i don't have that app but i have done something similar to this for detecting a different edr solution on both platforms

in case anyone else was interested, this was handled in DM. ---------- is it enough to say that it is running based on whether or not a process is simply running? for example, this is how i checked if crowdstrike was running on a macos box, and then in another system we have internally that consumes query results, i was able to make a decision whether or not the query returns RUNNING or not

SELECT count(*) AS count, 
path, 
CASE WHEN path LIKE '/Library/SystemExtensions/%/com.crowdstrike.falcon.Agent.systemextension/Contents/MacOS/com.crowdstrike.falcon.Agent' 
THEN 'RUNNING' 
ELSE 'ERROR' 
END 
status, 
'macOSCrowdStrikeCheckProcess' AS query_type 
FROM processes 
WHERE path LIKE '/Library/SystemExtensions/%/com.crowdstrike.falcon.Agent.systemextension/Contents/MacOS/com.crowdstrike.falcon.Agent';

for windows it was similar:

SELECT services.*,
'WindowsCrowdStrikeCheckProcess' AS query_type 
FROM services 
WHERE name LIKE 'CSFalconService';

you could do the CASE and add a string as well.

I may have some other stuff, i'll DM you if it fits the use case.