Added support for Crowdstrike Falcon (on macOS & Linux)

BUILD.bazel

@@ -39,6 +39,7 @@ go_library(
     deps = [
         "//tables/alt_system_info",
         "//tables/authdb",
+        "//tables/crowdstrike_falcon",
         "//tables/chromeuserprofiles",
         "//tables/fileline",
         "//tables/filevaultusers",

VERSION

@@ -1 +1 @@
-1.2.5
+1.2.6

main.go

@@ -9,6 +9,7 @@ import (
 
 	"github.com/macadmins/osquery-extension/tables/alt_system_info"
 	"github.com/macadmins/osquery-extension/tables/chromeuserprofiles"
+	"github.com/macadmins/osquery-extension/tables/crowdstrike_falcon"
 	"github.com/macadmins/osquery-extension/tables/fileline"
 	"github.com/macadmins/osquery-extension/tables/filevaultusers"
 	macosprofiles "github.com/macadmins/osquery-extension/tables/macos_profiles"
@@ -76,6 +77,18 @@ func main() {
 	// If there were windows only tables, they would go here
 	// }
 
+	if runtime.GOOS == "linux" || runtime.GOOS == "darwin" {
+		linuxPlugins := []osquery.OsqueryPlugin{
+			table.NewPlugin(
+				"crowdstrike_falcon",
+				crowdstrike_falcon.CrowdstrikeFalconColumns(),
+				func(ctx context.Context, queryContext table.QueryContext) ([]map[string]string, error) {
+					return crowdstrike_falcon.CrowdstrikeFalconGenerate(ctx, queryContext, *flSocketPath)
+				}),
+		}
+		plugins = append(plugins, linuxPlugins...)
+	}
+
 	if runtime.GOOS == "darwin" {
 		darwinPlugins := []osquery.OsqueryPlugin{
 			table.NewPlugin("filevault_users", filevaultusers.FileVaultUsersColumns(), filevaultusers.FileVaultUsersGenerate),

tables/crowdstrike_falcon/BUILD.bazel

@@ -0,0 +1,25 @@
+load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
+
+go_library(
+    name = "crowdstrike_falcon",
+    srcs = ["crowdstrike_falcon.go"],
+    importpath = "github.com/macadmins/osquery-extension/tables/crowdstrike_falcon",
+    visibility = ["//visibility:public"],
+    deps = [
+        "//pkg/utils",
+        "@com_github_micromdm_plist//:plist",
+        "@com_github_osquery_osquery_go//:osquery-go",
+        "@com_github_osquery_osquery_go//plugin/table",
+        "@com_github_pkg_errors//:errors",
+    ],
+)
+
+go_test(
+    name = "crowdstrike_falcon_test",
+    srcs = ["crowdstrike_falcon_test.go"],
+    embed = [":crowdstrike_falcon"],
+    deps = [
+        "//pkg/utils",
+        "@com_github_stretchr_testify//assert",
+    ],
+)

