Crowdstrike exists for Linux too. In fact, it apparently crashed RHEL and Debian a few months back. That didn’t get so much attention.
Falcon seems to be a cross between an antivirus and an intrusion detection system (IDS). There are many antiviruses on Linux, but only one FOSS AV is popular - ClamAV. As for IDS, snort is an example.
But in the true sense, Falcon is much more than just an AV and IDS. It’s a way to detect breaches and report it back to CrowdStrike’s threat detection and analysis teams. I don’t think there exists a proper alternative even in the commercial sector.
Is it legal? There may be alternatives with plausible deniability.