CrowdStrike / Falcon Sensor Support

Project Discussion
1

CrowdStrike Falcon sensor support is very kernel specific and currently FedoraCoreOS (FCOS) is unsupported. CrowdStrike support have indicated that FCOS support is a H1 2021 roadmap item but with no hard delivery date.

Hopefully the September 2020 introduction of Falcon sensors that can cope with minor kernel updates (“Zero Touch Linux Updates”) will provide strong support for self-updating OS’s like FCOS without resulting in sensors being constantly degraded into an RFM (“Reduced Functionality Mode”) mode.

For those running K8S on OKD on FCOS a container-level CrowdStrike sensor is available but obviously this is not intended to provide the host-level monitoring that regular Falcon sensors provide.

1 Like
2

Thanks for looking into that. Do you have a support ticket open with them to get updates on the progress? If not, I’d be interested in opening one with them.

3

For OpenShift and kernel modules, see https://github.com/openshift/enhancements/pull/357

(But, nothing really is going to be better than having whatever they’re doing in the upstream kernel. I suspect KRSI is relevant)

4

Found the ‘Idea’ that is roadmap-flagged in CrowdStrike. More votes from those of you who have CrowdStrike accounts can’t hurt: CrowdStrike Idea: Redhat CoreOS Support

It is worded for Redhat CoreOS support but the comments express desire for Fedora CoreOS support too. And more comments is good.

5

Met with the CrowdStrike engineering team and there has been a re-think on their end which is pushing this out somewhat further. They are resigned to being unable to engineer for a rapidly changing kernel and so are pushing to remove the Falcon Sensor kernel version dependency entirely so that they have wider OS reach. If as they suggest this only results in minor functionality reductions then this sounds a good plan. No timeline yet. Crowdstrike customer only link above updated to same effect.

6

I added a comment and vote to the customer support ticket.

1 Like
7

CrowdStrike confirmed in a status update today that they are pushing ahead with a fully user space Falcon sensor using eBPF with a v1 that will support 5.4+ Linux kernels and estimated to deliver in +6 months. This will have limited coverage initially, i.e. indicators of attacks but not preventative measures. However, goal is to expand to better current falcon sensor over time yet be fully user space.

1 Like
8

Does anyone have any experience with falcon-sensor on Fedora 42 (6.14+) or any recent Fedora release ? Any recommendations or experience to share ?

Thanks in advance.