CrowdStrike Falcon is the EDR or Endpoint Detection and Response offering from CrowdStrike, the American cybersecurity technology company.
It can be installed on Windows, Mac, and Linux operating systems, as well as for Android and iOS devices. Once CrowdStrike Falcon is installed, it looks for signs of malicious activity, and when security threats are detected, it helps to lock down the threat. Thus, CrowdStrike Falcon provides real-time visibility into endpoint activity, allowing for quick detection and response to threats. In this sense, CrowdStrike Falcon is a bit like traditional antivirus software, but on steroids.
CrowdStrike Falcon provides its broad range of security and support via following functionalities:-
⇾ Falcon Prevent: The next generation antivirus, that provides protection against both malware and
malware-free attacks
⇾ Falcon Insight: The Endpoint Detection and Response that delivers continuous and endpoint
visibility, detection, response and forensics
⇾ Falcon Discover: The IT Hygiene functionality that identifies unauthorized systems and
applications, as well as use privileged credentials in our environment
⇾ Falcon X: Integrated Threat Intelligence that automates breaches and incident investigations
⇾ Falcon Device Control: Enable safe and accountable USB device usage with full visibility and
granular control of USB utilization
⇾ Falcon Overwatch: The Threat Hunting Service that identifies attacks 24/7 with a team of experts
who hunt, investigate, and advise on threat activities
CrowdStrike’s Falcon Sensor for Linux supports both kernel mode and user mode to provide a broad range of support and functionality. It does not require specific kernel versions to enable protection. Thus, it is also a popular choice for protecting the CloudLinux operating systems that are used in Shared Hosting environments. This includes the cPanel/WHM Shared Hosting environments too.
CageFS is a functionality provided by CloudLinux which is a virtualized, per-user file system, isolating each user in their own “cage”. Each customer will have a fully functional filesystem or CageFS mounts with all the system files, tools, etc.
But the current version of CrowdStrike Falcon Sensor has an incompatibility issue with CloudLinux systems such that, the Falcon Sensor does not allow CloudLinux CageFS service to load on operating system startup. This means once we reboot the CloudLinux server, CageFS service will not start.
To temporarily fix this issue after a system reboot or startup, perform the following steps.
First, stop the Crowdstrike Falcon Sensor service:
# systemctl stop falcon-sensor
Load the kernel module for CloudLinux LVE, along with the required dependencies:
# modprobe kmodlve
Start the CloudLinux LVE default initialization service:
# systemctl start lvectl
Start the CloudLinux LVE Kernel module service service:
# systemctl start lve
Start the CloudLinux LVE namespaces initialization service:
# systemctl start lve_namespaces
Start the CloudLinux statistics service:
# systemctl start lvestats
Start the CloudLinux CageFS service:
# systemctl start cagefs
Remount all CageFS filesystems:
# cagefsctl –remount-all
Finally, start the Falcon Sensor service:
# systemctl start falcon-sensor
Done.
Connect with Nuventure Connect for expert Linux solutions.