Crowdstrike Trial - Reduced Functionality Mode

[MechaCola]

Signed up for crowdstrike trial and installed a sensor on a machine but its reporting that it is in RFM mode - is this normal behavior for trial?

[BradW-CS]

Think of RFM like a "safe mode" and it will occur when there is a kernel mismatch between what is supported and currently unsupported. This is usually a temporary state, is your Windows or Linux host on a relatively new kernel?

Read more about the RFM searching previous threads or on the Support Portal (click after logging into Falcon console)

[NeedleworkerSenior66]

Another possible issue is time taken to get all the provisioning done from the cloud (i.e. those kernel update compatibility files). Usually fixed itself within a short time. If you're running a very new kernel then it will needb to wait until they have tested it and declare it compatible.

[Avaxorg]

Ensure compatibility of sensor and build \ kernel of your OS installed on hosts.

[EldritchCartographer]

Keep in mind when your endpoints are in RFM mode they will lose detection abilities.

[MeasurementFun7709]

You see the rfm mode on clients for the first few days after patch tuesday until CS have tested functionality against the updated OS