Purpose of Knowledge Article:

This is a guide to check if CrowdStrike is running correctly on your system.

Resolution:

  • Using CrowdStrike Falcon Client v6.x or higher
    1. In the terminal, run sudo /Applications/Falcon.app/Contents/Resources/falconctl stats
    2. When asked for the password, type in your computer password
    3. The result should show at the beginning:
      Host: ts01-laggar-gcw.cloudsink.net
      Port: 443
      State: connected


  • macOS 10.15 (Catalina)
    1. In the terminal run kextstat | grep crowd
    2. When asked for the password, type in your computer password
    3. The result should show “com.crowdstrike.sensor”, this indicates extension is working correctly


  • macOS 11 and later
    1. In the terminal, run systemextensionsctl list
    2. When asked for the password, type in your computer password
    3. The result should look like this:
      1 extension(s)
      --- com.apple.system_extension.endpoint_security
      enabled active teamID bundleID (version) name [state]
      * * X9E956P446 com.crowdstrike.falcon.Agent (5.38/119.57) Agent [activated enabled]
  1. Open up a Command Prompt
  2. Run the command sc query csagent
    Note: you may need to run the command prompt as an administrator
  3. Ensure the result shows “STATE” is “RUNNING”