Skip to content
Get packs

CrowdStrike Falcon EDR Deployment

Guides agents through rolling out CrowdStrike Falcon EDR sensors and checking their coverage.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
7 files

What it does

This skill gives an AI agent a step-by-step playbook for installing CrowdStrike Falcon endpoint protection sensors on Windows, macOS and Linux machines, using tools such as SCCM, Intune, GPO or manual commands. It also covers recommended prevention, ransomware and response policy settings, how to verify each sensor is running and connected, and how to integrate telemetry with SIEM tools. Bundled Python scripts can query the CrowdStrike API to list hosts, pull detections and produce a deployment coverage report.

Great for

  • IT or security teams onboarding endpoints to CrowdStrike Falcon
  • Administrators verifying sensor coverage across a fleet
  • Security engineers drafting Falcon policy configurations

Skip it if

  • Organisations using other EDR products such as Carbon Black or SentinelOne, which the skill explicitly excludes
  • Running the scripts against production tenants without reviewing them first, since they call live APIs with client credentials
  • Anyone expecting a substitute for vendor documentation, since commands and version numbers may go out of date

Try asking

  • “Write an Intune deployment plan for the Falcon sensor on our Windows laptops”
  • “Give me the falconctl commands to install and verify a Falcon sensor on RHEL 8”
  • “Draft a Falcon prevention policy split between workstations and servers”
  • “Generate a report of hosts missing the Falcon sensor using our API credentials”
Step-by-step guide: how to use CrowdStrike Falcon EDR DeploymentInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.

    deploying-edr-agent-with-crowdstrike.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip deploying-edr-agent-with-crowdstrike.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip deploying-edr-agent-with-crowdstrike.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Review scripts/agent.py and scripts/process.py and use a read-only API client with minimal scopes before running them
  • Test deployment and policy steps in a pilot group before rolling out fleet-wide, especially aggressive ML and automated containment settings
  • Confirm sensor version numbers and download links against the current Falcon console, as the examples are pinned to specific versions

What's inside

  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.