What happens if a CrowdStrike Falcon sensor is incompatible with the kernel version?

When a CrowdStrike Falcon sensor is incompatible with the kernel version, it enters Reduced Functionality Mode. This mode allows the sensor to remain operational, but with limited capabilities to ensure some level of protection is still provided.

In Reduced Functionality Mode, certain features may be disabled, which helps the system avoid potential conflicts or issues that might arise from a sensor not fully supporting the kernel it's installed on. This design helps maintain a protective posture while allowing administrators the opportunity to resolve the compatibility issue.

Other scenarios, such as automatic updates, complete failure to install, or deletion of the sensor, do not encapsulate the intended design of the Falcon platform in response to compatibility challenges. Instead, the focus is on maintaining some operational capability even when full functionality cannot be achieved.