$falconHostState" ]
    then
        falconHostState=$(/Library/CS/falconctl stats 2>/dev/null | grep -i "State: " | awk '{print $2}')
    fi
elif [ -e /Applications/Falcon.app/Contents/Resources/falconctl ]; then

    falconHostState=$(/Applications/Falcon.app/Contents/Resources/falconctl stats 2>/dev/null | grep -i "State: " | awk '{print $2}')
else
  falconHostState="Not Connected"
fi
echo "<result>$falconHostState</result>"

I tested and these worked on the Big Sur beta, but I think right now (CS 6.12) the stats command is buggy. I'm having issues using it, although my client is confirmed to be working in the console; others in the macadmins Slack have reported the same. I'm guessing a future CS release will be more Big Sur friendly.

For me Falcon IS installed, but im still getting "unknown oid" and falconctl isn't working either