CrowdStrike Falcon Protection (macOS)

Description
Needing to deploy to CrowdStrike Falcon antivirus to your macOS fleet? FileWave has you covered.
CrowdStrike's flagship product is called Falcon, which is a cloud-native platform that combines next-generation antivirus, endpoint detection and response (EDR), threat intelligence, and proactive threat hunting. Falcon aims to provide real-time visibility into endpoint activity, rapid threat detection, and automated response to security incidents.
Ingredients
FileWave Admin Central
CrowdStrike Falcon Profiles
One for macOS Sonoma and later
One for macOS Sequoia and later
CrowdStrike PKG installer
CrowdStrike License code
Directions
Deploying the CrowdStrike Falcon to your devices
CrowdStrike deployment on macOS requires three filesets: two TCC profiles and the PKG installer. The required TCC profiles depend on the macOS version in your environment. Screenshot examples are included in this article as a reference if you choose to create the profiles manually.
The PKG installer should also include two scripts that apply your CrowdStrike Falcon license and verify that the appropriate TCC profile is installed before the CrowdStrike application is deployed.
Download TCC profile
Note: Please log in to your CrowdStrike portal and download the latest TCC profiles. The screenshots below are provided for reference if you choose to create the TCC profiles manually.
Falcon Configuration Profile for Sonoma and earlier:
Sonoma and later TCC Profile
Security & Privacy Payload:
 
Bundle ID:
com.crowdstrike.falcon.Agent
com.crowdstrike.falcon.App
Code requirement:
identifier "com.crowdstrike.falcon.Agent" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = X9E956P446
Access to service:
Full Disk Access
Agent configuration
App configuration
System Extension Policy Payload:
 
Check box 'Can approve additional system extensions'
Allowed Team Identifiers:
X9E956P446
Allowed System Extensions
com.crowdstrike.falcon.Agent
Allowed System Extension Types:
Network
Endpoint security
Web Content Filter Payload:
 
Name: Falcon
Identifier: com.crowdstrike.falcon.App
Filter Network Traffic
Socket Filter Bundle Identifier:
com.crowdstrike.falcon.Agent
Socket Filter Designated Requirement:
identifier "com.crowdstrike.falcon.Agent" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] and certificate leaf[field.1.2.840.113635.100.6.1.13] and certificate leaf[subject.OU] = "X9E956P446"
Falcon Configuration Profile for Sequoia and later:
Sequoia and later TCC Profile
System Extension Policy Payload:
 
Team Identifiers:
X9E956P446
Non Removable From UI System Extensions:
com.crowdstrike.falcon.Agent
Download the PKG installer
The PKG installer fileset includes three components. The template below can be used to upload your specific version of the CrowdStrike PKG installer. Ensure the installation folder and PKG file name are labeled correctly to support a successful deployment.
PKG - Crowdstrike macOS Installation.fileset.zip
Note: Please log in to your CrowdStrike portal and download the latest PKG installer to ensure a successful import and deployment. The PKG installer must be used along with the two required scripts: the Requirement script and the Activation script.
CrowdStrike License
Customizing the Fileset with your CrowdStrike license is required. The Fileset has a License.sh script to edit and enter in your license code.
Editing the License.sh script
Highlight your CrowdStrike PKG installer Fileset 
Select Scripts to open the Script window.
Highlight License.sh
Click Edit
Entering in your license code
Highlight the ####### string and enter in your CrowdStrike License code
Click OK to save
Click OK to save again to save your license code for the CrowdStrike Fileset
License code script
#!/bin/zsh
echo "License is being set"
/Applications/Falcon.app/Contents/Resources/falconctl license ##########
echo "License is set"
exit 0
 
Check for Falcon Profiles
The payload identifiers are preconfigured in the provided template fileset. The steps below explain how to add your own Payload Bundle Identifier if needed.
Note: The Requirement script verifies that the CrowdStrike Falcon TCC profiles are installed successfully before the CrowdStrike installer runs. The script checks for both profiles and confirms they are installed before proceeding with the CrowdStrike deployment.
Editing the CheckForFalconProfile.sh
 
Highlight your CrowdStrike PKG installer Fileset
Select Scripts to open the Scripts window
Highlight the CheckForFalconProfile.sh script
Click Edit
Entering in your Payload Profile Identifiers
 
Highlight the string after profile_id="#####"
Replace the ######, with your TCC profile Identifier.
If not sure, open your Profile and copy the Identifier.
Click OK to save
Click OK to save again to save your changes to the CrowdStrike Fileset
Check for Falcon profile script
#!/bin/zsh
profile_id="9BCE1C20-633D-405D-84D8-6F6C2D3AE66C"
profile_id2="C1A6E28A-21EF-49C6-B85F-84E845731E22"
found_profile=$(profiles list all | awk -v search=$profile_id  '$0 ~ search {print $NF}')
found_profile2=$(profiles list all | awk -v search=$profile_id2  '$0 ~ search {print $NF}')
i=0
if [ -z $found_profile ]
then
        echo "Did not find $profile_id" 
        i=$((i+1))
fi
if [ -z $found_profile2 ]
then
        echo "Did not find $profile_id2"
        i=$((i+1))
fi
if [ $i = 2 ]
then
       echo "Both Profiles are missing"
       exit 1
fi
echo $missing
echo "Found installed profile: $profile_id or $profile_id2"
exit 0
 
Creating a Fileset Group
Keeping your filesets organized is a recommended best practice, especially when managing multiple software deployments. You may create a new Fileset Group (for example, CrowdStrike Falcon (macOS 2023)) and move all related filesets into that group. This allows you to associate the Fileset Group with your devices instead of assigning individual filesets separately.
Once the filesets and profiles have been created, you can assign the CrowdStrike Falcon (macOS 2023) Fileset Group to a few test devices. This helps verify that the software installs correctly and that the configured license code is applied successfully.
FileWave Custom Fields to validate installation
Monitoring the CrowdStrike Falcon Sensor through FileWave custom fields helps ensure endpoint protection remains active and compliant. By validating that the Falcon service is running and reporting the installed sensor version, administrators can quickly detect inactive or outdated agents that may leave devices exposed. This custom fields includes both macOS and Windows.
FileWave Custom Fields for CrowdStrike.customfields.zip
Example Custom Field output:
Sensor State
Output Value
Installed
Installed | version_number
Not Installed
Not Installed
Related Content
CrowdStrike Falcon Protection (Windows EXE)