The CrowdStrike Falcon Console provides a dedicated filtering mechanism to identify the operational health of its sensors. Within the Host Management section (Hosts app), the "Sensor Health" filter is the most direct and efficient tool for this purpose. This filter allows administrators to specifically query for hosts whose sensors are in "Reduced Functionality Mode" (RFM). This state indicates the sensor is running but with limited capabilities, often due to issues like kernel incompatibility after an OS update, and requires administrative attention.

A. "Offline" status means the sensor is not communicating with the Falcon cloud. This is a connectivity issue, distinct from RFM where the sensor is active but degraded.

B. An outdated agent version does not automatically place a host in RFM. While outdated agents may have a higher risk of issues, this filter does not identify the current operational state.

D. Manually reviewing logs on each host is extremely inefficient, not scalable, and contradicts the purpose of a centralized management console for identifying system-wide issues.

1. CrowdStrike Falcon Documentation

Host and Host Group Management Guide: "The Sensor Health filter on the Host Management page allows you to find hosts based on the health of the sensor installed on them. Filter options include... Reduced functionality: The sensor is running with limited prevention and detection capabilities." (Reference: CrowdStrike Falcon Console > Support and Resources > Documentation > Falcon Platform > Host and Host Group Management).

2. CrowdStrike Falcon Documentation

Sensor Health Notifications: "Reduced functionality: The sensor is running

but a problem is preventing it from providing full protection... You can find hosts with a sensor health of 'Reduced functionality' by using the Sensor Health filter on the Host Management page." (Reference: CrowdStrike Falcon Console > Support and Resources > Documentation > Falcon Platform > Notifications).