Deploying SentinelOne for Mac via Kandji

Published: at 10:07 PM

We all know that the internet is a wonderful place and for the most part, there is a guide for everything. BUT, sometimes we’ll find ourselves in a unique position with no clear direction or outdated material and honestly, it can be very frustrating. I found myself in this exact position when my org decided to adopt SentinelOne as our EDR solution and I was tasked with deploying it to all of our Macs. After some trial and error, I developed a method that streamlines the process. Hopefully this guide makes your admin life a bit easier.

Prerequisites

Before we dive in, make sure you have the following:

Overview

We’ll be using Kandji’s Custom App Library item to deploy SentinelOne. The process involves:

  1. Creating your scripts: An audit script, a pre-install script (optional), and a post-install script.

  2. Setting up the Custom App in Kandji: Configuring the installation details and uploading your packaged files.

  3. Ensuring profiles are installed: Verifying that the necessary profiles are in place before deployment.

Step 1: Create the Audit Script

The audit script checks if the required profiles are installed on the device. If they aren’t, the script exits, preventing the installation from proceeding. This ensures that SentinelOne doesn’t get installed without the necessary profiles, which could cause issues like loss of internet connectivity.

Here’s the audit script:

#!/bin/bash


# Array of required profiles
REQUIRED_PROFILES=(
    "S1 - Full Disk Access"
    "S1 - Network Filtering"
    "S1 - Network Monitoring"
    "S1 - Notifications"
    "S1 - Service Management"
)


# Function to check if a profile is installed
check_profile_installed() {
    local profile_name=$1
    profiles_list=$(profiles -C -v | awk -F: '/attribute: name/{print $NF}')


    if echo "$profiles_list" | grep -F -q "$profile_name"; then
        return 0
    else
        return 1
    fi
}


# Check each required profile
for profile in "${REQUIRED_PROFILES[@]}"; do
    if ! check_profile_installed "$profile"; then
        echo "Error: $profile is not installed."
        exit 0
    fi
done


echo "All required profiles are installed. Proceeding to check for SentinelOne..."


# Check if SentinelOne is installed
if [ -d "/Library/Sentinel/sentinel-agent.bundle/Contents/MacOS/SentinelAgent.app" ]; then
    echo "SentinelOne is installed."
    exit 0
else
    echo "SentinelOne is not installed. Starting install process."
    exit 1
fi

What This Script Does:

Step 2: Create the Pre-Install Script

The pre-install script can contain an optional portion to uninstall any existing EDR or antivirus software before installing SentinelOne. In my case, I used it to remove Avast Business Antivirus and prepare the installation directory. If you don’t need to remove any other AV, just remove everything prior to # Create the director…

Example pre-install script:

#!/bin/bash


# Function to uninstall a program
uninstall_program() {
    local program_name=$1
    local uninstall_script=$2


    if [ -f "$uninstall_script" ]; then
        echo "$program_name found. Attempting to uninstall..."


        if "$uninstall_script"; then
            echo "$program_name uninstalled successfully."
        else
            echo "Error: Failed to uninstall $program_name."
            exit 1
        fi
    else
        echo "$program_name not found. Skipping uninstallation."
    fi
}


# Uninstall Avast Business Agent
uninstall_program "Avast Business Agent" "/Applications/AvastBusinessAgent.app/Contents/Backend/hub/uninstall.sh"


# Uninstall Avast Antivirus
uninstall_program "Avast Antivirus" "/Applications/Avast.app/Contents/Backend/hub/uninstall.sh"


# Create the directory /tmp/sentinel_install/
echo "Creating directory /tmp/sentinel_install/..."
if mkdir -p /tmp/sentinel_install/; then
    echo "Directory /tmp/sentinel_install/ created successfully."
else
    echo "Error: Failed to create directory /tmp/sentinel_install/."
    exit 1
fi


echo "Script completed successfully."

What This Script Does:

Step 3: Create the Post-Install Script

The post-install script handles the actual installation of SentinelOne and cleans up afterwards.

#!/bin/bash


# Define the registration token
SITE_TOKEN="YOUR_SITE_TOKEN_HERE"


# Create the registration token file
echo "$SITE_TOKEN" > /tmp/sentinel_install/com.sentinelone.registration-token
if [ $? -ne 0 ]; then
    echo "Error: Failed to create registration token file."
    exit 1
fi


# Install the SentinelOne package
/usr/sbin/installer -pkg /tmp/sentinel_install/sentinel-installer.pkg -target /
if [ $? -ne 0 ]; then
    echo "Error: Failed to install the SentinelOne package."
    exit 1
fi


# Remove the temporary installation directory
rm -rf /tmp/sentinel_install
if [ $? -ne 0 ]; then
    echo "Error: Failed to remove temporary installation directory."
    exit 1
fi


echo "Script completed successfully."

What This Script Does:

Note: Replace YOUR_SITE_TOKEN_HERE with your actual Site Token, and ensure the file paths match your zip file’s structure.

Step 4: Prepare the ZIP File

Your ZIP file should contain:

Compress these two items together and name it accordingly.

Step 5: Set Up the Custom App in Kandji

Now, let’s configure the Custom App in Kandji.

  1. Create a New Library Item:
    • Go to your Kandji dashboard and add a new Custom App library item.
    • Select Audit and Enforce for the installation method.
  2. Configure the Audit Script using the Script from Step 1.
  3. Configure Installation Details:
    • Deployment Type: Uncheck Self Service to deploy silently.
    • Installation Type: Select ZIP File.
    • Unzip Location: Set to /tmp/sentinel_install/ or your chosen directory. (Remember, if you change the unzip location you need to update your file paths within the script).
    • Pre-Install Script: If you’re uninstalling other software, include the pre-install script from Step 2.
    • Upload ZIP File: Upload the ZIP file you prepared in Step 4.
  4. Post-Install Script:
    • Add the Post-Install Script from Step 3.
    • Double-check that the Site Token and file paths are correct.

Step 6: Ensure Profiles Are Installed

Before deploying the app to your devices, make sure the five required profiles are installed. These profiles handle necessary permissions for SentinelOne to function properly.

Required Profiles:

  1. S1 - Full Disk Access
  2. S1 - Network Filtering
  3. S1 - Network Monitoring
  4. S1 - Notifications
  5. S1 - Service Management

You can create these profiles in Kandji and assign them to your devices. The audit script will verify their presence before allowing the installation to proceed.

Step 7: Deployment

With everything set up:

Final Thoughts

I developed this method because I couldn’t find a reliable guide that covered all the nuances of deploying SentinelOne with Kandji. By sharing my scripts and process, I hope to save you time and headaches.

Feedback Welcome!

If you have suggestions to improve these scripts or the deployment process, I’d love to hear them. Collaboration makes us all better at what we do.

Stay Tuned…

I’m working on my next post which will provide you all with the specific Profiles for you to edit and deploy or you can try deploying this one from GitHub but I haven’t used it and not sure if it will properly work. Sentinel-One-Combined-Profile.mobileconfig

If you decide to use the combined profile, make sure you update the audit script to only look for a single Profile versus 5 separate Profiles.

Check out my post about the S1 Profiles here

Happy deploying!

If you found this guide helpful or have questions, don’t hesitate to reach out. Managing a Mac environment can be challenging, but with the right tools and shared knowledge, we can make it a smoother experience for everyone.

Make sure you Subscribe to my Substack to get the latest updates from me.

Previous Post
Deploying SentinelOne Profiles for Mac