{"id":28409891,"url":"https://github.com/crowdstrike/falcon-installer","last_synced_at":"2026-02-02T19:04:13.680Z","repository":{"id":250365466,"uuid":"816447997","full_name":"CrowdStrike/falcon-installer","owner":"CrowdStrike","description":"A lightweight, multi-platform CrowdStrike Falcon sensor installer written in Golang","archived":false,"fork":false,"pushed_at":"2026-01-01T01:17:14.000Z","size":344,"stargazers_count":16,"open_issues_count":5,"forks_count":4,"subscribers_count":4,"default_branch":"main","last_synced_at":"2026-01-24T09:23:00.251Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/CrowdStrike.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":"SUPPORT.md","governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2024-06-17T19:18:51.000Z","updated_at":"2026-01-23T20:01:45.000Z","dependencies_parsed_at":"2024-07-30T02:54:18.796Z","dependency_job_id":"696dd15a-6ae2-4b0b-94f2-8e2a93e48a33","html_url":"https://github.com/CrowdStrike/falcon-installer","commit_stats":null,"previous_names":["crowdstrike/falcon-installer"],"tags_count":23,"template":false,"template_full_name":null,"purl":"pkg:github/CrowdStrike/falcon-installer","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CrowdStrike%2Ffalcon-installer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CrowdStrike%2Ffalcon-installer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CrowdStrike%2Ffalcon-installer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CrowdStrike%2Ffalcon-installer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/CrowdStrike","download_url":"https://codeload.github.com/CrowdStrike/falcon-installer/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CrowdStrike%2Ffalcon-installer/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29017940,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-02T18:51:31.335Z","status":"ssl_error","status_checked_at":"2026-02-02T18:49:20.777Z","response_time":58,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-06-02T11:08:54.074Z","updated_at":"2026-02-02T19:04:13.675Z","avatar_url":"https://github.com/CrowdStrike.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# falcon-installer\nA lightweight, multi-platform CrowdStrike Falcon sensor installer written in Golang\n\n## Falcon API Permissions\n\nAPI clients are granted one or more API scopes. Scopes allow access to specific CrowdStrike APIs and describe the actions that an API client can perform.\n\nEnsure the following API scopes are enabled:\n\n\u003e [!IMPORTANT]\n\u003e - **Sensor Download** [read]\n\u003e - (optional) **Installation Tokens** [read]\n\u003e   \u003e This scope allows the installer to retrieve a provisioning token from the API, but only if installation tokens are required in your environment.\n\u003e - (optional) **Sensor update policies** [read]\n\u003e   \u003e Use this scope when using the `--sensor-update-policy` flag or configuring the `FALCON_SENSOR_UPDATE_POLICY` environment variable.\n\u003e - (Optional) Sensor update policies [write]\n\u003e   \u003e Required if you want to automatically retrieve a maintenance token from the API. Not needed when using the\n\u003e   \u003e `--maintenance-token` flag or configuring the `FALCON_MAINTENANCE_TOKEN` environment variable. Maintenance\n\u003e   \u003e tokens are required to uninstall sensors that have uninstall protection enabled.\n\n\n## Usage\n\n```shell\nUsage:\n  falcon-installer [flags]\n\nFlags:\n      --config string         A falcon-installer configuration file\n      --enable-file-logging   Output logs to file\n  -h, --help                  Print usage information\n      --quiet                 Suppress all log output\n      --tmpdir string         Temporary directory for downloading files (default \"/tmp/falcon\")\n      --verbose               Enable verbose output\n  -v, --version               Print version information\n\nFalcon API Flags:\n      --access-token string           Access token for accessing CrowdStrike Falcon Platform\n      --client-id string              Client ID for accessing CrowdStrike Falcon Platform\n      --client-secret string          Client Secret for accessing CrowdStrike Falcon Platform\n      --cloud string                  Falcon cloud abbreviation (e.g. us-1, us-2, eu-1, us-gov-1) (default \"autodiscover\")\n      --member-cid string             Member CID for MSSP (for cases when OAuth2 authenticates multiple CIDs)\n      --sensor-update-policy string   The sensor update policy name to use for sensor installation (default \"platform_default\")\n      --sensor-version string         The sensor version to update or install (overrides sensor-update-policy)\n      --user-agent string             User agent string to append to use for API requests\n\nFalcon Sensor Flags:\n      --cid string                  Falcon Customer ID. Optional when OAuth2 credentials are provided\n      --disable-proxy               Disable the sensor proxy settings\n      --maintenance-token string    Maintenance token for uninstalling the sensor or configuring sensor settings\n      --provisioning-token string   The provisioning token to use for installing the sensor. If not provided, the API will attempt to retrieve a token\n      --proxy-host string           The proxy host for the sensor to use when communicating with CrowdStrike\n      --proxy-port string           The proxy port for the sensor to use when communicating with CrowdStrike\n      --tags string                 A comma separated list of tags for sensor grouping\n\nFalcon Uninstall Flags:\n      --uninstall   Uninstall the Falcon sensor\n\nFalcon Update Flags:\n      --update   Update the Falcon sensor for when sensor update policies are not in use\n\nVault Flags:\n      --aws-secret-name string      AWS Secrets Manager Secret Name\n      --aws-secret-region string    AWS Secrets Manager Region\n      --azure-vault-name string     Azure Key Vault Name\n      --gcp-project-id string       GCP Project ID for Secret Manager\n      --oci-compartment-id string   OCI Compartment ID\n      --oci-vault-name string       OCI Vault Name\n```\n\n### Linux Specific Arguments\n\n```shell\nLinux Installation Flags:\n      --configure-image   Use when installing the sensor in an image\n      --gpg-key string    Falcon GPG key to import\n```\n\n### MacOS Specific Arguments\n\n```shell\nMacOS Installation Flags:\n      --configure-image   Use when installing the sensor in an image\n```\n\n### Windows Specific Arguments\n\n```shell\nWindows Installation Flags:\n      --disable-provisioning-wait     Disabling allows the Windows installer more provisioning time\n      --disable-start                 Prevent the sensor from starting after installation until a reboot occurs\n      --pac-url string                Configure a proxy connection using the URL of a PAC file when communicating with CrowdStrike\n      --provisioning-wait-time uint   The number of milliseconds to wait for the sensor to provision (default 1200000)\n      --restart                       Allow the system to restart after sensor installation if necessary\n      --vdi                           Enable virtual desktop infrastructure mode\n```\n\n## Installation\n\n- Download a binary release for your targeted operating system of the Falcon Installer from [the official releases page](https://github.com/CrowdStrike/falcon-installer/releases).\n- Extract the archive `tar -xvzf \u003clinux-archive\u003e.tar.gz` for Linux and `tar -xf \u003cwindows-archive\u003e.zip` for Windows.\n- Run the installer setting the CLI flags or environment variables as necessary.\n\n## Building\n\nYou can build the binary for either Linux or Windows operating systems from source from within the root of the project directory.\n\n#### Linux and MacOS\n```bash\ngo build -o falcon-installer cmd/main.go\n```\n\n#### Windows\n```bash\ngo build -o falcon-installer.exe cmd/main.go\n```\n\nOnce the binary has been built, you can then manually copy to a location in the local $PATH if desired.