Deploy the Sensor

The Falcon sensor is your visibility foundation — every detection, every response action, every telemetry stream starts with a sensor on the endpoint. Whether you manage ten machines or ten thousand, CrowdStrike provides multiple paths to get sensors installed, configured, and maintained across Linux, macOS, and Windows infrastructure.

Configuration Management

Declare sensor state as code. Ansible, Chef, and Puppet maintain installation, configuration, and lifecycle across your fleet.

Direct Installation

Bash and PowerShell scripts that call the Falcon API to download and install the correct sensor package. No agent infrastructure required.

Container Environments

Run the Falcon sensor as a SystemD service using Docker or Podman for non-Kubernetes container deployments.

CID Migration

Move sensors between tenants without losing tags. Scripts handle uninstall, reinstall, and tag migration with recovery support.

Configuration Management

Declarative tools that define sensor state as code. Manage installation, configuration, and lifecycle across your fleet using repeatable, version-controlled manifests.

Ansible Deploy, configure, and manage the Falcon sensor across Linux, macOS, and Windows using Ansible roles, modules, inventory plugins, and event-driven automation.

Chef Install, configure, and manage the Falcon sensor service across Linux distributions using Chef resources and recipes.

Puppet Install, configure, and manage the Falcon sensor across Linux, macOS, and Windows using Puppet classes and defined types.

Deployment Scripts

Community-maintained scripts for direct Falcon sensor deployment without infrastructure agents. These scripts call the Falcon API to download the correct sensor package, install it, configure registration, and handle uninstallation — including maintenance token retrieval for protected sensors.

Linux (Bash)

Install / Uninstall Install or remove the Falcon sensor on Linux systems. Supports version pinning, golden image prep, proxy configuration, and sensor update policy targeting.

Migrate Migrate the Falcon sensor between CIDs on Linux. Handles tag migration, recovery files, and cross-region moves.

Container Sensor Pull Pull, copy, and manage Falcon container images. Supports multi-arch, unified images, registry mirroring, and Kubernetes pull token generation.

Windows (PowerShell)

Install / Uninstall Install or remove the Falcon sensor on Windows systems. Integrates with sensor update policies for version control and supports provisioning tokens.

Migrate Migrate the Falcon sensor between cloud tenants on Windows. Preserves sensor and Falcon grouping tags with automatic recovery on failure.

Container (SystemD)

Docker Run the Falcon Linux sensor container as a SystemD service using Docker. Includes automated installer script and manual configuration.

Podman Run the Falcon Linux sensor container as a SystemD service using Podman for rootless container deployments.

Getting Started

1. Create an API client — Create an API client within the CrowdStrike Falcon console with the required scopes for your use case.
2. Choose your deployment method — Configuration management (Chef, Puppet, Ansible) for fleet-wide state management, or scripts for direct installation without agent infrastructure.
3. Deploy — Follow the quickstart for your chosen tool. All methods pull the sensor package from the Falcon API, so no manual downloads or version tracking required.
4. Verify — Confirm sensor registration in the Falcon console. Hosts appear within minutes of successful installation.

API Permissions

All deployment methods authenticate against the Falcon API. The minimum scopes required:

Scope	Purpose
Sensor Download: READ	Download sensor installation packages
Installation Tokens: READ	Retrieve provisioning tokens (if enforced)
Sensor Update Policies: READ	Target a specific sensor version via policy
Sensor Update Policies: WRITE	Retrieve maintenance tokens for uninstallation
Hosts: WRITE	Remove hosts from console after uninstall