Enhanced Network Visibility: A Dive into the Falcon macOS Sensor's New Capabilities

Enhanced Network Visibility for macOS (Falcon sensor 7.29+) is an opt-in feature that enriches process monitoring with application-layer network insights: it parses plaintext HTTP requests/responses, inspects TLS client hello (with JA4 fingerprinting), and identifies protocols (HTTP, TLS, SOCKS4/5, Wireguard, SSH, SMB, VNC/ARD, QUIC, DNS) while minimizing performance impact via Apple content filter APIs; the feature emits AppProtocolDetected events and new SIEM events to support detection and threat hunting.