Overview

CrowdStrike Falcon is a cloud-native endpoint detection and response (EDR) platform built on a lightweight agent (the Falcon sensor) that streams telemetry to the CrowdStrike Security Cloud in real time. All policy management, threat hunting, and response actions are performed through the Falcon console — there is no on-premises management server.

This article covers the configuration decisions that matter most when deploying Falcon in an enterprise: sensor deployment, prevention policies, detection tuning, device control, firewall management, and identity protection.

Sensor Deployment

Supported Platforms

Deployment Methods

Windows

# Silent install with Customer ID (CID)
WindowsSensor.exe /install /quiet /norestart CID=<CID>-<checksum>

# Verify sensor is running
sc query csagent
Get-Service -Name CSAgent

macOS

# Install via MDM (Jamf, Mosyle, Kandji) or direct package
sudo installer -pkg falcon-sensor-<version>.pkg -target /

# Verify
sudo /Applications/Falcon.app/Contents/Resources/falconctl stats

Linux

# RHEL/CentOS
sudo rpm -ivh falcon-sensor-<version>.rpm
sudo /opt/CrowdStrike/falconctl set --cid=<CID>
sudo systemctl start falcon-sensor

# Ubuntu/Debian
sudo dpkg -i falcon-sensor_<version>_amd64.deb
sudo /opt/CrowdStrike/falconctl set --cid=<CID>
sudo systemctl start falcon-sensor

# Verify
sudo systemctl status falcon-sensor
sudo /opt/CrowdStrike/falconctl stats

Sensor Tags & Grouping

Sensor tags are used to assign devices to groups without relying solely on AD membership or hostname patterns.

# Windows — set tag at install time
WindowsSensor.exe /install /quiet CID=<CID> GROUPING_TAGS="production,finance"

Tags support hierarchical notation (datacenter/us-east/prod) and are case-insensitive. Groups drive policy assignment — plan your tag taxonomy before mass-deployment.

Host Groups

Host groups are the fundamental unit for policy targeting. A device can belong to multiple groups; the highest-precedence policy assigned to any matching group wins.

Group types:

Best practice: Create at minimum three groups — Servers, Workstations, and Sensitive Workstations (executives, finance, security team) — and tune prevention aggressiveness accordingly.

Prevention Policies

Prevention policies control what the sensor blocks autonomously, without a human in the loop. Each policy maps to one or more host groups.

Windows Prevention Settings

Navigate to: Endpoint Security → Prevention Policies → Windows

Next-Generation Antivirus (NGAV)

Process-Based Exploit Mitigations

Script Control

Rollout approach: Always start new environments in Detect mode. After 2–4 weeks of baseline telemetry, promote to Block incrementally, starting with the settings most likely to catch real attacks (exploitation, process hollowing) before tackling those with higher false-positive risk (interpreter-only script blocking).

Ransomware Protection

Identity & Credential Protection

macOS Prevention Settings

macOS requires additional kernel/system extensions to be approved via MDM before the sensor can enforce prevention.

<!-- MDM Profile — approve CrowdStrike system extension -->
<key>AllowedSystemExtensions</key>
<dict>
    <key>X9E956P446</key>
    <array>
        <string>com.crowdstrike.falcon.Agent</string>
    </array>
</dict>

Key macOS-specific settings:

Detection Policies

Detection policies control what the sensor alerts on — what appears in the Falcon console as detections and is sent to SIEM integrations. These are separate from prevention and should be tuned more aggressively because the cost of a false positive is an alert, not a blocked operation.

Navigate to: Endpoint Security → Detection Policies

Recommended Detection Sensitivity

Indicator of Attack (IoA) Rules

Custom IoA rules let you write behavioral detections that fire on process tree patterns — a lightweight behaviour-based DSL.

# Detect cmd.exe or PowerShell spawned by a browser process
Trigger:
  ParentBaseFileName IN [chrome.exe, firefox.exe, msedge.exe, iexplore.exe]
  FileName IN [cmd.exe, powershell.exe, wscript.exe, mshta.exe]

Custom IoAs require the Custom IOA entitlement. Keep rules tightly scoped — overly broad rules produce high noise volumes.

Firewall Management

CrowdStrike Firewall Management controls the Windows Firewall via policy, centralising rule management across the fleet.

Navigate to: Endpoint Security → Firewall Management

Policy Hierarchy

1. Platform default — CrowdStrike-maintained baseline rules
2. Customer policy — your organisation's rules, layered on top
3. Host override — per-host exceptions (use sparingly)

Recommended Baseline Rules

Block inbound SMB from non-RFC1918 addresses
  Direction: Inbound | Protocol: TCP | Port: 445 | Action: Block
  Condition: Remote Address NOT IN [10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16]

Block inbound RDP from non-management VLAN
  Direction: Inbound | Protocol: TCP | Port: 3389 | Action: Block
  Condition: Remote Address NOT IN [management_subnet]

Allow outbound to CrowdStrike cloud (sensor requirement)
  Direction: Outbound | Protocol: TCP | Port: 443
  Remote FQDN: ts01-b.cloudsink.net, lfodown01-b.cloudsink.net

Block outbound LLMNR
  Direction: Outbound | Protocol: UDP | Port: 5355 | Action: Block

Firewall Policy Settings

Device Control

Device control governs USB and removable media access.

