diff --git a/it-and-security/lib/collect-crowdstrike-info.queries.yml b/it-and-security/lib/collect-crowdstrike-info.queries.yml
new file mode 100644
index 0000000000..e68970df54
--- /dev/null
+++ b/it-and-security/lib/collect-crowdstrike-info.queries.yml
@@ -0,0 +1,8 @@
+- name: Get Crowdstrike Falcon network content filter status
+  description: "Collects crowdstrike information"
+  query: |
+    /* Load up the plist */ WITH extensions_plist AS (SELECT *, rowid FROM plist WHERE path = '/Library/Preferences/com.apple.networkextension.plist') /* Find the first "Enabled" key after the key indicating the crowdstrike app */ SELECT value AS enabled FROM extensions_plist WHERE subkey = 'Enabled' AND rowid > (SELECT rowid FROM extensions_plist WHERE value = 'com.crowdstrike.falcon.App') LIMIT 1;
+  interval: 300 # 5 minutes
+  observer_can_run: true
+  automations_enabled: false
+  platform: darwin,linux,windows
diff --git a/it-and-security/lib/collect-crowdstrike-info.yml b/it-and-security/lib/collect-crowdstrike-info.yml
new file mode 100644
index 0000000000..e68970df54
--- /dev/null
+++ b/it-and-security/lib/collect-crowdstrike-info.yml
@@ -0,0 +1,8 @@
+- name: Get Crowdstrike Falcon network content filter status
+  description: "Collects crowdstrike information"
+  query: |
+    /* Load up the plist */ WITH extensions_plist AS (SELECT *, rowid FROM plist WHERE path = '/Library/Preferences/com.apple.networkextension.plist') /* Find the first "Enabled" key after the key indicating the crowdstrike app */ SELECT value AS enabled FROM extensions_plist WHERE subkey = 'Enabled' AND rowid > (SELECT rowid FROM extensions_plist WHERE value = 'com.crowdstrike.falcon.App') LIMIT 1;
+  interval: 300 # 5 minutes
+  observer_can_run: true
+  automations_enabled: false
+  platform: darwin,linux,windows
diff --git a/it-and-security/teams/workstations-canary.yml b/it-and-security/teams/workstations-canary.yml
index 73f280909d..27ab9430ee 100644
--- a/it-and-security/teams/workstations-canary.yml
+++ b/it-and-security/teams/workstations-canary.yml
@@ -142,3 +142,4 @@ queries:
   - path: ../lib/collect-vs-code-extensions.queries.yml
   - path: ../lib/collect-software-permissions-system.queries.yml
   - path: ../lib/collect-software-permissions-user.queries.yml
+  - path: ../lib/collect-crowdstrike-info.queries.yml