topic Re: macOS Big Sur - how to automate full install, eliminate manual approval of system extension files in Cortex XDR Discussions

macOS Big Sur - how to automate full install, eliminate manual approval of system extension files

Houston29115 — Wed, 18 May 2022 22:35:37 GMT

we are still manually installing Coretex to our Macs on Big Sur, this involves some time and the hope that our human computer builder / imager doesn't forget to manually approve PMD and Traps extensions.

Is there a method where we can use a script install and automatically approve the installation of Coretex XDR version 7.3.0 build 2207?

if it matters, our MDM is Workspace One...

Re: macOS Big Sur - how to automate full install, eliminate manual approval of system extension files

jtalton — Fri, 10 Jun 2022 19:59:34 GMT

Hi Houston29115,

Please refer to the Install with a Unified Configuration Profile for MDMs (paloaltonetworks.com) TechDoc.

A ready install script is not available, however scripting can be done using bash/zsh/ksh or python scripting. For example, here is a bash shell script for a silent installation:

installer -pkg "CortexXDR.pkg" -target /

*CortexXDR.pkg = Insert XDR installation package name

For MacOS, the Cortex XDR agent needs full disk access to:

Trapsd - daemon which handles the communication between the agent and the ESM.
Authorized - daemon which handles the malware protection flow.
Pmd - daemon which is responsible for policy and core security functionality.

Thanks

Re: macOS Big Sur - how to automate full install, eliminate manual approval of system extension files

Houston29115 — Fri, 10 Jun 2022 20:17:50 GMT

yeah, know about this... this method wont get around asking our Tech Team or the end user to manually bless the install.

If you happen to find a method please update here - thank you for your time.

Re: macOS Big Sur - how to automate full install, eliminate manual approval of system extension files

Houston29115 — Fri, 24 Jun 2022 23:51:31 GMT

the problem with this advice is - if the user doesnt interact with the Full Disk Access prompt - (and most corp users rant admins, nor would they likely even know HOW to do FDA) - the computer will be left vulverable. This means Cortex will not be able to protect the entirety of files in storage.

What's actually required is a self heal solution from Palo Alto Networks, so that if:

a. the app, or either system extension become corrupt

b. the user somehow manages to corrupt or uninstall part of the original install

Cortex will detect this circumstance from a client computer and reinstall itself as soon as the user puts their computer on net again.

Currently, is there any known way to set this up?