Installing CrowdStrike Falcon Sensor on Databricks Workers

mm_soc — Thu, 18 Apr 2024 17:54:47 GMT

Greetings,

Does anyone here have experience deploying the CrowdStrike Falcon sensor on Databricks worker instances? For context, the cluster is deployed in AWS and we use a Databricks Ubuntu 20.04 AMI. Databricks allows adding a bootstrap/startup script that we attempted to use to download and install the Falcon sensor, which did not work as Databricks apparently runs inside of an LXC userspace and the Falcon sensor is not compatible (per CrowdStrike support). To confirm, I deployed an EC2 instance using the same AMI and bootstrap script directly from the AWS console and the Falcon sensor installs/runs normally on the underlying OS.

We also noticed that the Databricks AMI didn't have the SSM agent installed, preventing the use of State Manager to deploy the sensor.

Is there any way to "bake" the Falcon sensor into a custom AMI and specify it when creating Databricks clusters? Any other options?

Thanks

Re: Installing CrowdStrike Falcon Sensor on Databricks Workers

JP7 — Wed, 17 Sep 2025 18:34:15 GMT

I have the same doubt!

topic Re: Installing CrowdStrike Falcon Sensor on Databricks Workers in Community Articles

Installing CrowdStrike Falcon Sensor on Databricks Workers

Re: Installing CrowdStrike Falcon Sensor on Databricks Workers