What causes the CrowdStrike sensor to enter Reduced Functionality Mode (RFM)?

The CrowdStrike sensor entering Reduced Functionality Mode (RFM) is specifically due to an incompatibility with the current version of the kernel. In this scenario, when the sensor detects that it cannot effectively communicate or function properly with the operating system due to kernel issues, it will enter RFM to ensure some level of protective measures can still be maintained. This mode limits certain functionalities of the sensor but still allows for basic operations, helping to protect the system even in constrained environments.

It is essential for the sensors to operate with a compatible kernel to leverage the platform's full capabilities. When there's a mismatch, the sensor must revert to reduced capabilities to maintain stability and still deliver essential security features while avoiding conflicts that could arise from kernel incompatibilities.