What mode does the Falcon sensor operate in if installed on an unsupported kernel version?

The Falcon sensor, when installed on a kernel version that is not supported, operates in Reduced Functionality Mode (RFM). This mode is specifically designed to maintain some level of security monitoring and threat detection capabilities while acknowledging the limitations imposed by the unsupported kernel. In RFM, the sensor has reduced capabilities compared to its full operation in supported environments, meaning that certain advanced features may be disabled or function at a diminished level. This approach allows organizations to retain some protection and visibility while they work toward upgrading to a supported version, thus reducing the risk of exposure during the transition period.

In contrast, other modes mentioned, such as Maintenance mode or Compatibility mode, do not pertain specifically to the situation of an unsupported kernel. Maintenance mode is typically associated with temporary activity reductions for updates or maintenance, while Compatibility mode would imply functioning within the parameters of a known compatible environment, which does not apply in this scenario.