topic Re: Crowdstrike Falcon v6 not recognised by Global Protect HIP in GlobalProtect Discussions

Crowdstrike Falcon v6 not recognised by Global Protect HIP

GabrielLinero — Thu, 19 Nov 2020 13:33:03 GMT

Hi everyone!

I believe this is a new one here, but due to upgrading to Mac OS BigSur soon, we need to upgrade GlobalProtect version 5.1.1 to the latest one 5.1.7.

However, we have a double constraint here.

At the moment, we're checking that Crowdstrike v5 is running as part of our HIP checks. When moving to BigSur, we have to upgrade Crowdstrike into v6, but GlobalProtect is not seeing it as part of the HIP reports.

We've been able to "fool" GlobalProtect by inserting plist files from Crowdstrike in /Library/LaunchDaemons but this is not making GlobalProtect detect Crowdstrike.

Is there still compatibility updates that need to be done in GlobalProtect to recognise Crowdstrike v6?

Re: Crowdstrike Falcon v6 not recognised by Global Protect HIP

froche — Fri, 20 Nov 2020 15:01:32 GMT

Similar issue. We don't check for a specific version just that CS is installed and Real Time Protection is running. All was good at first and still is if its a Windows device, but v6.1x on Macs while detected no longer has Real Time Protection running. Its most likely due to Apple moving away from kernel extensions, but we have cases opened with Palo and Falcon.

Got this from Falcon, but last thing I want to do is run custom checks. I just want it working automagically like before...

Custom health check scripts or VPN compliance checks may need to be updated using these new processes.
To check for sensor health, run /Applications/Falcon.app/Contents/Resources/falconctl stats

Re: Crowdstrike Falcon v6 not recognised by Global Protect HIP

GabrielLinero — Fri, 27 Nov 2020 08:37:30 GMT

Yes, at the moment we've been able to workaround it using plists but that does not allow us to check that the Crowdstrike is running and protecting the endpoint.

We still don't have a final solution for this and we may need to either put the BigSur rollout on hold or not using the Crowdstrike check as a condition

Re: Crowdstrike Falcon v6 not recognised by Global Protect HIP

mike.pochan — Tue, 01 Dec 2020 23:57:30 GMT

Has anyone heard from support or engineering on this? We've had a case open for a few weeks and their only suggestion was to upgrade the agent, which obviously didn't work.

Re: Crowdstrike Falcon v6 not recognised by Global Protect HIP

fwmike2 — Wed, 02 Dec 2020 00:02:01 GMT

My case's status is TAC escalation since 11/26.

Re: Crowdstrike Falcon v6 not recognised by Global Protect HIP

mlgraham — Tue, 22 Dec 2020 12:55:34 GMT

Any more updates on this?

Re: Crowdstrike Falcon v6 not recognised by Global Protect HIP

froche — Tue, 22 Dec 2020 17:16:55 GMT

I was told it was going to be resolved in the next GP Data File release. It’s an issue with OPSWAT which is the underlying software that runs the HIP Checks.

Re: Crowdstrike Falcon v6 not recognised by Global Protect HIP

fwmike2 — Tue, 22 Dec 2020 19:42:07 GMT

Feedback I received is that it will be fixed in GP releases 5.1.8 and 5.2.5. That sounds different than the GP Data File version.

Re: Crowdstrike Falcon v6 not recognised by Global Protect HIP

froche — Tue, 22 Dec 2020 22:42:02 GMT

Same issue though? We are just having issues with Mac users only.

Re: Crowdstrike Falcon v6 not recognised by Global Protect HIP

fwmike2 — Wed, 23 Dec 2020 15:40:41 GMT

@froche, yes only with Falcon detection on Macs.

Re: Crowdstrike Falcon v6 not recognised by Global Protect HIP

fwmike2 — Tue, 05 Jan 2021 22:18:34 GMT

GP release 5.1.8 fixed the issue for me. HIP now shows CS Falcon 6.12.x under Anti-Malware on macOS endpoints.

Re: Crowdstrike Falcon v6 not recognised by Global Protect HIP

jasonwald — Tue, 31 May 2022 15:52:16 GMT

Had the same issue today with 5.2.8 on a PC. Simply upgraded to 5.2.12 and the problem was instantly fixed.

When you look a the HIP report on the FW it said realtime protection was NOT enabled. With the new GP version is then said realtime protection WAS enabled without making any change to Crowdstrike and let it connect to the network again.