crowdstrike falcon

falcon.nix

{pkgs?import <nixpkgs> {}}:
with pkgs;

stdenv.mkDerivation {
  name = "falcon-sensor";
  version = "4.18.0-6402";
  arch = "amd64";
  src = ./falcon-sensor_6.34.0-13108_amd64.deb;

  nativeBuildInputs = [ dpkg autoPatchelfHook zlib pkgs.libnl pkgs.openssl ];
  propagateBuildInputs = [pkgs.libnl pkgs.openssl];

  sourceRoot = ".";

  unpackCmd = ''
      dpkg-deb -x "$src" .
  '';

  installPhase = ''
      cp -r ./ $out/
      realpath $out
  '';

  meta = {
    description = "Crowdstrike Falcon Sensor";
    homepage    = "https://www.crowdstrike.com/";
    #license     = licenses.unfree;
    #platforms   = platforms.linux;
  };
}

I manually created /var/log/falconctl.log, but it's complaining about a missing falconstore.

$ tail -f /var/log/falconctl.log
Tue Jul 12 17:17:26 2022 Invalid file /opt/CrowdStrike/falconstore length: 0    (372889) [619]