PHPackages                             jc0b/crowdstrike\_falcon - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Utility & Helpers](/categories/utility)
4. /
5. jc0b/crowdstrike\_falcon

ActiveLibrary[Utility & Helpers](/categories/utility)

jc0b/crowdstrike\_falcon
========================

A MunkiReport module for Crowdstrike Falcon.

v2.1(2y ago)06MITPHPPHP ^8.0

Since Jun 22Pushed 2y ago1 watchersCompare

[ Source](https://github.com/jc0b/crowdstrike_falcon)[ Packagist](https://packagist.org/packages/jc0b/crowdstrike_falcon)[ RSS](/packages/jc0b-crowdstrike-falcon/feed)WikiDiscussions main Synced 1mo ago

READMEChangelog (2)DependenciesVersions (4)Used By (0)

Crowdstrike Falcon module
=========================

[](#crowdstrike-falcon-module)

A Crowdstrike Falcon module for MunkiReport that collects output from the Falcon sensors `falconctl` binary, and submits it to MunkiReport.

This module is additionally capable of reading the Zero Trust Assessment file if it is present on the device, and parsing the scores.

Configuration
-------------

[](#configuration)

The module uses the Agent ID of a device to provide direct links to the Crowdstrike console from Munkireport for each device. To customise the region you use, please set the variable below, so that the links are correct.

```
CROWDSTRIKE_REGION="falcon"
```

Possible regions and their values (defaults to `falcon`):

- US-1: `falcon`
- US-2: `falcon.us-2`
- EU-1: `falcon.eu-1`
- US-gov-1: `falcon.laggar.gcw`

Table Schema
------------

[](#table-schema)

---

- id - increments - Incremental value used by MunkiReport
- serial\_number - string - Serial number of Mac
- agent\_id - string - The ID of the Falcon agent on a machine
- customer\_id - string - The CCID associated with the machine
- sensor\_operational - string - Information on the status of the sensor
- sensor\_version - string - The Falcon sensor version
- fulldiskaccess\_granted - string - Whether the Falcon Sensor actually reports having Full Disk Access permission
- tamper\_protection - string - Whether the sensor reports tamper protection being enabled
- overall\_zta\_score - integer - The overall Zero Trust Assessment score
- os\_zta\_score - integer - The OS Zero Trust Assessment score
- sensor\_zta\_score - integer - The sensor configuration Zero Trust Assessment score

###  Health Score

23

—

LowBetter than 27% of packages

Maintenance20

Infrequent updates — may be unmaintained

Popularity4

Limited adoption so far

Community7

Small or concentrated contributor base

Maturity51

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~82 days

Total

2

Last Release

969d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/e3052f8de5271b92eb53f0604b427cdc808905958d7fbea450e6f9a55f6e0262?d=identicon)[jc0b](/maintainers/jc0b)

---

Top Contributors

[![jc0b](https://avatars.githubusercontent.com/u/27809638?v=4)](https://github.com/jc0b "jc0b (44 commits)")

### Embed Badge

![Health badge](/badges/jc0b-crowdstrike-falcon/health.svg)

```
[![Health](https://phpackages.com/badges/jc0b-crowdstrike-falcon/health.svg)](https://phpackages.com/packages/jc0b-crowdstrike-falcon)
```

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)