in chef/cookbooks/cpe_crowdstrike_falcon_sensor/resources/cpe_crowdstrike_falcon_sensor.rb [501:530]
def macos_cs_file_integrity_healthy?
healthy = true
files_to_check = %w[
/Applications/Falcon.app/Contents/Resources/falconctl
/Library/LaunchAgents/com.crowdstrike.falcon.UserAgent.plist
]
if node.catalina? || node.mojave?
files_to_check += %w[
/Library/LaunchDaemons/com.crowdstrike.falcond.plist
/Applications/Falcon.app/Contents/Extensions/Agent.kext
/Applications/Falcon.app/Contents/Resources/falcond
]
else
files_to_check += %w[
/Applications/Falcon.app/Contents/Library/SystemExtensions/com.crowdstrike.falcon.Agent.systemextension
]
end
files_to_check.each do |cs_file|
unless ::File.exists?(cs_file)
return false
end
end
if node.at_least_big_sur? && !node.system_extension_installed?('com.crowdstrike.falcon.Agent.systemextension')
return false
end
healthy
end