Skip to main content
Requires Enterprise plan. Contact sales for access.
Deploy endpoint security agents to all environments automatically. Useful when:
  • Meeting compliance requirements for endpoint detection and response (EDR)
  • Monitoring development environments for threats
  • Maintaining security visibility across your organization
Available agents: CrowdStrike Falcon

​
CrowdStrike Falcon

Deploy the Falcon sensor as a sidecar container reporting to your CrowdStrike console.

​
Prerequisites

  • CrowdStrike Falcon subscription with container sensor support
  • Access to Falcon container images
  • Customer ID (CID)

​
Configuration

  1. Go to Policies and toggle Enable CrowdStrike Falcon
  2. Click Settings
Security agents toggle
  1. Enter required information:
    • Customer ID (CID): Stored securely, not visible in secrets list
    • Falcon Sensor Image: Full image reference (e.g., 123456789.dkr.ecr.us-east-1.amazonaws.com/falcon-sensor:7.18.0-17106)
CrowdStrike configuration
  1. (Optional) Expand Advanced Options:
    • Tags: Comma-separated tags for Falcon console grouping
    • Additional Falcon Options: Key-value pairs for falconctl config
Advanced options
  1. Click Save
For private registries, configure container registry authentication.

​
CLI configuration

# View current configuration
gitpod organization security-agent get --organization-id <org-id>

# Enable CrowdStrike Falcon
gitpod organization security-agent set \
  --organization-id <org-id> \
  --crowdstrike-enabled \
  --crowdstrike-image <image-reference> \
  --crowdstrike-cid-secret-id <secret-id>

​
How it works

When enabled, the Falcon sensor deploys automatically as a privileged sidecar to all environments. Metadata tags are added automatically: env:<id>, project:<id>, org:<id>.

​
Effect on users

Users cannot view, modify, or disable the security agent—only admins can configure it.

​
Troubleshooting

IssueSolution
Sensor not in Falcon consoleVerify CID, check network connectivity, review environment logs
Image pull failuresVerify registry auth, check image reference, confirm IAM permissions (ECR)
Sensor offlineCheck network to CrowdStrike, verify CID is active, review sensor logs