An organization is conducting a review to ensure all newly added endpoints have CrowdStrike sensors installed. Which report should the administrator use to identify hosts without sensors?

The Host Inventory Report provides a comprehensive list of all hosts that have the CrowdStrike Falcon sensor installed and have successfully checked into the Falcon cloud. To identify endpoints without the sensor, an administrator must perform a reconciliation process. This involves comparing the list of managed systems from the Host Inventory Report against a master list of all organizational assets (e.g., from Active Directory, a CMDB, or a network scanner). The hosts present in the master list but absent from the Falcon Host Inventory Report are the ones without the sensor installed.

A. Sensor Status Report: This report provides health and connectivity information (e.g., online, offline, outdated) for hosts that already have the sensor installed.
B. Policy Assignment Report: This report details which prevention or sensor update policies are applied to hosts that are already managed by the Falcon platform.
D. Real-Time Response Activity Report: This report logs commands and activities performed by administrators using the Real-Time Response (RTR) feature on managed endpoints.

1. CrowdStrike Falcon® Documentation: In the Falcon User Guide, the section on "Host Management" describes the functionality of the Host app, which is the source for the Host Inventory Report. It is established as the definitive list of managed assets within the platform. The process of identifying unmanaged assets relies on comparing this inventory with an external source of truth. (Reference: CrowdStrike Falcon® User Guide, "Investigate App" -> "Hosts" section).

2. University Courseware: Cybersecurity asset management principles taught in university courses emphasize the need for reconciliation between security tool inventories and a master asset database. A lecture on Endpoint Security would state that the security agent's management console provides the inventory of protected devices, which must be compared against a full asset list to find coverage gaps. (e.g., Material analogous to Stanford's CS 155 Computer and Network Security, Lecture on Endpoint Security).

3. Official Vendor Training Material (CCFA 200): The CrowdStrike Certified Falcon Administrator (CCFA) course material explicitly covers the use of the Host Inventory to understand the population of managed endpoints. Module 4, "Falcon Host Management," details how to view and export the list of all hosts with sensors for administrative tasks, including asset reconciliation to ensure complete deployment coverage.