CrowdStrike Falcon is a modern cybersecurity protection software that uses a small program, called a sensor, installed on computers and servers to help protect against malware, ransomware, and other advanced cyberattacks. CrowdStrike uses behavioral analysis and threat intelligence to identify suspicious activity and detect, prevent, and respond to potential cybersecurity threats. The software operates in the background, providing continuous protection while helping authorized security teams investigate and respond to security incidents.
General Information
CrowdStrike is an endpoint detection and response (EDR) cybersecurity solution which includes anti-malware / antivirus software built-in. It helps detect, prevent, and respond to threats such as malware, ransomware, and unauthorized access. The technology helps security teams investigate and contain threats affecting computers and servers.
As part of the University of California's ongoing efforts to strengthen cybersecurity, the UC Office of the President (UCOP) is transitioning the centrally provided Endpoint Detection and Response (EDR) solution from Trellix HX (formerly known as FireEye) to CrowdStrike Falcon. This UC-wide transition supports the university's long-term cybersecurity strategy by providing enhanced threat detection, investigation, response, and centralized security management capabilities.
Both Trellix HX (formerly known as FireEye) and CrowdStrike Falcon are Endpoint Detection and Response (EDR) solutions designed to protect computers and university systems from cybersecurity threats. CrowdStrike Falcon is a modernized security platform that offers:
- Advanced threat detection and response: Uses behavioral analysis and threat indicators to help identify, prevent, and respond to known and emerging cybersecurity threats, including malware, ransomware, and unauthorized access.
- CrowdStrike uses a lightweight endpoint sensor designed to operate continuously in the background.
- Broader device compatibility: Supports Windows, macOS, and Linux devices, including Windows 11 ARM-based devices that were not supported by Trellix.
- Integrated security capabilities: Provides a platform designed to enhance threat visibility, investigation, and response, helping security teams identify and address potential threats.
CrowdStrike was selected by the University of California following an evaluation of multiple factors, including cybersecurity capabilities, operational requirements, vendor maturity, scalability, and long-term security needs.
Yes. UC's evaluation considered CrowdStrike's July 2024 outage as well as the corrective actions implemented following the incident. CrowdStrike published a root-cause analysis and implemented changes to its testing, validation, and software/content deployment processes. UC considered those factors as part of its overall assessment of the platform.
Deployment and Device Requirements
UCLA is implementing CrowdStrike Falcon in phases, working with local IT teams to coordinate deployment across university devices and environments. Following initial deployment to Digital & Technology Solutions (DTS) devices and a pilot with participating campus units, local IT teams will prioritize servers and administrative staff computers from November 2026 through January 2027. Deployment will expand to faculty, research, and remaining applicable staff devices from January through May 2027. Your local IT team will provide more specific information about deployment timing and any actions required for your computer.
CrowdStrike is required for applicable devices covered by the University of California's endpoint security requirements. At UCLA, these include:
- University-owned devices: UCLA-owned or purchased laptops, desktops, workstations, and servers, including devices purchased through university grants.
- Specialized IT and research environments: Applicable servers, research workstations, and other computing systems used for university business are also subject to endpoint security requirements. Some specialized systems may require additional compatibility assessments or an approved alternative approach.
Installing CrowdStrike on a personally owned computer allows the sensor to collect security data from that device, such as information about running processes, files and file paths, network connections, system activity, and potential security events. In alignment with university policy, authorized UCLA security personnel may review this information when needed to protect UCLA systems or investigate cybersecurity threats. Because CrowdStrike operates at the device level, users should consider whether installing university endpoint security software on a personally owned computer is appropriate for their use. Where available, a UCLA-managed device may provide greater separation between personal and university activity.
CrowdStrike Falcon supports many currently supported versions of Windows, macOS, and Linux. Compatibility depends on the operating system version, architecture, and configuration. Full platform support can be reviewed on CrowdStrike support page.
UCLA's CrowdStrike endpoint deployment currently applies to supported Windows, macOS, and Linux computers. Mobile phones and non-Microsoft Surface tablets are not part of this deployment.
Yes. CrowdStrike Falcon can protect supported laptops, desktops, workstations, servers, and many virtualized computing environments. Virtual desktop infrastructure and other cloned or non-persistent systems require specific deployment configuration, so administrators should follow UCLA's CrowdStrike technical deployment guidance rather than using the standard endpoint installation process.
