diff --git a/articles/deploying-crowdstrike-with-fleet.md b/articles/deploying-crowdstrike-with-fleet.md new file mode 100644 index 0000000000..bc11b59191 --- /dev/null +++ b/articles/deploying-crowdstrike-with-fleet.md @@ -0,0 +1,137 @@ +# Deploy CrowdStrike Falcon with Fleet + +This guide will show you how to deploy CrowdStrike Falcon on macOS, Linux and Windows using Fleet. It covers installing the CrowdStrike Falcon application, creating a post-install script for collecting the CrowdStrike Customer ID for activation and deploying required application configurations. + +## Upload the CrowdStrike Falcon installer to Fleet + +1. In the Falcon console, go to **Host setup and management** > **Sensor Downloads**. +2. Download the installer for the appropriate OS and architecture. +3. In Fleet, go to **Software > Add software > Custom package** to upload the installer. +4. Select **Automatic install** or **Self-service** if these options apply to your environment. + +>If needed, use [labels](https://fleetdm.com/guides/managing-labels-in-fleet) to scope installations for different hardware architectures. + +## Create a post-install script for collecting the CrowdStrike Customer ID + +Your CrowdStrike **Customer ID** can be found on the Sensor download page in the CrowdStrike console. + +The **Customer ID** _must be collected_ during the installation to activate the Falcon application. Adding the platfom-specifc scripts below as a post-install action to the uploaded CrowdStrike Falcon custom package settings in Fleet will allow the host on which the application has been installed to collect the **Customer ID** for activation in the CrowdStrike tenant. + +>For reference, Crowdstrike Falcon scripts and install documentation can be found at: https://github.com/CrowdStrike/falcon-scripts + +## macOS + +If your organization is using Fleet GitOps and you want to pass the CrowdStrike site key as a secret, follow this guide: https://fleetdm.com/guides/secrets-in-scripts-and-configuration-profiles. + +For admins using the macOS Setup Experience in Fleet, we recommend adding the Falcon application to the list of software being installed during initial provisioning. + +### Upload a macOS post-install script to Fleet for collecting the CrowdStrike Customer ID + +To use this script, copy your **Customer ID** from the CrowdStrike console, then, paste it into the value for the `CUSTOMER_ID` variable below. Next, copy the modified script to the CrowdStrike Falcon custom package settings as a post-install action in Fleet: + +``` +#!/bin/bash +CUSTOMER_ID="YOUR-CUSTOMER-ID-HERE" +FALCON_PATH="/Applications/Falcon.app/Contents/Resources/falconctl" + +sudo "$FALCON_PATH" license "$CUSTOMER_ID" + +# Check status +if [ $? -eq 0 ]; then + echo "Activation completed" +else + echo "Activation failed" + exit 1 +fi +``` + +### Upload macOS configuration files to Fleet + +CrowdStrike Falcon requires multiple `.mobileconfig` payloads on macOS. + +>These payloads can be combined into a single Configuration Profile, or, delivered in separate Configuration Profiles for modularity and easier reading. + +`crowdstrike-service-management.mobileconfig` - Configure CrowdStrike Falcon as a managed login item so its services can't be stopped by end users. + +`crowdstrike-notification.mobileconfig` - Suppress notifications to reduce end user notifcation fatigue. (This is a best practice for many fully-managed applications.) + +`crowdstrike-system-extension` - Install the CrowdStrike Falcon System Extension to allow all necessary application entitlements and access to the macOS kernel. + +`crowdstrike-web-filter.mobileconfig` - Enable web filtering to monitor network traffic at the socket level. + +`crowdstrike-full-disk-access.mobileconfig` - Grant full disk access to all CrowdStrike application processes using the CrowdStrike Apple Developer team identifier. + +## Linux + +### Upload a Linux post-install script to Fleet for collecting the CrowdStrike Customer ID + +To use this script, copy your **Customer ID** from the CrowdStrike console, then, paste it into the value for the `FalconCid` variable below. Next, copy the modified script to the CrowdStrike Falcon custom package settings as a post-install action in Fleet: + +``` +#!