CrowdStrike Falcon Sensor and Container Scanning

Docker Container Scanning

The CrowdStrike Falcon sensor can scan Docker containers created on the host OS, as well as containers running on Kubernetes clusters. The sensor can be installed on the host OS or on each individual container.

Host OS Installation

When the Falcon sensor is installed on the host OS, it can scan all Docker containers created on that host. This provides visibility into the security posture of all containers running on the host, regardless of the container type or orchestration platform.

Container Installation

The Falcon sensor can also be installed on each individual container. This provides even greater visibility and control over the security of each container. When the sensor is installed on a container, it can scan the container's file system, processes, and network traffic.

Behavioral Indicators of Attack

CrowdStrike has several behavioral indicators of attack (IOAs) to detect and prevent sensor tampering, including techniques that involve moving the sensor away from what is considered the normal location. Our sensor will continue to evolve to detect and prevent new and emerging threats.

Conclusion

The CrowdStrike Falcon sensor provides comprehensive visibility and protection for Docker containers, whether they are created on the host OS or running on Kubernetes clusters. The sensor's ability to scan containers from both the host and container perspectives provides a complete view of the security posture of each container.