Guide · Agent skill

How to use the CrowdStrike Falcon EDR Deployment agent skill

Updated 2026-10-29 · written with AI from the project's own documentation and checked against our catalogue data

This is a guide to the deploying-edr-agent-with-crowdstrike agent skill, a playbook that lets an AI agent help you roll out CrowdStrike Falcon endpoint sensors on Windows, macOS and Linux machines. It is written for IT and security teams who onboard endpoints, check sensor coverage, or draft Falcon policy settings. By the end you will know how to install the skill, ask for the right kind of help, and review the work before anything touches a live tenant.

CrowdStrike Falcon EDR Deploymentmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill

Quick start

1Get the installer and CID. In the Falcon console, open Host setup and management, then Sensor downloads. Download the installer for each OS and copy your Customer ID.
2Install the skill. Unzip the ZIP into ~/.claude/skills/ or a project's .claude/skills/ folder, or upload it under Settings → Capabilities → Skills in the Claude apps.
3Ask for the deployment. Describe the platform and tool you use, such as Intune for Windows or Ansible for Linux, and what you need, such as install steps or a policy draft.
4Review before running. Check any commands and scripts the agent produces against vendor documentation. Test scripts on a non-production tenant before using production API credentials.
5Verify coverage. Confirm each sensor is running locally and shows as online in the Falcon console, then review the coverage report if you ran the scripts.

What does the deploying-edr-agent-with-crowdstrike skill make the agent do?

An agent skill is a folder of instructions and supporting files that an AI agent loads when a request matches its description. This one covers installing CrowdStrike Falcon sensors across enterprise endpoints, configuring detection and response policies, verifying that each sensor is running and connected, and integrating Falcon telemetry with SIEM tools.

The deployment methods it describes include SCCM, Intune, GPO, Ansible and manual commands. Bundled Python scripts can query the CrowdStrike API to list hosts, pull detections and produce a deployment coverage report.

Sensor installation steps for Windows, Linux and macOS
Recommended prevention, ransomware and response policy settings
Validation checks for sensor status and cloud connectivity
SIEM integration notes for Splunk and Elastic

How do you install the skill?

Download the skill ZIP from this page. You can install it in one of two ways.

For Claude Code, unzip it into your personal skills folder at ~/.claude/skills/, or into a project's .claude/skills/ folder if you want it available only in that project.

In the Claude apps, upload the ZIP under Settings → Capabilities → Skills.

Personal: ~/.claude/skills/
Project only: .claude/skills/ inside your project folder
Claude apps: Settings → Capabilities → Skills, then upload the ZIP

How do you trigger the skill with a natural request?

You do not need a special command. The skill activates when your request involves CrowdStrike deployment, Falcon sensor installation, EDR policy configuration, or endpoint detection and response. Say what you are trying to achieve and name the platform or tool you use.

Good requests include the goal, the OS, and the deployment tool. The more specific you are, the more the agent can tailor the steps.

Help me deploy the Falcon sensor to our Windows laptops using Intune.
Write an SCCM install and detection setup for the Falcon sensor.
Check whether the Falcon sensors on our Ubuntu servers are running and connected.
Draft a Falcon prevention policy split between workstations and servers.
Show me how to send Falcon telemetry to Splunk.

How do you deploy the Falcon sensor on each platform?

Get the sensor installer and your Customer ID (CID) from the Sensor downloads page in the Falcon console, under Host setup and management. The source gives the Windows installer as WindowsSensor_<version>.exe, the macOS installer as FalconSensorMacOS_<version>.pkg, and Linux packages as .deb or .rpm files. Replace the version placeholders with the version you downloaded.

On Windows, the silent install command passes your CID on the command line. On Linux, you install the package, then set the CID with falconctl and start the service. On macOS, you install the package, set the CID with falconctl license, and approve the system extension and Full Disk Access through an MDM profile. Check the vendor documentation for your exact versions before running these.

Windows: deploy via SCCM, Intune or GPO, or run the installer directly
Linux: Debian/Ubuntu uses dpkg; RHEL/CentOS uses yum
macOS: an MDM profile is needed for the system extension and Full Disk Access on Ventura and later

WindowsSensor_<version>.exe /install /quiet /norestart CID=<YOUR_CID>

sudo /opt/CrowdStrike/falconctl -s -f --cid=<YOUR_CID>
sudo systemctl start falcon-sensor
sudo systemctl enable falcon-sensor
sudo /opt/CrowdStrike/falconctl -g --rfm-state

How do you set policies and verify each sensor?

