| 1 | Go to software.lbl.gov and download CrowdStrike Falcon Sensor for macOS 11 | no image |
| 2 | Browse to the location where the file LBL_CS_MacOS11_vX.X is downloaded, and double-click on it | |
| 3 | It will extract a folder called LBL_CS_MacOS11_vX.X, open it. Leave this folder open, you will return to it. | |
| 4 | Right-click on the GovLagger... file | |
| 5 | Select Open With |
| 6 | Select Installer |
| 7 | Click Continue for the "Introduction" and "Read Me" section | |
| 8 | Click Install | |
| 9 | Type in your computer password | |
| 10 | Click Install Software |
| 11 | Click Close | |
| 12 | Return to the LBL_CS_MacOS11_vX.X folder from step 3 and right-click on the file configuration.command | |
| 13 | Select Open With |
| 14 | Select Terminal |
| 15 | Click Open to the popup saying "macOS cannot verify the developer of "configuration.command". Are you sure you want to open it?" | |
| 16 | In the terminal window that pops up, type in your computer password and hit enter Note: no character will appear when you type the password here. | |
| 17 | Click Allow to the popup saying "Falcon would like to filter network content" | |
| 18 | A "System Extension Blocked" popup will appear, click Open Security Preferences | |
| 19 | Select Security & Privacy | |
| 20 | Click the Lock icon on the bottom left | |
| 21 | Type in your computer password |
| 22 | Click Unlock |
| 23 | Look for "System software from application "Falcon" was blocked from loading", and click Allow | |
| 24 | This process may take between 3-8 minutes. Once done you will see it say [Process Completed] You are done Note: if you have Sophos, you will need to restart the computer for Sophos to finish uninstalling. | |
| 25 | Click the Apple icon on the top left corner |  Image Added
|
| 26 | Click System Preferences |
| 27 | Click Security & Privacy |  Image Added
|
| 28 | Click the Lock icon on the bottom left corner |  Image Added
|
| 29 | Type in your computer password a |
| 30 | Click Unlock |
| 31 | Select Privacy tab |
| 32 | On the left column, find and select Full Disk Access |  Image Added
|
| 33 | Check the box for Agent |
| 34 | Click the + icon |
| 35 | Navigate to /Application/Falcon or Falcon.app and select it |  Image Added
|
| 36 | Click Open |
| 37 | Both the box for Agent and Falcon should now be checked |  Image Added
|
| 38 | If you want to confirm CrowdStrike Falcon is installed and running, see Is CrowdStrike Falcon Running? | no image |
