CS Audit Script - shows all OK when not cloud connected #42
Description
regarding
custom-apps/crowdstrike/crowdstrike_falcon_ae_script.zsh
Our latest CS installations have reported an all OK status:
Last Audit - 01/09/2025, 11:47:04
•
Executing audit script...
•
Script exited with success.
•
Script results:
•
Falcon.app Settings profile with prefix <redacted> is installed ...
•
Profile prefix io.kandji.crowdstrike.service-management present ...
•
Falcon.app version 7.20 is installed at "/Applications/Falcon.app"...
•
Crowdstrike KEXT is not running ... checking for newer process
•
Falcon System Extension is Sensor activated ...
•
Falcon agent(834) is running ...
•
Crowdstrike Falcon appears to be running properly ...
•
Nothing to do ...
However, it is not cloud connected meaning it does not reach the CrowdStrike portal, and is not managed. This should be a blaring alert in terms of auditing