Forge Home

Modules

Puppet

Resources

PuppetEcosystemPuppet CommunityUpdates

crowdstrike

Install and manage CrowdStrike Falcon Sensor
Project URLRSS FeedReport issues

12,950 downloads

593 latest version

5.0 quality score

We run a couple of automated
scans to help you access a
module's quality. Each module is
given a score based on how well
the author has formatted their
code and documentation and
modules are also checked for
malware using VirusTotal.

Please note, the information below
is for guidance only and neither of
these methods should be considered
an endorsement by Puppet.

Version information

  • 1.4.7 (latest)
  • 1.4.6
  • 1.4.5
  • 1.4.4
  • 1.4.3
  • 1.4.1
  • 1.4.0
  • 1.3.0
  • 1.2.4
  • 1.2.3
  • 1.2.2
  • 1.2.1
  • 1.2.0
released Feb 26th 2024
This version is compatible with:
  • Puppet Enterprise 2023.2.x, 2023.1.x, 2023.0.x, 2021.7.x, 2021.6.x, 2021.5.x, 2021.4.x, 2021.3.x, 2021.2.x, 2021.1.x, 2021.0.x, 2019.8.x
  • Puppet >= 6.21.0 < 8.0.0
  • , , , , ,

Start using this module

  • r10k or Code Manager
  • Bolt
  • Manual installation
  • Direct download

Add this module to your Puppetfile:

mod 'ruthenium-crowdstrike', '1.4.7'
Learn more about managing modules with a Puppetfile

Add this module to your Bolt project:

bolt module add ruthenium-crowdstrike
Learn more about using this module with an existing project

Manually install this module globally with Puppet module tool:

puppet module install ruthenium-crowdstrike --version 1.4.7

Direct download is not typically how you would use a Puppet module to manage your infrastructure, but you may want to download the module in order to inspect the code.

Download

Documentation

ruthenium/crowdstrike — version 1.4.7 Feb 26th 2024

Build Status Puppet Forge Puppet Forge -- Downloads

crowdstrike

The module is designed to deploy and manage CrowdStrike's Falcon Sensor antivirus agent.

Table of Contents

  1. Description
  2. Setup - The basics of getting started with crowdstrike
  3. Usage - Configuration options and additional functionality
  4. Limitations - OS compatibility, etc.

Description

The modules installs and manages or removes the Falcon Sensor anti-virus agent by CrowdStrike. Proxy settings and tags can be confiugred additionaly.

Setup

Setup requirements

The module installs a package falcon-sensor, which it assumes to be available in a repo configured on the system. The vendor does not maintain a Linux repository.

Alternatively you can customize package source and provider to have an ability to install from a different source.

Beginning with crowdstrike

The most basic usage of the module:

class { 'crowdstrike': cid => 'AAAAAAAAAAAAA-BB' }

Parameter cid is mandatory.

Usage

In most cases just specifying cid (customer id) is sufficient, but adding tags is desirable for easy grouping and searching of the hosts in the CrowdStrike console:

class { 'crowdstrike':
  cid  => 'AAAAAAAAAAAA-BB',
  tags => [ 'My Organization', 'My Department' ]
}

If the computer does not have direct access to the CrowdStrike cloud service, connection can be routed through a proxy server:

class { 'crowdstrike':
  cid        => 'AAAAAAAAAAAA-BB',
  proxy_host => 'proxy-server.my-organization.com',
  proxy_port => 3128
}

Both proxy_host and proxy_port are mandatory if either specified.

If provisioning token is reqired during the installation, use the provisioning_token parameter:

class { 'crowdstrike':
  cid                => 'AAAAAAAAAAAA-BB',
  provisioning_token => 'XXXXXXXXXXXXXX'
}

Limitations

If proxy has been used and later disabled, the host and port configuration is not removed entirely, only disabled. This does not affect the functionality in any way.

CrowdStrike sensor software is capable of auto-updating its binaries if configured to do so in the console. It happened in the past when update changes the format of the falconctl output, which may break the fact in this module. If that happens, the module detects this situation, displays the relevant error message and fails the puppet run. If you see this happening, it is time to update the version of the module you have.