Navigate to: Endpoint Security → Device Control

Policy Modes

USB Exception Workflow

1. Set policy to Monitor for two weeks to build a device inventory
2. Export the device usage report to identify business-justified USB devices (encrypted drives, hardware tokens, smart card readers)
3. Create Exceptions for approved vendor/product ID combinations
4. Promote policy to Block External Read/Write
5. Communicate the policy change to users before enforcing

Example exception — YubiKey (Yubico, Vendor ID 1050)
  Vendor ID:  1050
  Product ID: (leave blank to match any Yubico product)
  Class:      HID / Smart Card
  Action:     Allow

Identity Threat Protection (ITP)

Falcon ITP monitors authentication telemetry from domain controllers and Azure AD to detect credential attacks.

Requirements

• Falcon ITP sensor installed on all domain controllers (primary and RODCs)
• Kerberos and NTLM event logging enabled on DCs
• Service account created with read access to AD

Key Detections

Recommended ITP Settings

Spotlight (Vulnerability Management)

Falcon Spotlight provides continuous vulnerability assessment without deploying a separate scanner.

Navigate to: Exposure Management → Spotlight

Prioritisation Logic

CrowdStrike Spotlight uses ExPRT.AI to prioritise CVEs beyond raw CVSS score, incorporating:

• Real-world exploit activity in the CrowdStrike Intelligence feed
• Exploitability from the host's network exposure
• Asset criticality (Spotlight-defined or imported from CMDB)

Filter by ExPRT Rating (Very High, High) rather than CVSS to avoid alert fatigue on theoretical-only vulnerabilities.

Real-Time Response (RTR)

RTR gives analysts interactive shell access to endpoints without pre-deployed RMM tooling.

Navigate to: Response → Real Time Response

RTR Permissions

Restrict the RTR Administrator role to senior responders only. Assign RTR Active Responder to SOC tier-2 and above; SOC tier-1 analysts typically need read-only RTR at most.

Commonly Used RTR Commands

# Process list
ps

# Network connections
netstat

# Running services
services

# Run a pre-approved cloud script
runscript -CloudFile=list_scheduled_tasks.ps1

# Collect a specific file from the endpoint
get C:\Users\<user>\AppData\Local\Temp\suspicious.exe

# Put a remediation tool onto the endpoint
put remediation_tool.exe

Audit trail: All RTR commands are logged with the analyst's identity and timestamp. Treat RTR access like break-glass privileged access — restrict it, log it, and review it periodically.

Fusion SOAR (Workflow Automation)

Falcon Fusion allows event-triggered automation within the Falcon platform.

Navigate to: Response → Workflows

Useful Workflow Patterns

Auto-contain a host on critical detection:

Trigger: Detection severity = Critical
         AND Tactic IN [Credential Access, Lateral Movement, Exfiltration]
Actions: Network Contain Host
         Notify Slack #security-alerts
         Create ServiceNow incident

Auto-quarantine on hash match:

Trigger: IOC File Hash matched
         AND Prevention Policy = Detect (not Block)
Actions: Quarantine File
         Add host to "Quarantine Review" host group
         Page SOC on-call

Enrich detections with threat intelligence:

Trigger: Detection — any severity
Actions: Lookup IP in Falcon Intelligence
         If hit: elevate detection severity
                 Notify analyst immediately

Maintenance & Operational Settings

Sensor Update Policy

Navigate to: Endpoint Security → Sensor Update Policies

Maintenance Token

The maintenance token prevents unauthorised or attacker-driven sensor removal. Store tokens in your PAM solution, not in plaintext scripts or configuration management repositories.

# Windows — uninstall requires the token
WindowsSensor.exe /uninstall /quiet MaintenanceToken=<token>

Exclusions

Exclusions tell the sensor to skip specific paths, file hashes, or processes. Treat exclusions as a security control, not a fix-it tool.

When exclusions are justified:

• AV scanner quarantining files that a business application legitimately writes (e.g., decompressed payloads in a sandboxed environment)
• Persistent high-volume false positives on a well-understood, trusted internal binary

When to push back on exclusion requests:

• "It keeps alerting on our old software" — investigate the alert before excluding
• Path-only exclusions for writable user directories (e.g., C:\Users\*\Downloads\*) — an attacker will exploit this

Always scope exclusions to the narrowest possible host group, never to the default group.

API Quick Reference

OAuth2 Authentication

import requests

def get_falcon_token(client_id: str, client_secret: str) -> str:
    resp = requests.post(
        "https://api.crowdstrike.com/oauth2/token",
        data={"client_id": client_id, "client_secret": client_secret},
        headers={"Content-Type": "application/x-www-form-urlencoded"},
    )
    resp.raise_for_status()
    return resp.json()["access_token"]

# List critical detections
token = get_falcon_token("your_client_id", "your_client_secret")
headers = {"Authorization": f"Bearer {token}"}

resp = requests.get(
    "https://api.crowdstrike.com/detects/queries/detects/v1",
    headers=headers,
    params={"filter": "status:'new'+severity_name:'Critical'", "limit": 50},
)
detection_ids = resp.json()["resources"]

API clients should be created with least-privilege scopes — maintain separate read-only clients for SIEM integrations and write-capable clients for response automation.