systemextensionsctl list com.apple.system_extension.endpoint_security | awk -F"\t" '/com.crowdstrike.falcon.Agent/{gsub(/[\[\]]/,""); print $NF}'
/Applications/Falcon.app/Contents/Resources/falconctl stats | awk '/State:/{print $NF}'
launchctl print gui/"${console_uid}"/com.crowdstrike.falcon.UserAgent | awk '/^\tstate/{print $NF}'