Symptoms

This article covers the installation process for CrowdStrike Falcon Sensor. Affected Products: CrowdStrike Falcon Sensor Affected Operating Systems: WindowsMacLinux

Cause

Not applicable

Resolution

Note: Before installation, ensure that all requirements are met by referencing CrowdStrike Falcon Sensor System Requirements. Click Windows, macOS, or Linux for the installation process. Windows CrowdStrike Falcon Sensor can be installed on Windows through the: UI (user interface)CLI (command-line interface) Click the appropriate method for more information. UI To install the product by UI: Double-click WindowsSensor.exe. Note: For information about obtaining the installer, reference How to Download the CrowdStrike Falcon Sensor. If User Account Control (UAC) is enabled, click Yes. Otherwise go to Step 3. In the install UI: Accept the license agreement.Populate the Customer ID.Click Install. Note: To locate the Customer ID (CID), reference How to Obtain the CrowdStrike Customer Identification (CID).The CID is used to associate the endpoint to the CrowdStrike Falcon Console. On successful installation, click Close. CLI Note: Switches are not case-sensitive. SwitchRequiredPurpose/installYesInstalls the CrowdStrike Falcon Sensor./passiveNoThe installer shows a minimal UI with no prompts./quietNoSuppresses UI and prompts./norestartNoPrevents the host from restarting after installation./logNoChanges the default installation log directory from %Temp% to a new location. The new location must be contained in quotation marks (""). Note: Parameters are case-sensitive. ParameterValueRequiredPurposeCID=See Examples1YesUses customer identification (CID) to associate sensor to CrowdStrike Falcon Console.NO_START=0 (Default)NoStarts the sensor immediately after installation.1Prevents the sensor from starting after installation. The next time the host boots, the sensor is assigned an agent ID (AID).VDI=1NoConfigures sensor for a virtual desktop infrastructure (VDI) environment. Updates AID after system initialization.APP_PROXYNAME=See ExamplesNoConfigures sensor to use a proxy connection. Cannot be used with PACURL.APP_PROXYPORT=See ExamplesNoSpecifies APP_PROXYNAME port.PACURL=See ExamplesNoConfigures a proxy connection using a PAC file. Cannot be used with either APP_PROXYNAME or APP_PROXYPORT.PROXYDISABLE=0 (Default)NoAttempts to connect to CrowdStrike Falcon Console using any available proxy connections.1The parameter ignores any automatic proxy connection.ProvNoWait=0 (Default)NoThe parameter uninstalls the sensor if unable to connect to CrowdStrike Falcon Console within 10 minutes.1The parameter prevents uninstall if unable to connect to CrowdStrike Falcon Console. 1Reference How to Obtain the CrowdStrike Customer Identification (CID) for more information. Note: For information about obtaining the installer, reference How to Download the CrowdStrike Falcon Sensor. CLI Installation Examples: Example #1: WindowsSensor.exe /install NO_START=1 CID=ABCDEF123GHI-J6 Example #1 contains: Installer = WindowsSensor.exeCID = ABCDEF123GHI-J6Silent install = No Default value since not defined. End-user installation prompts = Yes Default value since not defined. Start sensor post installation = Yes Default value since not defined. VDI deployment = No Default since not defined. Configured Proxy/Port = No Default value since not defined. Connect using automatic proxy connection = Yes Default value since not defined. Uninstall if unable to connect to CrowdStrike Falcon Console = Yes Default value since not defined. Installation Directory = %TEMP% Default value since not defined. Example #2: WindowsSensor.exe /install NO_START=1 /quiet /norestart ProvNoWait=1 CID=ABCDEF123GHI-J6 /log "C:\Logs" Example #2 contains: Installer = WindowsSensor.exeCID = ABCDEF123GHI-J6Silent install = YesEnd-user installation prompts = NoStart sensor post installation = No Default value since not defined. VDI deployment = No Default since not defined. Configured Proxy/Port = No Default value since not defined. Connect using automatic proxy connection = Yes Default value since not defined. Uninstall if unable to connect to CrowdStrike Falcon Console = NoInstallation Directory = C:\Logs Example #3: WindowsSensor.exe /install VDI=1 NO_START=1 APP_PROXYNAME=proxy.domain.com APP_PROXYPORT=1234 ProvNoWait=1 PROXYDISABLE=1 /quiet CID=ABCDEF123GHI-J6 Example #3 contains: Installer = WindowsSensor.exeCID = ABCDEF123GHI-J6Silent install = YesEnd-user installation prompts = NoStart sensor post installation = NoVDI deployment = YesConfigured Proxy/Port = proxy.domain.com/1234Connect using automatic proxy connection = NoUninstall if unable to connect to CrowdStrike Falcon Console = NoInstallation Directory = %TEMP% Default value since not defined. macOS v5.10.9003 and Later To install the product: In the Apple menu, click Go and then select Utilities. In the