CrowdStrike Falcon: sensors, policies, containment and Real Time Response
For technicians and admins who run CrowdStrike Falcon: installing the Falcon sensor with the customer ID and installation tokens, choosing sensor versions with Sensor Update Policies, what the prevention policy controls (including automated remediation), protecting the sensor with tamper protection and maintenance tokens, and responding with network containment and Real Time Response.
- Level
- Intermediate
- Length
- About 50 minutes
- Contents
- 3 lessons · 1 video · final exam
- Status
- Published · updated 2 Oct 2026
- CrowdStrike Falcon
Skills you'll practise
- Install and verify a Falcon sensor using the customer ID, and explain what an installation token prevents
- Choose N, N-1 or N-2 sensor versions for groups of hosts with Sensor Update Policies and explain how Rapid Response Content differs
- Describe what network containment does to a host and when to request it
- Use Real Time Response safely for investigation and remediation, and record what was run
- Explain how Sensor Tampering Protection and single-use maintenance tokens control sensor removal
Course outline
- 1.CrowdStrike Falcon essentialsVideo · 2 min
- 2.The Falcon sensor: installing, verifying and versioningLesson · 17 min
- 3.Policies, tamper protection and multi-tenant setupsLesson · 15 min
- 4.Responding: detections, network containment and Real Time ResponseLesson · 18 min
- 5.CrowdStrike Falcon: sensors, policies, containment and Real Time Response: knowledge checkKnowledge check · 18 questions
- 6.Final exam9 questions · passing it completes the course, so people who already know the material can test out
Sources it draws on
The lessons and questions are written from these references, so learners can go back to the original.
- CrowdStrike Tech Hub: Install Falcon Sensor for Windows (customer ID, installation tokens, no restart, sc.exe query csagent, Newly Installed Sensors)
- CrowdStrike Free Trial Guide FAQ (Falcon Prevent technologies, online and offline protection, maintenance token to uninstall)
- CrowdStrike: Falcon Content Update Preliminary Post Incident Report (Sensor Content vs Rapid Response Content; N, N-1, N-2 through Sensor Update Policies)
- CrowdStrike Tech Hub: Remediate Threats with Real Time Response
- CrowdStrike Tech Hub: Automated Remediation (enabled in the prevention policy)
- CrowdStrike Tech Hub: Detecting and Remediating Threats with EDR (process tree, network contain)
- CrowdStrike Cybersecurity 101: What is EDR? (network containment keeps the cloud connection and persists through reboots)
- CrowdStrike Tech Hub: Falcon Flight Control (parent and child CIDs, shared policies)
- CrowdStrike blog: AV-Comparatives anti-tampering certification (Sensor Tampering Protection)
- CrowdStrike Tech Hub: Falcon Fusion with Real Time Response
See it with your own jobs and topics
Tell us about your team and we'll walk you through setup, from choosing jobs to your first skills check.