In the Falcon console, go to Configuration → Prevention Policies. The skill suggests separate policies for workstations (more aggressive), servers (moderate, to avoid false positives on server workloads) and critical infrastructure (maximum protection with exception lists). It also covers response settings such as Real-Time Response roles, network containment and automated remediation.

To verify a sensor, check that the service is running and the host appears as online in the console. The source expects rfm-state=false on Linux, which means the sensor is communicating with the cloud, and RUNNING from sc query csagent on Windows. Treat the suggested policy values as a starting point to test, not a final standard.

Workstations: aggressive settings
Servers: moderate settings
Critical infrastructure: maximum protection with exception lists
Windows check: sc query csagent should report RUNNING
Linux check: falconctl -g --rfm-state should report rfm-state=false

sc query csagent

How do you connect Falcon telemetry to a SIEM?

The skill outlines an API client approach. In the Falcon console, go to Support → API Clients and Keys, and create a client with the Event Streams → Read scope. The source names falcon-siem-connector and Falcon Data Replicator (FDR) as options for moving data out.

For Splunk, the source points to the CrowdStrike Falcon Event Streams Technical Add-on from Splunkbase. For Elastic, it points to the CrowdStrike integration in Elastic Agent through Fleet. Follow each vendor's current setup steps for the details.

Create an API client with Event Streams → Read scope
Splunk: install the Falcon Event Streams Technical Add-on
Elastic: add the CrowdStrike integration in Fleet

What safety checks should you run before using the scripts?

The skill runs scripts and uses the network. The Python scripts call live CrowdStrike APIs using FALCON_CLIENT_ID and FALCON_CLIENT_SECRET, so they can read your tenant data. Read agent.py and process.py before you run them, and test against a non-production tenant first. Keep API secrets out of shared files and shell history.

The endpoints need outbound access to CrowdStrike cloud on port 443. The source names ts01-b.cloudsink.net. Installing the sensors also requires administrative or root rights on each target machine. The skill does not replace vendor documentation, and its commands may go out of date.

Review scripts/agent.py and scripts/process.py before running them
Requires Python 3 and the crowdstrike-falconpy library for agent.py
Test on a non-production tenant before production
Do not use this skill for Carbon Black or SentinelOne

What people use it for

Planning a staged Falcon sensor rollout to Windows endpoints through Intune or SCCM
Checking that Linux servers have the sensor running and connected
Drafting separate Falcon prevention policies for workstations and servers
Connecting Falcon event data to a Splunk or Elastic environment

Frequently asked questions

How do I install the CrowdStrike Falcon EDR Deployment agent skill?

Download the ZIP from this page. Unzip it into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder, or upload it in the Claude apps under Settings → Capabilities → Skills.

What do I need to use this skill?

You need a Falcon console account with the Falcon Administrator role, your Customer ID (CID), sensor installer packages, and administrative or root access on endpoints. The scripts also need Python 3, the crowdstrike-falconpy library, FALCON_CLIENT_ID and FALCON_CLIENT_SECRET, and port 443 access to CrowdStrike cloud.

Is the skill free?

The skill is licensed under Apache-2.0. The source does not cover pricing for CrowdStrike Falcon, which you need an account for, so check CrowdStrike directly for licensing costs.

Does this skill work with Carbon Black or SentinelOne?

No. The skill explicitly excludes other EDR products such as Carbon Black and SentinelOne. It is built for CrowdStrike Falcon sensors only.

Why does my Falcon sensor not show as online?

Check that the service is running (sc query csagent on Windows, or falconctl -g --rfm-state on Linux) and that the endpoint can reach ts01-b.cloudsink.net on port 443. Proxy settings can also block this, so check them if the host still does not connect.

Is it safe to run the bundled Python scripts?

Read them first. They call live CrowdStrike APIs with your client credentials, so run them against a non-production tenant before production and keep secrets out of shared files.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits IT and security teams onboarding endpoints to CrowdStrike Falcon, admins checking sensor coverage, and engineers drafting Falcon policies. Pick a different resource if you use another EDR product, or if you need guaranteed current commands, since you should always confirm against vendor documentation.

Download the skill