Utilities folder, double-click Terminal. In Terminal, type sudo installer -verboseR -package [INSTALLPATH]/FalconSensorMacOS.pkg -target / and then press Enter. Note: [INSTALLPATH] = The directory where the installer is locatedFor information about obtaining the installer, reference How to Download the CrowdStrike Falcon Sensor. Populate the password for sudo and then press Enter. Type sudo /Library/CS/falconctl license 'CID' and then press Enter. Note: 'CID' = The Customer Identification that has been collected from the CrowdStrike Falcon ConsoleFor more information, reference How to Obtain the CrowdStrike Customer Identification (CID). If running: macOS Mojave (10.14.5) and later: Kernel Extensions must be approved for product functionality. For more information, reference How to Allow Dell Data Security Kernel Extensions on macOS.Full Disk Access must be granted for full protection. For more information, reference How to Grant Full Disk Access for the CrowdStrike Falcon Sensor. macOS High Sierra (10.13) or later: Kernel Extensions must be approved for product functionality. For more information, reference How to Allow Dell Data Security Kernel Extensions on macOS. macOS Sierra (10.12) and earlier, no further action is required. Linux Click Red Hat Enterprise Linux, CentOS, Amazon Linux, Ubuntu, or SLES for the steps to install CrowdStrike Falcon Sensor. Red Hat Enterprise Linux, CentOS, Amazon Linux CrowdStrike Falcon Sensor must be installed using Terminal on Linux. To install the product by Terminal for Red Hat Enterprise Linux, CentOS, or Amazon Linux: Open the Linux Terminal.In Terminal, type sudo yum install falcon-sensor-[VERSION].[EXT] and then press Enter. Note: [VERSION] = The version of the CrowdStrike Falcon Sensor installer file[EXT] = The extension of the CrowdStrike Falcon Sensor installer file Installer extensions can differ between Linux distributions. For information about obtaining the installer, reference How to Download the CrowdStrike Falcon Sensor. Type Y and then press Enter to confirm installation. Type sudo /opt/CrowdStrike/falconctl -s –cid=[CID] and then press Enter. Note: [CID] = Customer Identification for CrowdStrike Falcon Console[CID] is only present on installers that are downloaded from Google Chrome.For information about obtaining the installer, reference How to Download the CrowdStrike Falcon Sensor. Type: Hosts with SysVinit: service falcon-sensor start and then press Enter.Hosts with Systemd: systemctl start falcon-sensor and then press Enter. Ubuntu CrowdStrike Falcon Sensor must be installed using Terminal on Linux. To install the product by Terminal for Ubuntu: Open the Linux Terminal.In Terminal, type sudo dpkg -i falcon-sensor-[VERSION].[EXT] and then press Enter. Note: [VERSION] = The version of the CrowdStrike Falcon Sensor installer file[EXT] = The extension of the CrowdStrike Falcon Sensor installer file Installer extensions can differ between Linux distributions. For information about obtaining the installer, reference How to Download the CrowdStrike Falcon Sensor. Type Y and then press Enter to confirm installation. Type sudo /opt/CrowdStrike/falconctl -s –cid=[CID] and then press Enter. Note: [CID] = Customer Identification for CrowdStrike Falcon Console[CID] is only present on installers that are downloaded from Google Chrome.For information about obtaining the installer, reference How to Download the CrowdStrike Falcon Sensor. Type: Hosts with SysVinit: service falcon-sensor start and then press Enter.Hosts with Systemd: systemctl start falcon-sensor and then press Enter. SLES CrowdStrike Falcon Sensor must be installed using Terminal on Linux. To install the product by Terminal for SLES: Open the Linux Terminal.In Terminal, type sudo zypper install falcon-sensor-[VERSION].[EXT] and then press Enter. Note: [VERSION] = The version of the CrowdStrike Falcon Sensor installer file[EXT] = The extension of the CrowdStrike Falcon Sensor installer file Installer extensions can differ between Linux distributions. For information about obtaining the installer, reference How to Download the CrowdStrike Falcon Sensor. Type Y and then press Enter to confirm installation. Type sudo /opt/CrowdStrike/falconctl -s –cid=[CID] and then press Enter. Note: [CID] = Customer Identification for CrowdStrike Falcon Console[CID] is only present on installers that are downloaded from Google Chrome.For information about obtaining the installer, reference How to Download the CrowdStrike Falcon Sensor. Type: Hosts with SysVinit: service falcon-sensor start and then press Enter.Hosts with Systemd: systemctl start falcon-sensor and then press Enter. To contact support, reference Dell Data Security International Support Phone Numbers.Go to TechDirect to generate a technical support request online.For additional insights and resources, join the Dell Security Community Forum.

Support Cases