The CrowdStrike Falcon console provides a dedicated application for endpoint management, typically labeled "Host Management" or "Hosts." Within this interface, administrators can filter the list of all managed hosts by numerous attributes. The "Sensor Health" status is a key filterable attribute that directly reflects the operational state of the Falcon sensor. Reduced Functionality Mode (RFM) is a specific health state indicating a critical issue, such as a kernel incompatibility. Therefore, filtering by this specific sensor health status is the correct and most efficient method to identify all hosts currently in RFM.

A. "Disconnected" is a connectivity status indicating the host has not communicated with the cloud, which is a separate issue from the actively reported RFM health state.
C. An outdated sensor version can be a cause of RFM but is not a direct indicator; a host can have an old sensor and still be fully functional.
D. Filtering by Operating System is used for asset grouping and management; it provides no information about the sensor's operational health or status.

1. CrowdStrike Falcon® Platform Documentation. In the Host Management application, the filtering pane allows users to sort and find hosts based on their current state. The "STATUS" filter group contains an option for "Sensor health," which includes the specific state "Reduced functionality." This is the designated method for identifying these hosts. (Reference: CrowdStrike Falcon Console UI, Host Management Application, Filter Pane > STATUS > Sensor health > Reduced functionality).

2. SANS Institute Courseware (FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics). This course often covers leading EDR platforms like CrowdStrike Falcon. It details how to use the management console for threat hunting and assessing endpoint health. The course material explains that querying for specific sensor health states, such as RFM, is a critical first step in troubleshooting endpoint agent issues and identifying blind spots in visibility. (Reference: SANS FOR508 Course Material, Module on Endpoint Detection and Response, Section on EDR Health Checking).