How crowdstrike/azure-vm-extension works
This repository provides the CrowdStrike Falcon sensor Azure VM Extension: Azure invokes a platform-specific handler, which obtains a sensor package, runs the installer, and reports status. It also includes ARM deployment templates and Azure Policy templates for deploying the extension at scale. The source excerpts were unavailable, so runtime links follow the README’s documented flow; implementation-level call details are not inferred.
Main entry points: linux/handler Linux lifecycle handler · windows/handler Windows lifecycle handler · package Linux VM template · package-arc Linux Arc template
Components 15
Azure deployment
- Linux VM template
linux/package - Linux Arc template
linux/package-arc - Windows VM template
windows/package - Windows Arc template
windows/package-arc - Subscription policy
policy/falcon-subscription.bicep - Management group policy
policy/falcon-managementgroup.bicep
Linux handler
- Linux lifecycle handler
linux/handler
Windows handler
- Windows lifecycle handler
windows/handler
External integrations
- CrowdStrike API
- Azure Key Vault
- Falcon sensor package
- Falcon installer
- Azure status portal
Other components
- Deployment operator
- Azure VM extension
Connections 18
- Deployment operator → Azure VM extension: deploys extension
- Deployment operator → Linux VM template: selects deployment
- Deployment operator → Linux Arc template: selects deployment
- Deployment operator → Windows VM template: selects deployment
- Deployment operator → Windows Arc template: selects deployment
- Deployment operator → Subscription policy: applies policy
- Deployment operator → Management group policy: applies policy
- Azure VM extension → Linux lifecycle handler: invokes lifecycle
- Azure VM extension → Windows lifecycle handler: invokes lifecycle
- Linux lifecycle handler → CrowdStrike API: requests sensor
- Windows lifecycle handler → CrowdStrike API: requests sensor
- CrowdStrike API → Falcon sensor package: provides package
- Linux lifecycle handler → Falcon installer: executes installer
- Windows lifecycle handler → Falcon installer: executes installer
- Linux lifecycle handler → Azure Key Vault: retrieves credentials
- Windows lifecycle handler → Azure Key Vault: retrieves credentials
- Linux lifecycle handler → Azure status portal: reports status
- Windows lifecycle handler → Azure status portal: reports status