\n\n## Usage\n\nThe Falcon Installer provides several command-line options to customize the installation process. Below are some common usage examples:\n\n#### Basic Installation\n```shell\nfalcon-installer --client-id YOUR_CLIENT_ID --client-secret YOUR_CLIENT_SECRET\n```\n\n#### Installation with Specific Options\n```shell\nfalcon-installer --client-id YOUR_CLIENT_ID --client-secret YOUR_CLIENT_SECRET --cloud us-1 --sensor-update-policy enterprise --tags \"tag1,tag2,tag3\"\n```\n\n#### Installation with Parent/Child CIDs\n```shell\nfalcon-installer --client-id PARENT_CLIENT_ID --client-secret PARENT_CLIENT_SECRET --member-cid MEMBER_CID\n```\n\n#### Uninstallation\n```shell\nfalcon-installer --client-id YOUR_CLIENT_ID --client-secret YOUR_CLIENT_SECRET --uninstall\n```\n\n#### Update\n```shell\nfalcon-installer --client-id YOUR_CLIENT_ID --client-secret YOUR_CLIENT_SECRET --update --sensor-version 1.42.1234\n```\n\n### Using a Configuration File\n\nYou can also use a configuration file to specify installation options. The installer supports YAML, JSON, INI, TOML, and HCL formats. See the [examples](examples) directory for sample configuration files.\n\n```shell\nfalcon-installer --config-file /path/to/config/file\n```\n\n### Using Cloud Vaults\n\nThe Falcon Installer supports retrieving credentials and configuration from cloud vaults, eliminating the need to store sensitive API credentials in configuration files or environment variables.\n\n#### AWS Secrets Manager\n\nAWS Secrets Manager integration uses the AWS SDK's default credential chain, which supports multiple authentication methods including IAM roles, environment variables, and AWS CLI credentials.\n\n**Prerequisites:**\n- AWS Secrets Manager secret containing key-value pairs\n- Authentication configured (IAM role, environment variables, or AWS CLI)\n- Secret contains Falcon configuration as JSON (e.g. `{\"FALCON_CLIENT_ID\": \"...\", \"falcon-client-secret\": \"...\"}`)\n\n**Usage:**\n```shell\n# Using AWS Secrets Manager\nfalcon-installer --aws-secret-name \"falcon-credentials\" --aws-secret-region \"us-east-1\"\n```\n\n#### Azure Key Vault\n\nAzure Key Vault integration uses Azure's DefaultAzureCredential authentication, which supports multiple authentication methods including managed identity, Azure CLI, and service principal authentication.\n\n**Prerequisites:**\n- Azure Key Vault with appropriate access permissions\n- Authentication configured (managed identity, Azure CLI, or service principal)\n- Secrets stored with the `falcon-` or `FALCON-` prefix (e.g. `FALCON-CLIENT-ID`, `falcon-client-secret`, etc.)\n\n**Usage:**\n```shell\n# Using Azure Key Vault\nfalcon-installer --azure-vault-name \"my-keyvault\"\n```\n\n#### Google Cloud Secret Manager\n\nGCP Secret Manager integration uses Google's Application Default Credentials (ADC), which supports multiple authentication methods including service accounts, workload identity, and gcloud CLI credentials.\n\n**Prerequisites:**\n- GCP project with Secret Manager API enabled\n- Authentication configured (service account, workload identity, or gcloud CLI)\n- Secrets stored with the `falcon_` or `FALCON_` prefix (e.g. `falcon_client_id`, `FALCON_CLIENT_SECRET`, etc.)\n\n**Usage:**\n```shell\n# Using GCP Secret Manager\nfalcon-installer --gcp-project-id \"my-project-id\"\n```\n\n#### Oracle Cloud Infrastructure (OCI) Vault\n\nOCI Vault integration uses Instance Principal authentication, designed for use within OCI compute instances.\n\n**Prerequisites:**\n- OCI Vault in a specified compartment\n- Instance Principal authentication configured\n- Compute instance with appropriate IAM policies\n- Secrets stored with the `falcon_` or `FALCON_` prefix (e.g. `FALCON_CLIENT_ID`, `falcon_client_secret`, etc.)\n\n**Usage:**\n```shell\n# Using OCI Vault\nfalcon-installer --oci-vault-name \"my-vault\" --oci-compartment-id \"ocid1.compartment.oc1..example\"\n```\n\n## Contributing\n\nWe welcome contributions that improve the installation and distribution processes of the Falcon Sensor. Please ensure that your contributions align with our coding standards and pass all CI/CD checks.\n\n## Support\n\nFalcon Installer is a community-driven, open source project designed to streamline the deployment and use of the CrowdStrike Falcon sensor. While not a formal CrowdStrike product, Falcon Installer is maintained by CrowdStrike and supported in partnership with the open source developer community.\n\nFor additional support, please see the [SUPPORT.md](SUPPORT.md) file.\n\n## License\n\nSee [LICENSE](LICENSE)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcrowdstrike%2Ffalcon-installer","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcrowdstrike%2Ffalcon-installer","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcrowdstrike%2Ffalcon-installer/lists"}