CrowdStrike Falcon has revolutionized endpoint security by being the first and only solution to unify next-generation antivirus, endpoint detection and response (EDR), and a 24/7 threat hunting service - all delivered via a single lightweight agent. The Worklet will reference this during the install.CrowdStrike is the pioneer of cloud-delivered endpoint protection. Next, Load the FalconSensorMacOS.pkg installation file to the Worklet.#check to ensure the CS service is running to verify installation was successful Sudo /Library/CS/falconctl license $customerid Sudo installer -verboseR -package /tmp/FalconSensorMacOS.pkg -target / 2> /tmp/axfalconinstall.log & error logs are output to /tmp/axfalconinstall.log #run installation of Falcon Sensor on the device. #copy the files to the /tmp directory of the device Replace your_customer_id with your install code. #Input your unique CS Customer ID checksum code below. #evaluate the device to see if the Crowdstrike service is running Copy the syntax below to each of the code blocks (evaluation, remediation).From there select a “Worklet” policy for MacOS.Login into the Automox console and create a new policy from the System Mgmt page.The Worklet will fail if this is not added. You can check this by viewing the Support Docs in the CrowdStrike Falcon dashboard.īe sure to read the comments in the evaluation and remediation code below to ensure you are adding the Customer ID checksum unique to your organization. Otherwise, this Worklet will not install the app.īe sure to check the system and network/firewall requirements for CrowdStrike Falcon to ensure that you are meeting those requirements. You need to make sure that the CrowdStrike Falcon application is whitelisted for the devices so the KEXT does not prevent the installation. Some things to remember when using this Worklet to install CrowdStrike Falcon: pkg file to the endpoint and run the install if the Worklet determines if CrowdStrike is not installed. The below Worklet is designed to deploy CrowdStrike Falcon Sensors to macOS endpoints. Automox Worklets gives you the power to deploy endpoint security tools to newly added endpoints as well as enforce installation on existing endpoint,s so you always know that your endpoints are running the security tools necessary to protect your IT environment. As an IT administrator one of the first things you’ll find yourself doing is installing an endpoint security tool, which can be very difficult to automate across hundreds, if not thousands of devices.

Mac crowdstrike