DLP MacOS Endpoint Agent Quick Install Guide

Products

• Data Loss Prevention
• Data Loss Prevention API Detection
• Data Loss Prevention API Detection for Developer Apps Virtual Appliance
• Data Loss Prevention Cloud Detection Service
• Data Loss Prevention Cloud Detection Service for API Detection
• Data Loss Prevention Cloud Detection Service for Endpoint
• Data Loss Prevention Cloud Detection Service for ICAP
• Data Loss Prevention Cloud Detection Service for REST
• Data Loss Prevention Cloud Package
• Data Loss Prevention Cloud Prevent for Microsoft Office 365
• Data Loss Prevention Cloud Service for Discovery/Connector
• Data Loss Prevention Cloud Service for Email
• Data Loss Prevention Cloud Storage
• Data Loss Prevention Core API Detection
• Data Loss Prevention Core Package
• Data Loss Prevention Data Access Governance
• Data Loss Prevention Discover Suite
• Data Loss Prevention Endpoint Discover
• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention Enforce
• Data Loss Prevention Enterprise Suite
• Data Loss Prevention for Mobile
• Data Loss Prevention Form Recognition
• Data Loss Prevention Network Discover
• Data Loss Prevention Network Monitor
• Data Loss Prevention Network Monitor and Prevent for Email
• Data Loss Prevention Network Monitor and Prevent for Email and Web
• Data Loss Prevention Network Monitor and Prevent for Web
• Data Loss Prevention Network Prevent for Email
• Data Loss Prevention Network Prevent for Email Virtual Appliance
• Data Loss Prevention Network Prevent for Web Virtual Appliance
• Data Loss Prevention Network Protect
• Data Loss Prevention Oracle Standard Edition 2
• Data Loss Prevention Plus Suite
• Data Loss Prevention Sensitive Image Recognition
• Data Loss Protection Oracle Standard Edition

Issue/Introduction

This is a Quick Install guide for the Data Loss Prevention MacOS Endpoint Agent.

For the full "DLP Quick Install Guide" please visit the following link: DLP Quick Install Guides

Environment

MacOS

Cause

MacOS Endpoint Agents are one of the core components for Data Loss Prevention.

Resolution

VERSION DISCLAIMER: Please note that the following instructions are version agnostic, and can generally be used on any currently supported version. As such you will find several variables denoted such as "<DLPversion>" to indicate where a version number "should" be used. You will need to replace these variables with the appropriate version that you are attempting to use. Below are a few examples of such translations... <DLPversion>  = 16.0, 16.0.1, 16.0.2, 16.1, or 25.1 <DLPfullversion>  = 16.0.10000.60631 <ORACLEversion>  = 193000 or 19.3.0.0 <JREversion> = jdk8u322-b06, 8u322b06, jdk8u422-b05-jre, jdk-21.0.4_7-jre

 

Download Installers: https://support.broadcom.com/group/ecx/productdownloads?subfamily=Data%20Loss%20Prevention
Agent File: Symantec_DLP_<DLPversion>_<MP>_Agent_Mac-IN.zip

An important Prerequisite is for deploying the Mac Agent an MDM profile is required.

Complete macOS endpoint agent installation prerequisites listed in the documentation to ensure that agent monitoring features are enabled after you install the agent. The MDM administrator in your organization completes these steps.

Steps to Complete Installation Prerequisites

1. Enable full-disk access.
2. Configure the DLP Agent to start automatically on macOS 13 agents.
3. Enable browser extensions.
4. Enable print monitoring for Microsoft Office applications.
5. Enable MPIP keyword> classification notifications and access to Microsoft Office applications.

Once the prerequisites are met you can proceed with the agent installation, if you choose to manually install the agent refer to the steps below.

Configure the Agent package for distribution:
1 - Access the DLP Web Interface
          - open a browser and go to the localhost        
               https://<enforce>/ProtectManager/Logon    
          - The default user is "Administrator", use the password previously specified during the Enforce installation process        
               User: Administrator
               Pass: <your password>

2 - Open the Agent Packaging 

3  - Enter in the package information:

4 - Choose the installer package you wish to build out for distribution.
          Endpoint Server Host: IP Address of your Endpoint server
          Port: 10443 (default)
          Tools Password: <Your Password>
               - The Tools password is critical for managing the agents.

5 - Once all fields are populated, select "Generate Installed Packages" 

6 - Once the package is downloaded, copy the package to the Agent Machine Desktop

- Open Terminal

- Navigate to the users Desktop:

cd /Users/<username>/Desktop

- Run the following unzip command: "if required, depending on how you bring the package over the OS may automatically unzip it. In which case just copy it to the /tmp/MacInstaller location. do not run the installer from the desktop"

unzip AgentInstaller_Mac64.zip -d /tmp/MacInstaller

- Next run:

cd /tmp/MacInstaller/AgentInstaller_Mac64

- Next run:

sudo chmod +x install_agent.sh

-Next Run:

sudo ./install_agent.sh

- Check the Enforce Console to confirm the agent is reporting in
                    System > Agents > Overview

To troubleshoot any install issues see install log located at Log Location: The primary installation log is /var/log/install.log.

After the agent is installed, Endpoint users must enable the Symantec extension to allow the DLP Agent to monitor Safari.

For more information on this refer to: Enable monitoring on the Safari browser and Safari Browser changes with DLP 16.0 and above

For more information on installing the DLP MacOS Agent refer to the official documentation: Install the DLP Agent for macOS

Under the Install the DLP Agent for macOS link above search for "Installing the DLP Agent for macOS Using Deployment Software" for more information on this topic

For information on uninstalling the DLP MacOS Agent refer to the official documentation: Removing a DLP Agent from a Mac Endpoint