Thanks for this reference. I was told I'm having this rolled out onto the infra I'm using. I have added this to the growing list of reasons to quit.

Really? That's interesting. We deployed this a few months ago this where I work and haven't encountered any performance issues like this. But we have had the fun of encountering BSODs when some of our end users try to use Excel.

right now, just browsing web using hn, com.crowdstrike.falcon.Agent is using 10% cpu -- this is on an intel macbook pro 16".

when i try to use docker, tmux within a terminal, it gets even worse -- i've seen it using 60% cpu + io.

What sensor version are you running? 6.33 iirc has an issue and you'll need to upgrade to 6.34. . If you have access to the support page inside the Falcon platform, run the script they have for collecting system info and submit a case to support. (not affiliated with CS, I came across a similar high CPU usage and middlemanned the comms between our Mac admin and CS).

That might be the difference, my work is a 100% Windows shop, so that's why we haven't seen it. That really sucks though.

My heart goes out to AV/EDR developper because i really don't see how it is possible to analyze most of the code being run somewhere in realtime, without a significant toll on the machine...

Carbon Black is not much better - on top of McAfee, it rendered my work laptop at the time almost unusable. It used a crazy amount of RAM too.

have had the exact same negative experience with this as well. imagine a hellscape with crowdstrike falcon, defender, and beyond trust all running on the same machines.