It depends on your device and how it is managed. CrowdStrike deployment is being coordinated by Digital & Technology Solutions (DTS) and local IT teams across UCLA.
- IT-managed computers: For many university-managed laptops, desktops, and workstations, CrowdStrike will be installed automatically through existing device management tools, with little or no action required from the user.
- Servers and IT-managed environments: Server administrators and local IT teams will be responsible for coordinating and deploying CrowdStrike to the servers and systems they manage, following the deployment guidance and technical resources provided by the CrowdStrike project team.
- Self-managed or personally owned devices: Individuals who manage their own devices may need to install CrowdStrike themselves using instructions and resources provided by UCLA.
Do not uninstall Trellix HX (formerly known as FireEye) before CrowdStrike Falcon has been installed and is operational. To ensure your computer remains protected throughout the transition, CrowdStrike Falcon should be installed and its protection verified before Trellix HX is removed. Depending on how your computer is managed, the installation of CrowdStrike Falcon and removal of Trellix HX may be handled automatically by your IT team or require you to complete specific steps. Your local IT team will provide instructions on when and how to install CrowdStrike Faclon, remove Trellix HX, and whether any changes to other security software are necessary.
Your local IT team may provide instructions for confirming installation. On some systems, CrowdStrike Falcon may not display a prominent desktop icon because the sensor runs primarily as a background service. If you are unsure whether your device is protected, contact your local IT team rather than attempting to reinstall the software.
Beginning June 1, 2027, Duo Desktop will no longer recognize Trellix (formerly known as FireEye) as an approved endpoint security solution. Duo Desktop is already used to check whether applicable devices meet UCLA's cybersecurity requirements when accessing certain university applications and services. CrowdStrike will replace Trellix as the approved EDR solution for these checks. If CrowdStrike Falcon is not installed on your computer, you may be unable to access certain UCLA applications and services, even if Trellix HX is still installed.
CrowdStrike Falcon is replacing Trellix HX (formerly known as FireEye) as UCLA's approved endpoint security solution, and installation is required for devices covered by applicable UC cybersecurity requirements. Users cannot opt out of required endpoint security protections solely based on personal preference.
If CrowdStrike Falcon cannot be installed because of a documented technical, research, or operational constraint, contact your local IT team. The IT team can work with UCLA Information Security to determine whether an exception or approved alternative security control is appropriate.
Computer Performance, Teaching, and Research
CrowdStrike Falcon is designed to run continuously in the background with minimal impact on normal computer use. Compared to Trellix HX, it yield substantial performance increases. Performance may vary depending on the device, operating system, and specialized applications. If you experience an unexpected performance issue following installation, contact your local IT team.
CrowdStrike Falcon is deployed for cybersecurity purposes. Its use does not alter UCLA's policies protecting academic freedom or governing access to electronic communications records. While enforcement begins on June 1, 2027, shortly before the end of the spring quarter, we strongly encourage users to complete the installation well in advance of the deadline. Installing early will help minimize potential disruptions to academic activities and ensure a smooth transition during this busy period of the academic calendar.
Yes. CrowdStrike Falcon includes protection capabilities that continue operating when the computer is disconnected from the internet. Some cloud-based detection, threat intelligence, management, and response capabilities require connectivity and will resume when the device reconnects.
If CrowdStrike appears to block a legitimate application, interfere with specialized software, or cause an unexpected issue on your computer, contact your local IT team for assistance. For urgent issues affecting a critical service, local IT can escalate the incident to UCLA Information Security for expedited troubleshooting and, when necessary, temporary mitigation measures.
CrowdStrike is part of UCLA's required endpoint security protection for applicable devices and is intended to remain active once installed. You should not attempt to stop, disable, or remove CrowdStrike without instructions or authorization from UCLA Information Security team. Disabling or removing required endpoint security software may leave your computer and university information vulnerable to cybersecurity threats and may affect your ability to access certain UCLA applications and services. The sensor includes protections intended to prevent unauthorized disabling or removal which is a tactic cyber criminals utilize to evade detection.
Privacy, Data, and Security Response
CrowdStrike Falcon is not deployed by UCLA as an employee productivity or general-purpose internet monitoring tool. CrowdStrike Falcon does collect security-related activity from protected devices so that malicious or suspicious behavior can be identified and investigated. Depending on the activity involved, this may include information about processes, applications, files, system activity, network connections, domains, and user or device identifiers.
