macOS Big Sur - how to automate full install, eliminate manual approval of system extension files

[Houston29115]

we are still manually installing Coretex to our Macs on Big Sur, this involves some time and the hope that our human computer builder / imager doesn't forget to manually approve PMD and Traps extensions. 

Is there a method where we can use a script install and automatically approve the installation of Coretex XDR version 7.3.0 build 2207? 

if it matters, our MDM is Workspace One... 

[jtalton]

Hi Houston29115,

Please refer to the Install with a Unified Configuration Profile for MDMs (paloaltonetworks.com) TechDoc.

A ready install script is not available, however scripting can be done using bash/zsh/ksh or python scripting. For example, here is a bash shell script for a silent installation:

installer -pkg "CortexXDR.pkg" -target /

*CortexXDR.pkg = Insert XDR installation package name

For MacOS, the Cortex XDR agent needs full disk access to:

• Trapsd - daemon which handles the communication between the agent and the ESM.
• Authorized - daemon which handles the malware protection flow.
• Pmd - daemon which is responsible for policy and core security functionality.

Thanks

[Houston29115]

yeah, know about this... this method wont get around asking our Tech Team or the end user to manually bless the install. 

If you happen to find a method please update here - thank you for your time.

[Houston29115]

the problem with this advice is - if the user doesnt interact with the Full Disk Access prompt - (and most corp users rant admins, nor would they likely even know HOW to do FDA) - the computer will be left vulverable. This means Cortex will not be able to protect the entirety of files in storage.

What's actually required is a self heal solution from Palo Alto Networks, so that if:

a. the app, or either system extension become corrupt

b. the user somehow manages to corrupt or uninstall part of the original install

Cortex will detect this circumstance from a client computer and reinstall itself as soon as the user puts their computer on net again. 

Currently, is there any known way to set this up?