Install CrowdStrike on Mac: Falcon Sensor Deployment Guide for macOS

Step 2: Install the Falcon Sensor on macOS

Method 1: Install via GUI (Graphical User Interface)

1. Locate the downloaded file (FalconSensorMacOS.pkg).
2. Double-click the file to launch the installer.
3. Follow the on-screen prompts and enter your admin credentials when required.
4. When prompted, enter your CrowdStrike Customer ID (CID).
5. Click Install and wait for the installation to complete.

Method 2: Install via Terminal (Command Line)

For silent installations, use the Terminal:

1. Open Terminal (Press Command + Space, type Terminal, and hit Enter).

2. Navigate to the directory where the Falcon Sensor installer is downloaded:

   cd ~/Downloads
   

   Copy

3. Run the installation command (replace YOUR-CUSTOMER-ID with your actual CID):

   sudo installer -pkg FalconSensorMacOS.pkg -target /
   

   Copy

4. Register the Falcon Sensor with your CID:

   sudo /Applications/Falcon.app/Contents/Resources/falconctl license YOUR-CUSTOMER-ID
   

   Copy

5. Verify the installation:

   sudo /Applications/Falcon.app/Contents/Resources/falconctl stats
   

   Copy

If installed correctly, you should see Sensor operational: true in the output.

Step 3: Approve System Extensions (Required for macOS 10.15 and Later)

Since macOS Catalina (10.15), Apple requires user approval for third-party system extensions.1. Open System Settings (System Preferences on older macOS). 2. Go to Privacy & Security. 3. Look for a message stating that “CrowdStrike, Inc.” software was blocked. 4. Click Allow and enter your Mac administrator password if prompted. 5. Restart the Mac if required.📌 Note: This step must be performed manually by the user or pre-approved via MDM (Mobile Device Management) for enterprise deployments.

Step 4: Approve Full Disk Access (Required for Falcon to Function Fully)

For Falcon to scan files effectively, Full Disk Access must be granted:1. Open System Settings > Privacy & Security. 2. Scroll down and select Full Disk Access. 3. Click the + icon and add the following Falcon processes: 4. /Applications/Falcon.app/Contents/Resources/falconctl 5. /Applications/Falcon.app/Contents/Resources/falcond 6. Restart the system or run the following command in Terminal:bashCopyEditsudo killall falcond

Step 5: Verify the Falcon Sensor is Running

After installation, confirm that the sensor is active and communicating with CrowdStrike Falcon Console.

Check Sensor Status Using Terminal

Run the following command:

sudo /Applications/Falcon.app/Contents/Resources/falconctl stats

Check in the Falcon Console

1. Log into the CrowdStrike Falcon Console (https://falcon.crowdstrike.com).
2. Navigate to Hosts > Host Management.
3. Search for the Mac device by hostname or IP address.
4. If the sensor is successfully installed and reporting, it will appear as Connected.📌 Note: It may take a few minutes for the device to appear in the console.

Troubleshooting Installation Issues

1. Sensor Does Not Appear in Falcon Console

• Restart the Mac and wait 5-10 minutes for the sensor to connect.
• Verify that the Falcon service is running:bashCopyEditsudo /Applications/Falcon.app/Contents/Resources/falconctl stats
• Ensure that the Mac has an active internet connection.

2. “System Extension Blocked” Message Appears

• Go to System Settings > Privacy & Security and Allow the CrowdStrike extension.

3. Full Disk Access Not Approved

• Check Privacy & Security > Full Disk Access and make sure Falcon processes are listed.

4. Installation Fails Due to SIP (System Integrity Protection) Issues

• Ensure SIP is enabled by running:bashCopyEditcsrutil status
• If disabled, enable it using macOS Recovery Mode.

Best Practices

• ✅ Use MDM for Large Deployments – Pre-approve system extensions and disk access via Jamf, Intune, or Workspace ONE.
• ✅ Monitor New Installs – Regularly check the Falcon Console to verify new installations.
• ✅ Keep Sensors Updated – Ensure that Mac sensors are up-to-date to stay protected from new threats.