Jamf Pro Computer Extension Attribute to report version of CrowdStrike Falcon client

crowdstrike-falcon-sensor-version.sh

#!/bin/bash
# 
# Created by jps3@lehigh.edu on 2020-?-? (History empty)
# Updated by jps3@lehigh.edu on 2022-05-17
# 
# https://gist.github.com/jps3/4f4cadc7f00c6108a87a0865651b5fe7
#
# Jamf Pro > Settings > Computer Management > Extension Attributes
# Display Name      : crowdstrike-falcon-sensor-version
# Description       : Parses the output of the 'falconctl' command for the version string to report as a result.
# Data Type         : String
# Inventory Display : General
# Input Type        : Script
# 

# ----------------------------------------------------------------------
#  Vars
# ----------------------------------------------------------------------

FALCONCTL="$1/Applications/Falcon.app/Contents/Resources/falconctl"
FALCONCTL_LEGACY="$1/Library/CS/falconctl"

# ----------------------------------------------------------------------
#  Main
# ----------------------------------------------------------------------

# Simple test for current or legacy installation
if [[ ! -x "$FALCONCTL" && -x "$FALCONCTL_LEGACY" ]]; then
	FALCONCTL="$FALCONCTL_LEGACY"
fi

FALCON_VERSION=$("${FALCONCTL}" stats 2>/dev/null  | awk -F: '$1=="version" { print $2 }')

echo "<result>${FALCON_VERSION}</result>"

exit 0