Where Does CrowdStrike Falcon Store Sensor Data?
Where CrowdStrike Falcon sensor keeps data and logs on Windows and macOS computers. Full paths are listed below.
Last updated
Falcon is EDR cloud with a tiny sensor. Your tenant holds hosts, detections, and quarantine. Each computer holds sensor state, policy cache, and support logs.
Same customer ID means same fleet. Exact sensor folder names shift with Windows versus Mac builds and versions. Keep online during incidents so telemetry uploads. If hosts vanish, check the customer ID first. A test tenant twin is the usual empty fleet cause with security tools. When in doubt, verify paths inside the app before trusting a remembered folder.
Where CrowdStrike Falcon stores this, by platform
C:\Program Files\CrowdStrike (sensor state, detections in cloud)
Detections follow your CrowdStrike tenant. Sensor holds state plus support logs. Uninstalls never touch cloud timelines. Match the customer ID exactly.
/Library/CrowdStrike (sensor state, detections in cloud)
Same sensor model on Mac with state undercrowdstrike directories. Console holds timelines. Collect support bundles from sensor logs for tickets.
Frequently asked questions
Does uninstalling CrowdStrike delete detections?
No. The sensor streams detections to your CrowdStrike cloud tenant and caches policy locally. The computer holds sensor state plus logs for support. Uninstalls remove local state but never delete cloud detections or quarantine history. Export reports from the console for records.
Where is CrowdStrike detection history?
In the Falcon console cloud with full timeline per host. The sensor holds a working copy plus support logs. Detections rebuild in the console after reinstall. Collect the support bundle from the sensor folder for tickets, since the console never shows local cache alone.
Notice an outdated path? Let us know.