# Deploy SentinelOne on macOS devices using Hexnode UEM
What is SentinelOne?
--------------------
SentinelOne is a cloud-based autonomous cybersecurity and endpoint security solution that provides top-notch anti-virus protection for Windows and Mac devices. It uses AI-powered prevention, detection, response and threat hunting across endpoints, containers and IoT devices.
Hexnode UEM allows you to remotely install and deploy the SentinelOne agent app to provide anti-virus protection to your macOS devices. The following sections give a detailed explanation of how to deploy SentinelOne to your macOS devices using Hexnode UEM.
License token script
--------------------
The deployment of the SentinelOne agent requires the execution of a script to license the software. You can run the following script using the [Execute Custom Script](https://www.hexnode.com/mobile-device-management/help/how-to-run-scripts-on-mac-using-hexnode-mdm/) action, [Live Terminal](https://www.hexnode.com/mobile-device-management/help/how-to-enable-live-terminal-on-your-macos-devices/), or directly from the terminal on the device.
License token script
\#!/bin/sh ## Ensure you update the TokenHere below with the Token provided by SentinelOne. echo 'TOKEN\_HERE' > /var/tmp/"com.sentinelone.registration-token"
1
2
3
\#!/bin/sh
\## Ensure you update the TokenHere below with the Token provided by SentinelOne.
echo 'TOKEN\_HERE' > /var/tmp/"com.sentinelone.registration-token"
Create the SentinelOne DMG file
-------------------------------
Using the Disk Utility application, create a DMG file for deploying the PKG file and the license token as a single package. Follow the steps below to create the DMG file:
1. Copy the SentinelOne PKG file and the license token into a single folder.
2. Open the Disk Utility app and click on **File > New Image > Image from Folder**.
3. Choose the folder that contains the PKG file and the licensing token script.
4. Give an appropriate name for the app and click on **Save**.
Add the SentinelOne DMG file to the app inventory
--------------------------------------------------
To add the SentinelOne DMG file to the app inventory, follow the steps given below:
1. Login to the Hexnode UEM console.
2. Navigate to the **Apps** tab and click on **+Add Apps > Enterprise App**.
3. Select **macOS**, enter the required app details and upload the DMG file.
4. Click on **Add**.
The SentinelOne DMG file has now been added to the app repository.
Configure the SentinelOne policy
--------------------------------
Deploying SentinelOne Agent to your macOS devices requires you to configure **Privacy Preferences**, **System Extensions**, **Notification Settings** and **3rd party plugin content filtering**. Kernel Extensions must be configured only if your Mac runs macOS 10.14 and below. The following sections give you a detailed explanation of how to configure the required settings.
### Add the SentinelOne DMG file as a mandatory app
1. Login to the Hexnode UEM console.
2. Navigate to **Policies > New Policy > New Blank Policy**.
3. Select **macOS > App Management > Required Apps**.
4. Click on **+Add > Add App**. Next, search and select the SentinelOne DMG file and click on **Done**.
5. Once the app is added, click **Configure** next to the app under the Scripts column to add *pre-install script, post-install script* or *audit script* to [customize app deployment](https://www.hexnode.com/mobile-device-management/help/deploy-scripts-to-automate-app-deployment-on-macos-devices/) based on the requirements.
### Allow Full Disk Access using Privacy Preferences
You can either use the same policy or configure a new policy to allow full disk access for the required components of SentinelOne.
1. Under the **macOS** tab, navigate to **Security > Privacy Preferences**.
2. Click on **+Add new preference**.
3. Click on the dropdown beside **All Files** and select **Allow**.
4. Select **Specify Bundle IDs/Path**.
Full Disk Access needs to be given for the following components of SentinelOne:
Sl No Identifier Type Identifier Code Requirement 1.Bundle IDcom.sentinelone.sentineld `anchor apple generic and identifier "com.sentinelone.sentineld" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "4AYE5J54KN")` 2.Bundle IDcom.sentinelone.sentineld-helper ```
anchor apple generic and identifier "com.sentinelone.sentineld-helper" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "4AYE5J54KN")` `
```3.Bundle IDcom.sentinelone.sentineld-shell `anchor apple generic and identifier "com.sentinelone.sentineld-shell" and (certificate leaf[field.1.2.840.113635.100.6.1.9] or certificate 1[field.1.2.840.113635.100.6.2.6] and certificate leaf[field.1.2.840.113635.100.6.1.13] and certificate leaf[subject.OU] = "4AYE5J54KN")` 4.Bundle IDcom.sentinelone.sentinel-shell `anchor apple generic and identifier "com.sentinelone.sentinel-shell" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "4AYE5J54KN")` ### Configure System Extensions (For Macs running macOS 10.15 and above)
To configure a System Extensions policy,
1. Navigate to **macOS > Configurations > System Extensions**.
2. Click **Configure**.
3. Enable **User Override**.
4. Enter the Team ID “**4AYE5J54KN**” under **Team Identifiers** and click on **Add**.
5. Under **System Extension Types,** input the same Team ID **(4AYE5J54KN)**, and check the box for **Network Extension.**
### Configure Kernel Extensions (For Macs running macOS 10.14 and below)
You can use policies to configure Kernel Extensions from the Hexnode console.
