Rolled out Falcon to ~200 mixed Windows/macOS endpoints. The agent is lightweight, but the initial deployment uncovered a few assumptions in our environment.
**What broke:**
* **Network saturation:** Initial agent update check-in spiked traffic. Our regional offices on low-bandwidth links choked.
* **Legacy app false positives:** An in-house provisioning tool (C++, unsigned) was flagged and blocked by default ML policy.
* **macOS kernel extension:** Silent failures on older macOS 10.15 systems due to outdated third-party kexts conflicting with Falcon's sensor.
* **API rate limits:** Our existing inventory scripts, which polled the Falcon API, hit rate limits and failed.
**What we fixed:**
* Staggered the agent update schedule using the `SensorUpdatePolicy` to avoid peak hours. Set update source to local distribution server.
* Created a separate policy for dev/test groups with a more permissive Prevention policy. Added the legacy tool's hash to the IOC allow list.
```json
// Example of allow list entry via API
{
"type": "sha256",
"value": "a1b2c3...",
"description": "Internal Provisioning Tool v2.1",
"platforms": ["windows"]
}
```
* For macOS, had to script a pre-deployment check to unload/update the conflicting kexts. CrowdStrike support provided the `kextstat` grep pattern.
* Rewrote inventory scripts to use bulk endpoints API calls and implement exponential backoff.
Main takeaway: The sensor works, but you must adapt your existing infrastructure and processes to its operational model. The API is comprehensive but requires careful handling.
Data over opinions