14 DAY FREE TRIAL

No Search Results

No Search Results

14 DAY FREE TRIAL
  1. Help Center
  2. Managing Mac Devices
  3. Security

Category filter

How to deploy CrowdStrike Falcon to your Macs using Hexnode UEM?

Jump To

What is CrowdStrike Falcon?

CrowdStrike Falcon is a cloud-based endpoint security system that provides an industry-leading anti-virus solution for your macOS and Windows devices. The Falcon is powered by the latest technologies in AI and ML to ensure that security breaches and malware are neutralized before they cause significant damage to your devices.

The capabilities of the CrowdStrike Falcon platform are:

  • Industry-leading next-generation anti-virus (NGAV) solution
  • Endpoint detection and response (EDR) system
  • Cyber threat intelligence
  • Managed threat hunting
  • Security hygiene

Once the Falcon sensor gets installed on your device, you can monitor all your devices from the Falcon console.

Steps to deploy the CrowdStrike Falcon sensor

Upload the Falcon sensor PKG file to Hexnode’s app inventory

The Falcon sensor PKG file can be downloaded from the Crowdstrike console under Host setup and management > Sensor downloads. Follow the steps below to upload the PKG file to Hexnode’s app inventory:

  1. Navigate to the Apps tab, click on the +Add Apps dropdown, and select Enterprise App.
  2. Select macOS, enter the application’s required details, and upload the PKG file.
  3. Click on Add.

Create a policy to deploy CrowdStrike Falcon sensor along with the required configurations

You need to configure System Extensions, Kernel Extensions and PPPC settings for the CrowdStrike Falcon sensor to operate flawlessly on your devices. Kernel Extensions must be configured only if your Mac runs on macOS 10.14 and below. Follow the steps given below to create a policy with all the required configurations to deploy the CrowdStrike Falcon sensor:

  1. Navigate to Policies > New Policy > macOS.
  2. To deploy the CrowdStrike Falcon sensor,
    1. Select Mandatory Apps from the left menu and click on Configure.
    2. Click on +Add > Add App and select the CrowdStrike sensor PKG file.
    3. Click on Done.
  3. To configure System Extensions,
    1. Select System Extensions from the left menu and click on Configure.
    2. Under Team Identifier, enter X9E956P446 as the Team ID and click on Add.
  4. To configure Kernel Extensions,
    1. Select Kernel Extensions from the left menu and click on Configure.
    2. Under Team Identifier, enter X9E956P446 as the Team ID and click on Add.
  5. To configure PPPC,
    1. Select Privacy Preferences from the left menu and click on Configure.
    2. Select +Add new preferences.
    3. Set the Full Disk Access option to Allow.
    4. Click on Specify Bundle IDs/Path.

    6. Full Disk Access needs to be given for the following components:

    Sl No Identifier Type Identifier Code Requirement
    1. Bundle ID com.crowdstrike.falcon.Agent identifier “com.crowdstrike.falcon.Agent” and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = X9E956P446
    2. Bundle ID com.crowdstrike.falcon.App identifier “com.crowdstrike.falcon.App” and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = X9E956P446
  6. To configure third-party Plugin web content filter and Notification Settings, select Deploy Custom Configuration and upload the following configuration profile we’ve created for you:

    You can use the above configuration profile or create your custom configuration profile.

  7. To associate the policy to your devices, navigate to Policy Targets, select all your required devices, and click on Save.
Need more help?
Raise a Ticket Raise a Ticket
Ask Community Ask Community
Chat With us Chat With us
  • Managing Mac Devices