14 DAY FREE TRIAL

No Search Results

No Search Results

14 DAY FREE TRIAL
  1. Help Center
  2. Managing Mac Devices
  3. Security

Category filter

Deploy SentinelOne on macOS devices using Hexnode UEM

Jump To

What is SentinelOne?

SentinelOne is a cloud-based autonomous cybersecurity and endpoint security solution that provides top-notch anti-virus protection for Windows and Mac devices. It uses AI-powered prevention, detection, response and threat hunting across endpoints, containers and IoT devices.

Hexnode UEM allows you to remotely install and deploy the SentinelOne agent app to provide anti-virus protection to your macOS devices. The following sections give a detailed explanation of how to deploy SentinelOne to your macOS devices using Hexnode UEM.

License token script

The deployment of the SentinelOne agent requires the execution of a script to license the software. You can run the following script using the Execute Custom Script action, Live Terminal, or directly from the terminal on the device.

Create the SentinelOne DMG file

Using the Disk Utility application, create a DMG file for deploying the PKG file and the license token as a single package. Follow the steps below to create the DMG file:

  1. Copy the SentinelOne PKG file and the license token into a single folder.
  2. Open the Disk Utility app and click on File > New Image > Image from Folder.
  3. Choose the folder that contains the PKG file and the licensing token script.
  4. Give an appropriate name for the app and click on Save.

Add the SentinelOne DMG file to the app inventory

To add the SentinelOne DMG file to the app inventory, follow the steps given below:

  1. Login to the Hexnode UEM console.
  2. Navigate to the Apps tab and click on +Add Apps > Enterprise App.
  3. Select macOS, enter the required app details and upload the DMG file.
  4. Click on Add.

The SentinelOne DMG file has now been added to the app repository.

Configure the SentinelOne policy

Deploying SentinelOne Agent to your macOS devices requires you to configure Privacy Preferences, System Extensions, Notification Settings and 3rd party plugin content filtering. Kernel Extensions must be configured only if your Mac runs macOS 10.14 and below. The following sections give you a detailed explanation of how to configure the required settings.

Add the SentinelOne DMG file as a mandatory app

  1. Login to the Hexnode UEM console.
  2. Navigate to Policies > New Policy > New Blank Policy.
  3. Select macOS > App Management > Required Apps.
  4. Click on +Add > Add App. Next, search and select the SentinelOne DMG file and click on Done.
  5. Once the app is added, click Configure next to the app under the Scripts column to add pre-install script, post-install script or audit script to customize app deployment based on the requirements.

Allow Full Disk Access using Privacy Preferences

You can either use the same policy or configure a new policy to allow full disk access for the required components of SentinelOne.

  1. Under the macOS tab, navigate to Security > Privacy Preferences.
  2. Click on +Add new preference.
  3. Click on the dropdown beside All Files and select Allow.
  4. Select Specify Bundle IDs/Path.

Full Disk Access needs to be given for the following components of SentinelOne:

Sl No Identifier Type Identifier Code Requirement
1. Bundle ID com.sentinelone.sentineld anchor apple generic and identifier "com.sentinelone.sentineld" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "4AYE5J54KN")
2. Bundle ID com.sentinelone.sentineld-helper anchor apple generic and identifier "com.sentinelone.sentineld-helper" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "4AYE5J54KN")
3. Bundle ID com.sentinelone.sentineld-shell anchor apple generic and identifier "com.sentinelone.sentineld-shell" and (certificate leaf[field.1.2.840.113635.100.6.1.9] or certificate 1[field.1.2.840.113635.100.6.2.6] and certificate leaf[field.1.2.840.113635.100.6.1.13] and certificate leaf[subject.OU] = "4AYE5J54KN")
4. Bundle ID com.sentinelone.sentinel-shell anchor apple generic and identifier "com.sentinelone.sentinel-shell" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "4AYE5J54KN")

Configure System Extensions (For Macs running macOS 10.15 and above)

To configure a System Extensions policy,

  1. Navigate to macOS > Configurations > System Extensions.
  2. Click Configure.
  3. Enable User Override.
  4. Enter the Team ID “4AYE5J54KN” and click on Add.

Configure Kernel Extensions (For Macs running macOS 10.14 and below)

You can use policies to configure Kernel Extensions from the Hexnode console.

  1. Navigate to macOS > Configurations > Kernel Extensions.
  2. Click Configure.
  3. Enable User Override.
  4. Enter the Team ID “4AYE5J54KN” and click on Add.

Deploy Custom Configuration

  1. Under the macOS tab, navigate to Configurations > Deploy Custom Configuration.
  2. Click Configure.
  3. Click on Choose File and upload the mobileconfig file. You can either use the configuration profile displayed below or create your own custom configuration profile.
  4. Click on OK.

Associate target device

  1. Navigate to Policy Targets and select the Devices, Device Groups, Users, User Groups, or Domains you would like to associate the policy with.
  2. Click on Save.

What happens at the device end?

The SentinelOne agent will get successfully installed on your endpoints and you will be able to manage and protect them using Hexnode UEM's endpoint security console.

Notes:

  • SentinelOne provides support for Ventura on both Intel Macs and Apple silicon Macs through agent releases 22.2.3 and later.
  • Before running a Ventura update, administrators should ensure that the SentinelOne agent is updated to the latest version.

Need more help?
Raise a Ticket Raise a Ticket
Ask Community Ask Community
Chat With us Chat With us
  • Managing Mac Devices