Queries/

Get Crowdstrike Falcon network content filter status

Zach Wasserman

Get the status of the Crowdstrike Falcon network content filter (as in "System Settings" > "Network > "Filters").

To learn more about queries, check this guide.

Query PowerShellNEW BashNEW

/* Load up the plist */ WITH extensions_plist AS (SELECT *, rowid FROM plist WHERE path = '/Library/Preferences/com.apple.networkextension.plist') /* Find the first "Enabled" key after the key indicating the crowdstrike app */ SELECT value AS enabled FROM extensions_plist WHERE subkey = 'Enabled' AND rowid > (SELECT rowid FROM extensions_plist WHERE value = 'com.crowdstrike.falcon.App') LIMIT 1;