/bin/bash + +# Set your Customer ID here +FalconCid = "YOUR-CUSTOMER-ID-HERE + +echo "Setting CrowdStrike Falcon Customer ID: $FalconCid" + +# Set the Customer ID +sudo /opt/CrowdStrike/falconctl -s --cid="$FalconCid" + +# Check if the command was successful +if [ $? -eq 0 ]; then + echo "Customer ID set successfully!" + + # Verify the setting + echo "Verifying Customer ID..." + sudo /opt/CrowdStrike/falconctl -g --cid +else + echo "Error: Failed to set Customer ID" + exit 1 +fi +``` + +Admins can verify the installation by running the following command which searches for the falcon-sensor binary: + +``` +sudo ps -e | grep falcon-sensor +``` + +## Windows + +CrowdStrike offers `.exe` and `.msi` Falcon installers for Windows. Using the `.msi` inataller in Fleet is preferred as this installer type performs a silent, fully-automated installation when using the **Automatic install** option. + +### Upload a Windows post-install script to Fleet for collecting the CrowdStrike Customer ID + +To use this script, copy your **Customer ID** from the CrowdStrike console, then, paste it into the value for the `$FalconCid` variable below. Next, copy the modified script to the CrowdStrike Falcon custom package settings as a post-install action in Fleet: + +``` +# Set your Customer ID here +$FalconCid = "YOUR-CUSTOMER-ID-HERE" + +$logFile = "${env:TEMP}/fleet-install-software.log" +try { +$installProcess = Start-Process msiexec.exe ` + -ArgumentList "/quiet /norestart /lv ${logFile} /i `"${env:INSTALLER_PATH}`" CID=${FalconCid}" ` + -PassThru -Verb RunAs -Wait +Get-Content $logFile -Tail 500 +Exit $installProcess.ExitCode +} catch { + Write-Host "Error: $_" + Exit 1 +} +``` + +There are several other flags that can be added to this script. See: https://github.com/CrowdStrike/falcon-scripts for a list of supported options. + +## Conclusion + +Fleet offers admins a straight-forward approach to deploying the CrowdStrike Falcon application across your macOS, Linux and Windows hosts. See https://fleetdm.com/guides/deploy-software-packages for more information on installing software packages using Fleet. + + + + + + + + diff --git a/assets/configuration-profiles/crowdstrike-full-disk-access.mobileconfig b/assets/configuration-profiles/crowdstrike-full-disk-access.mobileconfig new file mode 100644 index 0000000000..a6b05c7bde --- /dev/null +++ b/assets/configuration-profiles/crowdstrike-full-disk-access.mobileconfig @@ -0,0 +1,79 @@ + + + + + PayloadContent + + + PayloadDescription + Configures Privacy Preferences Policy Control settings for CrowdStrike + PayloadDisplayName + Full Disk Access - Crowdstrike + PayloadIdentifier + com.fleet.privacy + PayloadOrganization + CrowdStrike Inc. + PayloadType + com.apple.TCC.configuration-profile-policy + PayloadUUID + C7B25543-8A46-4782-B5F1-FABF2CC07934 + PayloadVersion + 1 + Services + + SystemPolicyAllFiles + + + Allowed + + CodeRequirement + identifier "com.crowdstrike.falcon.Agent" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = X9E956P446 + Comment + + Identifier + com.crowdstrike.falcon.Agent + IdentifierType + bundleID + StaticCode + + + + Allowed + + CodeRequirement + identifier "com.crowdstrike.falcon.App" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = X9E956P446 + Comment + + Identifier + com.crowdstrike.falcon.App + IdentifierType + bundleID + StaticCode + + + + + + + PayloadDescription + CrowdStrike Falcon Full Disk Access + PayloadDisplayName + CrowdStrike - Privacy Preferences + PayloadEnabled + + PayloadIdentifier + com.fleet.privacy + PayloadOrganization + Fleet + PayloadRemovalDisallowed + + PayloadScope + System + PayloadType + Configuration + PayloadUUID + A4A2274E-370D-4641-A248-7A637ADFB169 + PayloadVersion + 1 + + \ No newline at end of file diff --git a/assets/configuration-profiles/crowdstrike-notification.mobileconfig b/assets/configuration-profiles/crowdstrike-notification.mobileconfig new file mode 100644 index 0000000000..6ab64184bf --- /dev/null +++ b/assets/configuration-profiles/crowdstrike-notification.mobileconfig @@ -0,0 +1,58 @@ + + + + + PayloadContent + + + NotificationSettings + + + AlertType + 1 + BundleIdentifier + com.crowdstrike.falcon.UserAgent + CriticalAlertEnabled + + NotificationsEnabled + + ShowInLockScreen + + ShowInNotificationCenter + + + + PayloadDisplayName + Notifications + PayloadIdentifier + com.fleet.notifications + PayloadType + com.apple.notificationsettings + PayloadUUID + F5E94A3F-6E76-4A28-AF32-068455731244 + PayloadVersion + 1 + + + PayloadDescription + CrowdStrike Falcon Notification settings + PayloadDisplayName + CrowdStrike - Notifications + PayloadEnabled + + PayloadIdentifier + com.fleet.notifications + PayloadOrganization + Fleet + PayloadRemovalDisallowed + + PayloadScope + System + PayloadType + Configuration + PayloadUUID + F749D9AF-DE8B-45B0-98F5-CACA98C67FEC + PayloadVersion + 1 + + \ No newline at end of file diff --git a/assets/configuration-profiles/crowdstrike-service-management.mobileconfig b/assets/configuration-profiles/crowdstrike-service-management.mobileconfig new file mode 100644 index 0000000000..3d440cc1ea --- /dev/null +++ b/assets/configuration-profiles/crowdstrike-service-management.mobileconfig @@ -0,0 +1,60 @@ + + + + + PayloadContent + + + PayloadDescription + Configures Service Management settings for CrowdStrike Falcon + PayloadDisplayName + Service Management + PayloadIdentifier + com.fleet.servicemanagement + PayloadOrganization + CrowdStrike Inc. + PayloadType + com.apple.servicemanagement + PayloadUUID + B2C3D4E5-F6G7-8901-2345-678901BCDEFG + PayloadVersion + 1 + Rules + + + RuleType + BundleIdentifier + RuleValue + com.crowdstrike.falcon.UserAgent + + + RuleType + TeamIdentifier + RuleValue + X9E956P446 + + + + + PayloadDescription + CrowdStrike Falcon Service Management configuration + PayloadDisplayName + CrowdStrike - Service Management + PayloadEnabled + + PayloadIdentifier + com.fleet.servicemanagement + PayloadOrganization + Fleet + PayloadRemovalDisallowed + + PayloadScope + System + PayloadType + Configuration + PayloadUUID + 5007F4E7-372B-4B90-8E64-BDC59E4C1D93 + PayloadVersion + 1 + + \ No newline at end of file diff --git a/assets/configuration-profiles/crowdstrike-system-extension.mobileconfig b/assets/configuration-profiles/crowdstrike-system-extension.mobileconfig new file mode 100644 index 0000000000..809f06cdba --- /dev/null +++ b/assets/configuration-profiles/crowdstrike-system-extension.mobileconfig @@ -0,0 +1,61 @@ + + + + + PayloadContent + + + AllowUserOverrides + + AllowedSystemExtensions + + X9E956P446 + + com.crowdstrike.falcon.Agent + + + NonRemovableFromUISystemExtensions + + X9E956P446 + + com.crowdstrike.falcon.Agent + + + PayloadDescription + Configures System Extensions Policy settings for CrowdStrike Falcon + PayloadDisplayName + System Extensions - Crowdstrike + PayloadIdentifier + com.fleet.systemextensions + PayloadOrganization + CrowdStrike Inc. + PayloadType + com.apple.system-extension-policy + PayloadUUID + 6527669C-0C1F-4B84-998F-33902DBFEB86 + PayloadVersion + 1 + + + PayloadDescription + CrowdStrike Falcon System Extensions configuration + PayloadDisplayName + CrowdStrike - System Extensions + PayloadEnabled + + PayloadIdentifier + com.fleet.systemextensions + PayloadOrganization + Fleet + PayloadRemovalDisallowed + + PayloadScope + System + PayloadType + Configuration + PayloadUUID + C84A8495-1B68-4C28-B29B-FDF3A40018D4 + PayloadVersion + 1 + + \ No newline at end of file diff --git a/assets/configuration-profiles/crowdstrike-web-filter.mobileconfig b/assets/configuration-profiles/crowdstrike-web-filter.mobileconfig new file mode 100644 index 0000000000..51b49618f8 --- /dev/null +++ b/assets/configuration-profiles/crowdstrike-web-filter.mobileconfig @@ -0,0 +1,57 @@ + + + + + PayloadContent + + + FilterDataProviderBundleIdentifier + com.crowdstrike.falcon.Agent + FilterDataProviderDesignatedRequirement + identifier "com.crowdstrike.falcon.Agent" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] and certificate leaf[field.1.2.840.113635.100.6.1.13] and certificate leaf[subject.OU] = "X9E956P446" + FilterGrade + inspector + FilterPackets + + FilterSockets + + FilterType + Plugin + Organization + CrowdStrike Inc. + PayloadDisplayName + Web Content Filter + PayloadIdentifier + com.fleet.webfilter + PayloadType + com.apple.webcontent-filter + PayloadUUID + E63C7607-408B-485F-BF2F-0900AAE6797F + PayloadVersion + 1 + PluginBundleID + com.crowdstrike.falcon.App + + + PayloadDescription + CrowdStrike Falcon Web Content Filter configuration + PayloadDisplayName + CrowdStrike - Web Filter + PayloadEnabled + + PayloadIdentifier + com.fleet.webfilter + PayloadOrganization + Fleet + PayloadRemovalDisallowed + + PayloadScope + System + PayloadType + Configuration + PayloadUUID + 141ECE18-BC29-4A0E-9743-055A4E649512 + PayloadVersion + 1 + + \ No newline at end of file diff --git a/website/assets/images/articles/fleet-crowdstrike-cover-800x450@2x.png b/website/assets/images/articles/fleet-crowdstrike-cover-800x450@2x.png new file mode 100644 index 0000000000..c0a0d6c361 Binary files /dev/null and b/website/assets/images/articles/fleet-crowdstrike-cover-800x450@2x.png differ