# How to deploy CrowdStrike Falcon to your Macs using Hexnode UEM?
What is CrowdStrike Falcon?
----------------------------
CrowdStrike Falcon is a cloud-based endpoint security system that provides an industry-leading anti-virus solution for your macOS and Windows devices. The Falcon is powered by the latest technologies in AI and ML to ensure that security breaches and malware are neutralized before they cause significant damage to your devices.
The capabilities of the CrowdStrike Falcon platform are:
- Industry-leading next-generation anti-virus (NGAV) solution
- Endpoint detection and response (EDR) system
- Cyber threat intelligence
- Managed threat hunting
- Security hygiene
Once the Falcon sensor gets installed on your device, you can monitor all your devices from the Falcon console.
Steps to deploy the CrowdStrike Falcon sensor
----------------------------------------------
### Upload the Falcon sensor PKG file to Hexnode’s app inventory
The Falcon sensor PKG file can be downloaded from the Crowdstrike console under **Host setup and management > Sensor downloads**. Follow the steps below to upload the PKG file to Hexnode’s app inventory:
1. Navigate to the **Apps** tab, click on the **+Add Apps** dropdown, and select **Enterprise App**.
2. Select **macOS**, enter the application’s required details, and upload the PKG file.
3. Click on **Add**.
### Create a policy to deploy CrowdStrike Falcon sensor along with the required configurations
You need to configure **System Extensions, Kernel Extensions** and **PPPC** settings for the CrowdStrike Falcon sensor to operate flawlessly on your devices. Kernel Extensions must be configured only if your Mac runs on macOS 10.14 and below. Follow the steps given below to create a policy with all the required configurations to deploy the CrowdStrike Falcon sensor:
1. Navigate to **Policies > New Policy > macOS**.
2. To deploy the CrowdStrike Falcon sensor,
1. Select **Required Apps** from the left menu and click on **Configure**.
2. Click on **+Add > Add App** and select the CrowdStrike sensor PKG file.
3. Click on **Done**.
4. Once the app is added, click **Configure** next to the app under the Scripts column to add *pre-install script, post-install script* or *audit script* to [customize app deployment](https://www.hexnode.com/mobile-device-management/help/deploy-scripts-to-automate-app-deployment-on-macos-devices/) based on the requirements.
3. To configure **System Extensions**,
1. Select **System Extensions** from the left menu and click on **Configure**.
2. Under **Team Identifier**, enter **X9E956P446** as the **Team ID** and click on **Add**.
4. To configure **Kernel Extensions**,
1. Select **Kernel Extensions** from the left menu and click on **Configure**.
2. Under **Team Identifier**, enter **X9E956P446** as the **Team ID** and click on **Add**.
5. To configure **PPPC**,
1. Select **Privacy Preferences** from the left menu and click on **Configure**.
2. Select **+Add new preferences.**
3. Set the **All Files** option to **Allow**.
4. Click on **Specify Bundle IDs/Path**.
Full Disk Access needs to be given for the following components:
Sl No Identifier Type Identifier Code Requirement 1.Bundle IDcom.crowdstrike.falcon.Agent`identifier "com.crowdstrike.falcon.Agent" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = X9E956P446`2.Bundle IDcom.crowdstrike.falcon.App`identifier "com.crowdstrike.falcon.App" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = X9E956P446`8. To configure third-party **Plugin web content filter** and **Notification Settings**, select **Deploy Custom Configuration** and upload your configuration profile. Here’s a sample configuration profile: Custom Configuration Profile for deploying Crowdstrike
