Is there a use case for Crowd Strike Falcon on Linux?
Is there a use case for Crowd Strike Falcon on Linux?
How does Linux it self or some other software on Linux address what Crowd Strike is doing for Windows?
E: thanks for the answers :)
CrowdStrike’s Falcon Sensor agent can be and is installed on bare metal, VMs and inside Kubernetes clusters. All running Linux.
is there a use case … on Linux
It’s already installed on Linux, in massive companies all around the globe. Leadership sure thinks so.
Like it or not, most cyber insurance policies require all endpoints and hosts be secured with industry approved edr solution. Crowdstrike is a very popular multi platform player in that space. 🤷♂️
CrowdStrike Falcon is XDR product, there is hundreds of similar products available.
The role of XDR is to detect and block if some bad actor is trying to do something malicious in the machine. Old school virus signature detection is not enough anymore, you need pattern detection from network communication/DNS queries etc.
When corporation has thousands of devices to monitor the OS each of those devices Is not relevant. You need to detect if some random user logs to some Linux info display thousand kilometers away, and starts scanning the network.
Because the detection and response, needs to happen near realtime, for example Incase of cryptolockers, where all devices are encrypted within seconds, the software blocking this needs kernel level access.
I work in critical infrastructure as IT, but luckily we did not use falcon
How does Linux it self or some other software on Linux address what Crowd Strike is doing for Windows?
Well, it usually drops to a black screen and kernel panics, but lately there's been a bit of a push for parity with windows.
The Linux BSOD is quite funny. But reading from Crowd Strike's website the Falcon product is supposed to monitor for breaches(?), so I was curious about what analogs exist in Linux or how the OS it self takes on that role.
Crowdstrike exists for Linux too. In fact, it apparently crashed RHEL and Debian a few months back. That didn't get so much attention.
Falcon seems to be a cross between an antivirus and an intrusion detection system (IDS). There are many antiviruses on Linux, but only one FOSS AV is popular - ClamAV. As for IDS, snort is an example.
But in the true sense, Falcon is much more than just an AV and IDS. It's a way to detect breaches and report it back to CrowdStrike's threat detection and analysis teams. I don't think there exists a proper alternative even in the commercial sector.
That's a BSOD for DRM failures I think, not a generic BSOD like on Windows.
Systemd also added systemd-bsod, but it’s for boot failures.
It detects and reports bad behavior of software
Monitoring is very important when you have 1000 machines
If someone starts transferring a bunch of files to an external drive, heuristics will detect that and alert. Source: I worked at crowdstrike six years ago.
The use case is - if you are in an industry that is legally mandated to use EDR, it is an EDR product.
EDR is a massive security risk, so no.
If youre forced to install it, put it on a VM and don't let it escape to your real machine. They can exfiltrate all your data and install malware as root.