tables/crowdstrike_falcon/crowdstrike_falcon.go

@@ -0,0 +1,147 @@
+package crowdstrike_falcon
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"regexp"
+	"runtime"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/macadmins/osquery-extension/pkg/utils"
+	"github.com/micromdm/plist"
+	"github.com/osquery/osquery-go"
+	"github.com/osquery/osquery-go/plugin/table"
+	"github.com/pkg/errors"
+)
+
+var falconCtlPath = map[string]string{
+	"linux":  "/opt/CrowdStrike/falconctl",
+	"darwin": "/Applications/Falcon.app/Contents/Resources/falconctl",
+}
+
+type CrowdStrikeOutput struct {
+	AgentID                  string `plist:"aid"`
+	CID                      string `plist:"cid"`
+	FalconVersion            string `plist:"falcon_version"`
+	ReducedFunctionalityMode bool   `plist:"rfm"`
+	SensorLoaded             bool   `plist:"sensor_loaded"`
+}
+
+func CrowdstrikeFalconColumns() []table.ColumnDefinition {
+	return []table.ColumnDefinition{
+		table.TextColumn("agent_id"),
+		table.TextColumn("cid"),
+		table.TextColumn("falcon_version"),
+		table.TextColumn("reduced_functionality_mode"),
+		table.TextColumn("sensor_loaded"),
+	}
+}
+
+func CrowdstrikeFalconGenerate(ctx context.Context, queryContext table.QueryContext, socketPath string) ([]map[string]string, error) {
+	var results []map[string]string
+	r := utils.NewRunner()
+	fs := utils.OSFileSystem{}
+
+	var output = CrowdStrikeOutput{}
+	var err error
+
+	switch runtime.GOOS {
+	case "darwin":
+		output, err = runCrowdstrikeFalconDarwin(r, fs)
+		if err != nil {
+			fmt.Println(err)
+			return nil, err
+		}
+
+	case "linux":
+		osqueryClient, err := osquery.NewClient(socketPath, 10*time.Second)
+		if err != nil {
+			return nil, err
+		}
+		defer osqueryClient.Close()
+		output, err = runCrowdstrikeFalconLinux(r, fs, osqueryClient)
+		if err != nil {
+			fmt.Println(err)
+			return nil, err
+		}
+	}
+
+	results = append(results, map[string]string{
+		"agent_id":                   strings.ToUpper(output.AgentID),
+		"cid":                        strings.ToUpper(output.CID),
+		"falcon_version":             output.FalconVersion,
+		"reduced_functionality_mode": strconv.FormatBool(output.ReducedFunctionalityMode),
+		"sensor_loaded":              strconv.FormatBool(output.SensorLoaded),
+	})
+
+	return results, nil
+}
+
+func runCrowdstrikeFalconLinux(r utils.Runner, fs utils.FileSystem, client utils.OsqueryClient) (CrowdStrikeOutput, error) {
+	var output CrowdStrikeOutput
+
+	_, err := fs.Stat(falconCtlPath[runtime.GOOS])
+	if err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			return output, nil
+		}
+		return output, err
+	}
+
+	falconProcessQuery := "SELECT 1 FROM processes WHERE name like 'falcon-sensor%';"
+	loadedState, err := client.QueryRows(falconProcessQuery)
+	if err != nil {
+		return output, err
+	}
+
+	if len(loadedState) == 0 {
+		output.SensorLoaded = false
+	} else {
+		output.SensorLoaded = true
+	}
+
+	out, err := r.Runner.RunCmd(falconCtlPath[runtime.GOOS], "-g", "--aid", "--cid", "--rfm-state", "--version")
+	if err != nil {
+		return output, errors.Wrap(err, falconCtlPath[runtime.GOOS]+" -g --aid --cid --rfm-state --version")
+	}
+
+	agentIdRegex := regexp.MustCompile(`aid="([a-f0-9]{32})"`)
+	output.AgentID = agentIdRegex.FindStringSubmatch(strings.ToLower(string(out)))[1]
+
+	cidRegex := regexp.MustCompile(`cid="([a-f0-9]{32})"`)
+	output.CID = cidRegex.FindStringSubmatch(strings.ToLower(string(out)))[1]
+
+	versionRegex := regexp.MustCompile(`version\s?=\s?(\d\.\d{2}\.\d{5}\.\d)`)
+	output.FalconVersion = versionRegex.FindStringSubmatch(strings.ToLower(string(out)))[1]
+
+	// as of 7.29, `rfm-state` is always returned on a newline, and always has a trailing comma.
+	rfmStateRegex := regexp.MustCompile(`rfm-state\s?=\s?(true|false),?`)
+	output.ReducedFunctionalityMode = rfmStateRegex.FindStringSubmatch(strings.ToLower(string(out)))[1] == "true"
+
+	return output, nil
+}
+
+func runCrowdstrikeFalconDarwin(r utils.Runner, fs utils.FileSystem) (CrowdStrikeOutput, error) {
+	var output CrowdStrikeOutput
+
+	_, err := fs.Stat(falconCtlPath[runtime.GOOS])
+	if err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			return output, nil
+		}
+		return output, err
+	}
+
+	out, err := r.Runner.RunCmd(falconCtlPath[runtime.GOOS], "info")
+	if err != nil {
+		return output, errors.Wrap(err, falconCtlPath[runtime.GOOS]+" info")
+	}
+	if err := plist.Unmarshal(out, &output); err != nil {
+		return output, errors.Wrap(err, "unmarshalling falconctl output")
+	}
+
+	return output, nil
+}