PayloadContent NotificationSettings BundleIdentifier com.crowdstrike.falcon.UserAgent CriticalAlertEnabled PayloadDisplayName Notifications PayloadIdentifier com.apple.notificationsettings.C0CF3EF6-9747-4476-8154-98C009EAF07C PayloadType com.apple.notificationsettings PayloadUUID C0CF3EF6-9747-4476-8154-98C009EAF07C PayloadVersion 1 FilterDataProviderBundleIdentifier com.crowdstrike.falcon.Agent FilterDataProviderDesignatedRequirement identifier "com.crowdstrike.falcon.Agent" and anchor apple generic and certificate 1\[field.1.2.840.113635.100.6.2.6\] and certificate leaf\[field.1.2.840.113635.100.6.1.13\] and certificate leaf\[subject.OU\] = "X9E956P446" FilterGrade inspector FilterPacketProviderBundleIdentifier com.crowdstrike.falcon.Agent FilterPacketProviderDesignatedRequirement identifier "com.crowdstrike.falcon.Agent" and anchor apple generic and certificate 1\[field.1.2.840.113635.100.6.2.6\] and certificate leaf\[field.1.2.840.113635.100.6.1.13\] and certificate leaf\[subject.OU\] = "X9E956P446" FilterPackets FilterSockets FilterType Plugin Organization Crowdstrike Inc PayloadDisplayName Crowdstrike PayloadIdentifier com.apple.webcontent-filter.37A525E7-88FB-44A2-9966-1EDB43D4C692 PayloadType com.apple.webcontent-filter PayloadUUID 37A525E7-88FB-44A2-9966-1EDB43D4C692 PayloadVersion 1 PluginBundleID com.crowdstrike.falcon.App UserDefinedName Crowdstrike Falcon PayloadDisplayName CrowdstrikeFalcon PayloadIdentifier D02B6591-182E-42E9-9C4E-61D852243FAC PayloadType Configuration PayloadUUID D02B6591-182E-42E9-9C4E-61D852243FAC PayloadVersion 1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
PayloadContent
NotificationSettings
BundleIdentifier
com.crowdstrike.falcon.UserAgent
CriticalAlertEnabled
PayloadDisplayName
Notifications
PayloadIdentifier
com.apple.notificationsettings.C0CF3EF6-9747-4476-8154-98C009EAF07C
PayloadType
com.apple.notificationsettings
PayloadUUID
C0CF3EF6-9747-4476-8154-98C009EAF07C
PayloadVersion
1
FilterDataProviderBundleIdentifier
com.crowdstrike.falcon.Agent
FilterDataProviderDesignatedRequirement
identifier "com.crowdstrike.falcon.Agent" and anchor apple generic and certificate 1\[field.1.2.840.113635.100.6.2.6\] and certificate leaf\[field.1.2.840.113635.100.6.1.13\]
and certificate leaf\[subject.OU\] = "X9E956P446"
FilterGrade
inspector
FilterPacketProviderBundleIdentifier
com.crowdstrike.falcon.Agent
FilterPacketProviderDesignatedRequirement
identifier "com.crowdstrike.falcon.Agent" and anchor apple generic and certificate 1\[field.1.2.840.113635.100.6.2.6\] and certificate leaf\[field.1.2.840.113635.100.6.1.13\]
and certificate leaf\[subject.OU\] = "X9E956P446"
FilterPackets
FilterSockets
FilterType
Plugin
Organization
Crowdstrike Inc
PayloadDisplayName
Crowdstrike
PayloadIdentifier
com.apple.webcontent-filter.37A525E7-88FB-44A2-9966-1EDB43D4C692
PayloadType
com.apple.webcontent-filter
PayloadUUID
37A525E7-88FB-44A2-9966-1EDB43D4C692
PayloadVersion
1
PluginBundleID
com.crowdstrike.falcon.App
UserDefinedName
Crowdstrike Falcon
PayloadDisplayName
CrowdstrikeFalcon
PayloadIdentifier
D02B6591-182E-42E9-9C4E-61D852243FAC
PayloadType
Configuration
PayloadUUID
D02B6591-182E-42E9-9C4E-61D852243FAC
PayloadVersion
1
9. For **macOS Sequoia 15.0.1 and later**, you can prevent users from manually removing the **CrowdStrike Falcon Sensor** system extension via System Settings. Here’s a sample configuration profile that can be deployed via **Deploy Custom Configuration**: Custom Configuration Profile for preventing manual removal of CrowdStrike Falcon Sensor
PayloadDisplayName CrowdStrike - System Extension non-removable from UI PayloadDescription CrowdStrike - System Extension non-removable from UI PayloadIdentifier 9F3B02F8-1A67-4C8E-8BFA-D4E9E8A5F7C1 PayloadUUID 9F3B02F8-1A67-4C8E-8BFA-D4E9E8A5F7C1 PayloadOrganization CrowdStrike, Inc. PayloadRemovalDisallowed PayloadType Configuration PayloadVersion 1 PayloadContent PayloadDisplayName CrowdStrike - System Extension non-removable from UI PayloadDescription CrowdStrike - System Extension non-removable from UI PayloadIdentifier 36CA716D-92E3-4A4D-94BD-17E77E24F403 PayloadUUID 36CA716D-92E3-4A4D-94BD-17E77E24F403 PayloadType com.apple.system-extension-policy NonRemovableFromUISystemExtensions X9E956P446 com.crowdstrike.falcon.Agent
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
PayloadDisplayName
CrowdStrike - System Extension non-removable from UI
PayloadDescription
CrowdStrike - System Extension non-removable from UI
PayloadIdentifier
9F3B02F8-1A67-4C8E-8BFA-D4E9E8A5F7C1
PayloadUUID
9F3B02F8-1A67-4C8E-8BFA-D4E9E8A5F7C1
PayloadOrganization
CrowdStrike, Inc.