1. Navigate to **macOS > Configurations > Kernel Extensions**.
2. Click **Configure**.
3. Enable **User Override**.
4. Enter the Team ID “**4AYE5J54KN**” and click on **Add**.
### Deploy Custom Configuration
1. Under the **macOS** tab, navigate to **Configurations > Deploy Custom Configuration**.
2. Click **Configure**.
3. Click on **Choose File** and upload the mobileconfig file. You can either use the configuration profile displayed below or create your own custom configuration profile.
Custom Configuration profile for SentinelOne deployment
PayloadContent NotificationSettings BundleIdentifier com.sentinelone.SentinelAgent CriticalAlertEnabled PayloadDescription Configures notifications settings for apps PayloadDisplayName Notifications PayloadIdentifier com.apple.notificationsettings.26E82306-CDA4-4AF0-9714-0B8363D2A26F PayloadType com.apple.notificationsettings PayloadUUID 26E82306-CDA4-4AF0-9714-0B8363D2A26F PayloadVersion 1 PayloadDescription Configures Conference Room Display mode PayloadDisplayName Conference Room Display PayloadIdentifier com.apple.conferenceroomdisplay.B64EF9CA-0B32-43F9-82D7-5ABB51D1422B PayloadType com.apple.conferenceroomdisplay PayloadUUID B64EF9CA-0B32-43F9-82D7-5ABB51D1422B PayloadVersion 1 FilterBrowsers FilterSockets FilterType Plugin Organization Hexnode Inc PayloadDescription Configures content filtering settings PayloadDisplayName SentinelOne PayloadIdentifier com.apple.webcontent-filter.B456B4A3-5794-4C8E-99FA-9148C6458AEE PayloadType com.apple.webcontent-filter PayloadUUID B456B4A3-5794-4C8E-99FA-9148C6458AEE PayloadVersion 1 PluginBundleID com.sentinelone.extensions-wrapper UserDefinedName SentinelOne PayloadDisplayName SentinelOne Config PayloadIdentifier com.hexnode.sentinelone PayloadOrganization Hexnode PayloadRemovalDisallowed PayloadType Configuration PayloadUUID 9B3EA38F-D1C7-4045-A745-AE3AA25ACCEE PayloadVersion 1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
PayloadContent
NotificationSettings
BundleIdentifier
com.sentinelone.SentinelAgent
CriticalAlertEnabled
PayloadDescription
Configures notifications settings for apps
PayloadDisplayName
Notifications
PayloadIdentifier
com.apple.notificationsettings.26E82306-CDA4-4AF0-9714-0B8363D2A26F
PayloadType
com.apple.notificationsettings
PayloadUUID
26E82306-CDA4-4AF0-9714-0B8363D2A26F
PayloadVersion
1
PayloadDescription
Configures Conference Room Display mode
PayloadDisplayName
Conference Room Display
PayloadIdentifier
com.apple.conferenceroomdisplay.B64EF9CA-0B32-43F9-82D7-5ABB51D1422B
PayloadType
com.apple.conferenceroomdisplay
PayloadUUID
B64EF9CA-0B32-43F9-82D7-5ABB51D1422B
PayloadVersion
1
FilterBrowsers
FilterSockets
FilterType
Plugin
Organization
Hexnode Inc
PayloadDescription
Configures content filtering settings
PayloadDisplayName
SentinelOne
PayloadIdentifier
com.apple.webcontent-filter.B456B4A3-5794-4C8E-99FA-9148C6458AEE
PayloadType
com.apple.webcontent-filter
PayloadUUID
B456B4A3-5794-4C8E-99FA-9148C6458AEE
PayloadVersion
1
PluginBundleID
com.sentinelone.extensions-wrapper
UserDefinedName
SentinelOne
PayloadDisplayName
SentinelOne Config
PayloadIdentifier
com.hexnode.sentinelone
PayloadOrganization
Hexnode
PayloadRemovalDisallowed
PayloadType
Configuration
PayloadUUID
9B3EA38F-D1C7-4045-A745-AE3AA25ACCEE
PayloadVersion
1
5. Click on **OK**.
### Associate target device
1. Navigate to Policy Targets and select the Devices, Device Groups, Users, User Groups, or Domains you would like to associate the policy with.
2. Click on **Save**.
What happens at the device end?
-------------------------------
The SentinelOne agent will get successfully installed on your endpoints and you will be able to manage and protect them using Hexnode UEM's endpoint security console.
Notes:- SentinelOne provides support for Ventura on both Intel Macs and Apple silicon Macs through agent releases 22.2.3 and later.
- Before running a Ventura update, administrators should ensure that the SentinelOne agent is updated to the latest version.