From e348fe75c7ddd3e61ea94dfe87ed172b5d301393 Mon Sep 17 00:00:00 2001
From: Dave Herder <27025660+dherder@users.noreply.github.com>
Date: Fri, 19 Jul 2024 10:23:48 -0700
Subject: [PATCH] adding crowdstrike detection on canary (#20619)

detecting the health of crowdstrike
---
 it-and-security/lib/collect-crowdstrike-info.queries.yml | 8 ++++++++
 it-and-security/lib/collect-crowdstrike-info.yml         | 8 ++++++++
 it-and-security/teams/workstations-canary.yml            | 1 +
 3 files changed, 17 insertions(+)
 create mode 100644 it-and-security/lib/collect-crowdstrike-info.queries.yml
 create mode 100644 it-and-security/lib/collect-crowdstrike-info.yml

diff --git a/it-and-security/lib/collect-crowdstrike-info.queries.yml b/it-and-security/lib/collect-crowdstrike-info.queries.yml
new file mode 100644
index 0000000000..e68970df54
--- /dev/null
+++ b/it-and-security/lib/collect-crowdstrike-info.queries.yml
@@ -0,0 +1,8 @@
+- name: Get Crowdstrike Falcon network content filter status
+  description: "Collects crowdstrike information"
+  query: |
+    /* Load up the plist */ WITH extensions_plist AS (SELECT *, rowid FROM plist WHERE path = '/Library/Preferences/com.apple.networkextension.plist') /* Find the first "Enabled" key after the key indicating the crowdstrike app */ SELECT value AS enabled FROM extensions_plist WHERE subkey = 'Enabled' AND rowid > (SELECT rowid FROM extensions_plist WHERE value = 'com.crowdstrike.falcon.App') LIMIT 1;
+  interval: 300 # 5 minutes
+  observer_can_run: true
+  automations_enabled: false
+  platform: darwin,linux,windows
diff --git a/it-and-security/lib/collect-crowdstrike-info.yml b/it-and-security/lib/collect-crowdstrike-info.yml
new file mode 100644
index 0000000000..e68970df54
--- /dev/null
+++ b/it-and-security/lib/collect-crowdstrike-info.yml
@@ -0,0 +1,8 @@
+- name: Get Crowdstrike Falcon network content filter status
+  description: "Collects crowdstrike information"
+  query: |
+    /* Load up the plist */ WITH extensions_plist AS (SELECT *, rowid FROM plist WHERE path = '/Library/Preferences/com.apple.networkextension.plist') /* Find the first "Enabled" key after the key indicating the crowdstrike app */ SELECT value AS enabled FROM extensions_plist WHERE subkey = 'Enabled' AND rowid > (SELECT rowid FROM extensions_plist WHERE value = 'com.crowdstrike.falcon.App') LIMIT 1;
+  interval: 300 # 5 minutes
+  observer_can_run: true
+  automations_enabled: false
+  platform: darwin,linux,windows
diff --git a/it-and-security/teams/workstations-canary.yml b/it-and-security/teams/workstations-canary.yml
index 73f280909d..27ab9430ee 100644
--- a/it-and-security/teams/workstations-canary.yml
+++ b/it-and-security/teams/workstations-canary.yml
@@ -142,3 +142,4 @@ queries:
   - path: ../lib/collect-vs-code-extensions.queries.yml
   - path: ../lib/collect-software-permissions-system.queries.yml
   - path: ../lib/collect-software-permissions-user.queries.yml
+  - path: ../lib/collect-crowdstrike-info.queries.yml