deploying-edr-agent-with-crowdstrike

name	deploying-edr-agent-with-crowdstrike
description	Deploys and configures CrowdStrike Falcon EDR agents across enterprise endpoints to enable real-time threat detection, behavioral analysis, and automated response. Use when onboarding endpoints to EDR coverage, configuring detection policies, or integrating Falcon telemetry with SIEM platforms. Activates for requests involving CrowdStrike deployment, Falcon sensor installation, EDR policy configuration, or endpoint detection and response.
domain	cybersecurity
subdomain	endpoint-security
tags	["endpoint","edr","CrowdStrike","Falcon","threat-detection","sensor-deployment"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_ai_rmf	["GOVERN-1.1","MEASURE-2.7","MANAGE-3.1","MAP-5.1","MANAGE-2.4"]
atlas_techniques	["AML.T0070","AML.T0066","AML.T0082"]
nist_csf	["PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01"]
mitre_attack	["T1003.001","T1055","T1059.001","T1486","T1071.001"]

Deploying EDR Agent with CrowdStrike

When to Use

Use this skill when:

• Deploying CrowdStrike Falcon sensors to Windows, macOS, or Linux endpoints
• Configuring Falcon prevention and detection policies for different endpoint groups
• Integrating CrowdStrike telemetry with SIEM (Splunk, Elastic, Sentinel) for correlated detection
• Troubleshooting sensor connectivity, performance, or detection issues

Do not use this skill for deploying other EDR solutions (Carbon Black, SentinelOne) or for Falcon cloud workload protection (use cloud-specific deployment guides).

Prerequisites

• CrowdStrike Falcon console access with Falcon Administrator role
• Customer ID (CID) and Falcon sensor installer package
• Administrative/root access on target endpoints
• Network access: endpoints must reach CrowdStrike cloud (ts01-b.cloudsink.net on port 443)
• Deployment tool: SCCM, Intune, GPO, Ansible, or manual installation

Workflow

Step 1: Obtain Falcon Sensor Installer and CID

1. Log into Falcon Console: https://falcon.crowdstrike.com
2. Navigate: Host setup and management → Sensor downloads
3. Download the appropriate installer:
   - Windows: WindowsSensor_<version>.exe
   - macOS: FalconSensorMacOS_<version>.pkg
   - Linux: falcon-sensor_<version>_amd64.deb / .rpm
4. Copy the Customer ID (CID) from the Sensor downloads page
   - CID format: <32-char-hex>-<2-char-checksum>

Step 2: Deploy Falcon Sensor - Windows

Silent installation via command line:

WindowsSensor_7.18.17106.exe /install /quiet /norestart CID=<YOUR_CID>

SCCM deployment:

1. Create an Application in SCCM
2. Deployment type: Script Installer
3. Install command: WindowsSensor_7.18.17106.exe /install /quiet /norestart CID=<CID>
4. Detection method: Registry key exists
   - HKLM\SYSTEM\CrowdStrike\{9b03c1d9-3138-44ed-9fae-d9f4c034b88d}\{16e0423f-7058-48c9-a204-725362b67639}\Default
5. Deploy to target collection
6. Deployment purpose: Required (for mandatory installation)

Microsoft Intune deployment:

1. Navigate: Devices → Windows → Configuration profiles
2. Create Win32 app deployment
3. Upload .intunewin package (wrapped sensor installer)
4. Install command: WindowsSensor_7.18.17106.exe /install /quiet /norestart CID=<CID>
5. Detection rule: File exists C:\Windows\System32\drivers\CrowdStrike\csagent.sys
6. Assign to device group

GPO deployment:

# Create startup script that checks for existing installation
$sensorPath = "C:\Windows\System32\drivers\CrowdStrike\csagent.sys"
if (-not (Test-Path $sensorPath)) {
    Start-Process -FilePath "\\fileserver\CrowdStrike\WindowsSensor.exe" `
      -ArgumentList "/install /quiet /norestart CID=<CID>" -Wait
}