MAC OS Steps

To install the macOS Agent

1. Get the Site or Group Token
2. Install the Agent using the command line or the Installation Wizard.
3. Authorize Full Disk Access and Network Extension (this must be done locally).
4. Authorize the Bluetooth Low Energy permissions.
5. Upgrading macOS Agents with a Local Upgrade.

1. Run the installation package and enter the Token string when prompted in the installation wizard.
2. Complete the installation.If the EDR icon shows “Needs user attention” or the message “Authorize EDR components in System Preferences“. Authorize Full Disk Access and Network Extension permissions for the EDR Agent in the System Preferences.

The macOS makes sure that applications are installed in a secure way. It limits installation only to applications that are approved by Apple and the user. This change does not let applications access specified paths (such as Documents, Downloads, and Desktop) without user consent.

For macOS Catalina and later releases

The macOS (10.15 Catalina and later releases) makes sure that applications are installed in a secure way. It limits installation only to applications that are approved by Apple and the user. This change does not let applications access specified paths (such as Documents, Downloads, and Desktop) without user consent.

If the EDR icon shows “Needs user attention” or these messages “Authorize Full-Disk-Access to EDR in System Preferences“, “Authorize EDR components in System Preferences“. Approve Full Disk Access for EDR Apps in the System Preferences.

Important: This is done only once on an endpoint. If already done on the endpoint, do not repeat it when the Agent is updated. If you do not complete this prerequisite step, the macOS Agent will not have full visibility to all files from all users.

Authorize Full Disk Access to these processes:

• sentineld
• sentineld_helper
• For Agents 21.5 and lower, Authorize Full Disk Access to sentinel_shell
• For Agents 21.7 and later, Authorize Full Disk Access to sentineld_shell

To Authorize Full Disk Access with MDM:

• To grant full disk access in Jamf, see Installing and Upgrading macOS Agents with Jamf.

To Authorize Full Disk Access on a local computer:

1. On the local computer, open System Preferences.
2. Click Security & Privacy, and select the Privacy tab.
3. Click the lock to make changes.
4. In the left pane, click Full Disk Access.
5. Click the + icon.
6. Press and hold Command+Shift+G at the same time to open the Go to the folder menu.
7. Enter the path:/Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/
8. Click Go.
9. Select the EDR applications, and click Open:
   • sentineld.app
   • sentineld_helper.app
   • For Agents 21.5 and lower, Authorize Full Disk Access to sentinel_shell.app
   • For Agents 21.7 and later, Authorize Full Disk Access to sentineld_shell.app
   Optional: Drag and drop the EDR applications into the Security & Privacy window.
   1. Open a Finder window.
   2. Navigate to /Library/Sentinel.
   3. Right-click the sentinel-agent.bundle, and select Show Package Contents.
   4. Navigate to the /Contents/MacOS/ folder.
   5. Select the required EDR applications, and drag the applications to the Security & Privacy window.
10. Close System Preferences.

If the EDR icon shows “Needs user attention” or these messages “Authorize EDR Network Extension in System Preferences“, “Authorize EDR components in System Preferences” you must approve the network Extension for EDR in the System Preferences.

Do this only one time on every macOS endpoint. If you already approved it, there is no need to repeat it when the EDR App is updated. If you do not complete this prerequisite step, your mac will not be fully protected.

If you use Mobile Device Management (MDM) solution to manage your Endpoints, see:

• Installing and Upgrading macOS Agents with Jamf
• Installing and Upgrading macOS Agents with MDM tools

To approve Network Extension:

1. If you see the System Extension Blocked message, click Open Security Preferences.Note: If you click OK, the window closes. To approve the EDR Network Extension later, open System Preferences > Security & privacy > Security.
2. At System software from application “EDR Extensions” was blocked from loading, click Allow.
3. In the window that opens, click Allow.

For macOS Ventura +

If the EDR icon shows “Needs user attention” or these messages “Authorize Full-Disk-Access to EDR in System Preferences“, “Authorize EDR components in System Preferences“. Approve Full Disk Access for EDR Apps in the System Settings.

Important: This is done only once on an endpoint. If already done on the endpoint, do not repeat it when the Agent is updated. If you do not complete this prerequisite step, the macOS Agent will not have full visibility to all files from all users.

Authorize Full Disk Access to these processes:

• sentineld
• sentineld_helper
• sentineld_shell

To Authorize Full Disk Access on a local computer:

1. On the local computer, open System Settings.
2. Click Privacy & Security, and select the Full Disk Access tab.
3. Click the + button.
4. Press and hold Command+Shift+G at the same time to open the Go to the folder menu.
5. Enter the path:/Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/
6. Double click your destination folder..
7. Select the EDR applications, and click Open:
   • sentineld.app
   • sentineld_helper.app
   • sentineld_shell.app
   Optional: Drag and drop the EDR applications to the Full Disk Access list.
   1. Open a Finder window.
   2. Navigate to /Library/Sentinel.
   3. Right-click the sentinel-agent.bundle file, and click Show Package Contents.
   4. Navigate to the /Contents/MacOS/ folder.
   5. Select the required EDR applications, and drag the applications to the Full Disk Access list.
8. Close System Settings.

If the EDR icon shows “Needs user attention” or these messages “Authorize EDR Network Extension in System Preferences“, “Authorize EDR components in System Preferences” you must approve the network Extension for EDR in the System Settings.

Do this only one time on every macOS endpoint. If you already approved it, there is no need to repeat it when the EDR App is updated. If you do not complete this prerequisite step, your mac will not be fully protected.

To approve Network Extension:

1. If you see the System Extension Blocked message, click Open System Settings.Note: If you click OK, the window closes. To approve the EDR Network Extension later, open System Settings > Privacy & Security > Security.
2. At System software from application “EDR Extensions” was blocked from loading, click Allow.
3. In the window that opens, click Allow.