PayloadRemovalDisallowed
PayloadType
Configuration
PayloadVersion
1
PayloadContent
PayloadDisplayName
CrowdStrike - System Extension non-removable from UI
PayloadDescription
CrowdStrike - System Extension non-removable from UI
PayloadIdentifier
36CA716D-92E3-4A4D-94BD-17E77E24F403
PayloadUUID
36CA716D-92E3-4A4D-94BD-17E77E24F403
PayloadType
com.apple.system-extension-policy
NonRemovableFromUISystemExtensions
X9E956P446
com.crowdstrike.falcon.Agent
10. To associate the policy with your devices, navigate to **Policy Targets**, select all your required devices, and click on **Save**.
Disclaimer:The sample configuration profile given above is subject to OS or application updates. It is recommended to verify the configuration profile on the targeted OS versions using third-party profile editors before deploying it in bulk.
What happens once the policy is associated?
---------------------------------------------
After associating the policy with the device, the following processes are initiated, depending on the configurations specified in the policy.
1. The CrowdStrike sensor PKG gets installed on the device, consisting of two apps: the Crowdstrike agent app and the Crowdstrike sensor app.
2. The system extensions and kernel extensions configurations allocate the necessary permissions to the applications accordingly.
3. The Crowdstrike agent and Crowdstrike sensor apps are granted Full Disk Access. The apps may or may not appear in list under ***Privacy & Security > Full Disk Access*** with the toggle button on/off on the device end. Rest assured that the permissions have been successfully granted to them.
4. Third-party Plugin web content filtering and Notification Settings are configured.
License the Product using Custom Scripting
-------------------------------------------
Execute the following script to license your CrowdStrike Falcon agent using [Custom Scripts](https://www.hexnode.com/mobile-device-management/help/how-to-run-scripts-on-mac-using-hexnode-mdm/) or [Live Terminal](https://www.hexnode.com/mobile-device-management/help/how-to-enable-live-terminal-on-your-macos-devices/):
License token script
sudo /Applications/Falcon.app/Contents/Resources/falconctl license ‘TOKEN\_HERE’
1
sudo /Applications/Falcon.app/Contents/Resources/falconctl license ‘TOKEN\_HERE’
Uninstalling the Falcon Sensor
------------------------------
If maintenance protection is disabled, run the following script using [Custom Scripts](https://www.hexnode.com/mobile-device-management/help/how-to-run-scripts-on-mac-using-hexnode-mdm/) or [Live Terminal](https://www.hexnode.com/mobile-device-management/help/how-to-enable-live-terminal-on-your-macos-devices/):
License token script
sudo /Applications/Falcon.app/Contents/Resources/falconctl uninstall
1
sudo /Applications/Falcon.app/Contents/Resources/falconctl uninstall
Follow the below steps when the maintenance protection is enabled:
1. In the CrowdStrike cloud console, find the endpoint on the Host Management screen and click on it to access further details about the host.
2. Click the *Reveal maintenance* token button.
3. Write a reason for using the token and click the Reveal Token button. Note the maintenance token.
4. Start the [Live Terminal](https://www.hexnode.com/mobile-device-management/help/how-to-enable-live-terminal-on-your-macos-devices/) from the device management tab and run the following script:
License token script
sudo /Applications/Falcon.app/Contents/Resources/falconctl uninstall --maintenance-token
1
sudo /Applications/Falcon.app/Contents/Resources/falconctl uninstall --maintenance-token
6. Enter the maintenance token when prompted.
The CrowdStrike Falcon will be uninstalled.