Authorized UCLA personnel may review relevant security information when necessary to investigate or respond to a cybersecurity event. Access to university electronic communications records is governed by applicable UC and UCLA policies, including the UC Electronic Communications Policy and UCLA Policy 410.
CrowdStrike Falcon collects security data necessary to detect, investigate, and respond to cybersecurity threats. Depending on the operating system and enabled CrowdStrike Falcon capabilities, this may include:
- device and operating-system information;
- usernames and device identifiers;
- running processes and process relationships;
- command-line activity;
- application and executable information;
- filenames and file paths;
- file and registry activity;
- network connections, IP addresses, DNS activity, and related network metadata;
- security detections and information associated with suspicious activity.
CrowdStrike is a cloud-based security platform, and security data from protected devices is transmitted to the CrowdStrike platform for analysis and detections and alerts are retained for 90 days in CrowdStrike. During a cyber incident investigation, and with consent, CrowdStrike may also support authorized response actions such as retrieving a suspicious file, collecting diagnostic or forensic information, or executing response actions when needed during an investigation.
Access to UCLA CrowdStrike data is limited to personnel and service providers with authorized security responsibilities and is subject to university policy, contractual controls, and role-based access.
Additional access to the contents of electronic communications or other records is governed by the UC Electronic Communications Policy and UCLA Policy 410.
UCLA and CrowdStrike do not provide CrowdStrike security data to law enforcement or other outside parties as a matter of routine. Information may be disclosed when authorized by UCLA, necessary to provide contracted services, or required by applicable law or valid legal process.
Responding to subpoenas is governed by UCLA Policy 120: Legal Process - Summonses, Complaints, and Subpoenas and UCLA Procedure 120.1: Producing Records Under Subpoena Duces Tecum and Deposition Subpoena. Any legal process served to the Information Security Office is immediately forwarded to Campus Counsel for disposition. We do not release security-related information to law enforcement or other entities unless directed to do so by counsel. If and when legal counsel authorizes a release of information, counsel reviews the information before providing it to outside agencies. Internally, at the campus or system level, this data is not released except in the course of an authorized audit, and even in those cases, great care is taken to release only the minimum necessary data.
CrowdStrike Falcon is not deployed by UCLA to maintain a conventional history of the websites you browse. However, security data may include network-related information such as domains, URLs, DNS requests, IP addresses, or connections when relevant to system activity or a cybersecurity detection.
If a cybersecurity investigation requires access to additional electronic communications records, including browser records, that access must follow applicable UC and UCLA policies: Electronic Communications Policy.
CrowdStrike Falcon provides endpoint protection capabilities that help prevent, detect, investigate, and respond to cybersecurity threats, including malware and ransomware.
Depending on the device and operating system, other built-in or centrally managed security protections may continue to operate alongside CrowdStrike Falcon. Users should not install, disable, or remove antivirus or other security software unless instructed to do so by their local IT team.
Your local IT team will manage the appropriate security configuration for UCLA-managed devices and provide instructions if any changes are required
CrowdStrike Falcon includes security response capabilities that may allow authorized UCLA Information Security personnel to perform limited remote actions on a protected computer when necessary to investigate or respond to a cybersecurity threat. These actions always occur with consent from the individual.
For example, during a security incident, authorized personnel may need to collect diagnostic information, examine running processes or network connections, retrieve a suspicious file for analysis, stop malicious activity, or take other actions necessary to contain a threat.
These capabilities are used for cybersecurity purposes and are not intended for routine access to an individual's computer or for monitoring employee productivity, teaching, research, or other day-to-day activities.
Use of CrowdStrike Falcon and access to university electronic communications records are governed by applicable University of California and UCLA policies, including the UC Electronic Communications Policy and UCLA Policy 410.
CrowdStrike has technical capabilities that may allow authorized security personnel to retrieve individual files or collect diagnostic and forensic information when necessary to investigate or respond to a cybersecurity event. These actions always occur with consent from the individual.
This does not mean that UCLA routinely reviews or copies files from computers protected by CrowdStrike. File collection or other investigative actions are performed only when appropriate for a legitimate cybersecurity purpose and are subject to applicable University policies and authorization requirements.
Access to the contents of electronic communications or other protected records is governed by the UC Electronic Communications Policy and UCLA Policy 410, and other applicable University policies.
Getting Help
Our Information Security staff is on hand to answer all your questions about CrowdStrike Falcon. If you have any questions, please contact the Information Security Office at security@ucla.edu.