Posted on 05-13-2020 12:10 PM
Hi, I am trying to find a way to see if there is a way to show if a program is installed or missing on specific machines. We want to make sure everyone has Crowdstrike Falcon sensor installed and running.
Posted on 05-13-2020 12:22 PM
Here's what we're using to report on the installed version - you should be able to use the "Not Installed" criteria in a smart group for your purposes.
#!/bin/sh
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
#
# Copyright (c) 2018 Jamf. All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:
# * Redistributions of source code must retain the above copyright
# notice, this list of conditions and the following disclaimer.
# * Redistributions in binary form must reproduce the above copyright
# notice, this list of conditions and the following disclaimer in the
# documentation and/or other materials provided with the distribution.
# * Neither the name of the Jamf nor the names of its contributors may be
# used to endorse or promote products derived from this software without
# specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY
# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
# DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY
# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
################
# Most authorship of the following script by Jamf Sr. Systems Engineer: Matt Woodruff
# Jamf Nation username: mwoodruff
################
# Regex for OS detection +10.13
OSREGEX="^1[3-9]$"
# Gets the OS version
OS=$(/usr/bin/sw_vers -productVersion)
OSVERS=$(/usr/bin/sw_vers -productVersion | /usr/bin/awk -F. '{print $2}')
if [[ $OSVERS =~ $OSREGEX ]]; then
CS=$(sysctl cs | grep cs.version | awk -F: '{print $2}')
else
CS="none"
fi
if [ "$CS" == "none" ]; then
echo "<result>Not Supported in OS $OS</result>"
elif [ "$CS" != "" ]; then
echo "<result>Version $CS</result>"
else
echo "<result>Not Installed or Running</result>"
fi
Posted on 02-16-2021 12:31 AM
Hi I'm getting error
I think this not supported for big sur
<result>Not Supported in OS 11.0.1</result>
Posted on 02-16-2021 06:30 AM
I think that script is based on the pre-5.3x versions of the Falcon sensor, because a lot of that info moved into the output from falconctl
instead of the kernel variables. Here's what we're using, which has been tested with version 5.11 through 6.18:
#!/bin/bash
# Find falconctl in /Library or /Applications/Falcon.app, or report if it's not there
if [ -e /Library/CS/falconctl ]; then
falconctlPath="/Library/CS/falconctl"
elif [ -e /Applications/Falcon.app/Contents/Resources/falconctl ]; then
falconctlPath="/Applications/Falcon.app/Contents/Resources/falconctl"
else
echo "<result>Not Installed</result>"
exit 0
fi
# Try to get the information from falconctl
csVersion=$($falconctlPath stats | grep version: | awk '{print $2}')
# If that didn't get it, try the old way
if [[ "$csVersion" == "" ]]; then
csVersion=$(sysctl cs | grep cs.version | awk '{print $2}')
fi
# Report what we found, or that we don't know
echo "<result>${csVersion:-Unknown}</result>"
Posted on 02-16-2021 11:46 PM
@bvrooman thanks for the script im getting error as like
NTS-IT-001:Desktop manikandan.raju$ sudo ./csv2.sh
./csv2.sh: line 14: /Library/CS/falconctl: is a directory
<result>6.16.12903.0</result>
Posted on 02-22-2021 08:13 AM
Thanks for the information keep sharing such informative post keep suggesting such post.
Posted on 02-23-2021 11:22 PM
try like this it may help to find a better result.
#!/bin/bash
# Supports bith CS-V5.X below and CS-v6.X above .
# Find falconctl in /Library or /Applications/Falcon.app, or report if it's not there
if [ -e /Library/CS/falconctl ]; then
falconctlPath="/Library/CS/falconctl"
elif [ -e /Applications/Falcon.app/Contents/Resources/falconctl ]; then
falconctlPath="/Applications/Falcon.app/Contents/Resources/falconctl"
else
echo "<result>Not Installed</result>"
exit 0
fi
# Try to get the information from falconctl
csVersion=$($falconctlPath stats | grep version: | awk '{print $2}')
# If that didn't get it, try the old way
if [[ "$csVersion" == "" ]]; then
csVersion=$(sysctl cs | grep cs.version | awk '{print $2}')
fi
# Report what we found, or that we don't know
echo "<result>${csVersion:-Unknown}</result>"