Topic
This article provides a sample configuration for deploying common security software and streamlining the end-user experience for SentinelOne.
Note that these configurations are provided as examples, and we recommend that you first consult the security tool's software documentation to ensure it is configured correctly.
Environment
- NinjaOne Mobile Device Management (MDM)
- Apple macOS
- NinjaOne Integrations
- SentinelOne
Description
Security tools and apps generally require you to apply various configurations during installation in order to function properly within a configured environment. When devices are managed by NinjaOne MDM, you can use NinjaOne to deploy these standard configurations.
SentinelOne Agent for macOS
This section outlines how to streamline the deployment and configuration of the SentinelOne agent for macOS. Deploy the following mobile configuration as a custom payload in your NinjaOne macOS policy to any devices that have the SentinelOne agent installed. For more information on MDM-enrolled macOS custom payloads, refer to NinjaOne Apple MDM Policy Settings: Custom Payloads.
This payload will configure the following:
- SentinelOne agent notifications are always visible.
- Permissions to access All Files and Bluetooth are automatically granted.
- The system extension is automatically approved.
- The web content filter is automatically configured.
- Background processing is automatically approved and cannot be disabled.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>PayloadContent</key>
<array>
<dict>
<key>NotificationSettings</key>
<array>
<dict>
<key>BundleIdentifier</key>
<string>com.sentinelOne.SentinelAgent</string>
<key>BadgesEnabled</key>
<true />
<key>AlertType</key>
<integer>2</integer>
<key>CriticalAlertEnabled</key>
<true />
<key>NotificationsEnabled</key>
<true />
<key>ShowInCarPlay</key>
<false />
<key>ShowInLockScreen</key>
<true />
<key>ShowInNotificationCenter</key>
<true />
<key>SoundsEnabled</key>
<true />
</dict>
</array>
<key>PayloadType</key>
<string>com.apple.notificationsettings</string>
<key>PayloadOrganization</key>
<string>Sentinel Labs, Inc.</string>
<key>PayloadIdentifier</key>
<string>com.apple.notificationsettings.FBAE4EE4-76AA-4839-959A-26A115241574</string>
<key>PayloadUUID</key>
<string>FBAE4EE4-76AA-4839-959A-26A115241574</string>
<key>PayloadDisplayName</key>
<string>SentinelOne Notifications</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
<dict>
<key>Services</key>
<dict>
<key>SystemPolicyAllFiles</key>
<array>
<dict>
<key>Allowed</key>
<integer>1</integer>
<key>CodeRequirement</key>
<string>anchor apple generic and identifier "com.sentinelone.sentineld" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "4AYE5J54KN")</string>
<key>Identifier</key>
<string>com.sentinelone.sentineld</string>
<key>IdentifierType</key>
<string>bundleID</string>
<key>StaticCode</key>
<integer>0</integer>
</dict>
<dict>
<key>Allowed</key>
<integer>1</integer>
<key>CodeRequirement</key>
<string>anchor apple generic and identifier "com.sentinelone.sentineld-helper" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "4AYE5J54KN")</string>
<key>Identifier</key>
<string>com.sentinelone.sentineld-helper</string>
<key>IdentifierType</key>
<string>bundleID</string>
<key>StaticCode</key>
<integer>0</integer>
</dict >
<dict>
<key>Allowed</key>
<integer>1</integer>
<key>CodeRequirement</key>
<string>anchor apple generic and identifier "com.sentinelone.sentineld-shell" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "4AYE5J54KN")</string>
<key>Identifier</key>
<string>com.sentinelone.sentineld-shell</string>
<key>IdentifierType</key>
<string>bundleID</string>
<key>StaticCode</key>
<integer>0</integer>
</dict>
</array>
<key>BluetoothAlways</key>
<array>
<dict>
<key>Allowed</key>
<integer>1</integer>
<key>CodeRequirement</key>
<string>anchor apple generic and identifier "com.sentinelone.sentinel-helper" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "4AYE5J54KN")</string>
<key>Identifier</key>
<string>com.sentinelone.sentinel-helper</string>
<key>IdentifierType</key>
<string>bundleID</string>
<key>StaticCode</key>
<integer>0</integer>
</dict>
</array>
</dict>
<key>PayloadType</key>
<string>com.apple.TCC.configuration-profile-policy</string>
<key>PayloadOrganization</key>
<string>Sentinel Labs, Inc.</string>
<key>PayloadIdentifier</key>
<string>com.apple.TCC.configuration-profile-policy.820943C1-D570-4466-B18D-BD00FF002A36</string>
<key>PayloadUUID</key>
<string>820943C1-D570-4466-B18D-BD00FF002A36</string>
<key>PayloadDisplayName</key>
<string>Privacy Preferences Policy Control</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
<dict>
<key>FilterDataProviderBundleIdentifier</key>
<string>com.sentinelone.network-monitoring</string>
<key>FilterDataProviderDesignatedRequirement</key>
<string>identifier "com.sentinelone.network-monitoring" and anchor apple generic and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "4AYE5J54KN")</string>
<key>FilterGrade</key>
<string>firewall</string>
<key>FilterPackets</key>
<false/>
<key>FilterSockets</key>
<true/>
<key>FilterType</key>
<string>Plugin</string>
<key>PluginBundleID</key>
<string>com.sentinelone.extensions-wrapper</string>
<key>UserDefinedName</key>
<string>SentinelOne Extensions</string>
<key>PayloadType</key>
<string>com.apple.webcontent-filter</string>
<key>PayloadOrganization</key>
<string>Sentinel Labs, Inc.</string>
<key>PayloadIdentifier</key>
<string>com.apple.webcontent-filter.5C9D8A65-3FDC-4488-ACA9-7D61151C8FD4</string>
<key>PayloadUUID</key>
<string>5C9D8A65-3FDC-4488-ACA9-7D61151C8FD4</string>
<key>PayloadDisplayName</key>
<string>Web Content Filter Payload</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
<dict>
<key>AllowUserOverrides</key>
<false/>
<key>AllowedTeamIdentifiers</key>
<array>
<string>4AYE5J54KN</string>
</array>
<key>RemovableSystemExtensions</key>
<dict>
<key>4AYE5J54KN</key>
<array>
<string>com.sentinelone.network-monitoring</string>
</array>
</dict>
<key>NonRemovableFromUISystemExtensions</key>
<dict>
<key>4AYE5J54KN</key>
<array>
<string>com.sentinelone.network-monitoring</string>
</array>
</dict>
<key>PayloadType</key>
<string>com.apple.system-extension-policy</string>
<key>PayloadOrganization</key>
<string>Sentinel Labs, Inc.</string>
<key>PayloadIdentifier</key>
<string>com.apple.system-extension-policy.CC5F64AF-7C8C-4977-912F-8060B56CE223</string>
<key>PayloadUUID</key>
<string>CC5F64AF-7C8C-4977-912F-8060B56CE223</string>
<key>PayloadDisplayName</key>
<string>System Extensions</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
<dict>
<key>Rules</key>
<array>
<dict>
<key>RuleType</key>
<string>LabelPrefix</string>
<key>RuleValue</key>
<string>com.sentinelone.</string>
<key>Comment</key>
<string>Prevent removal of SentinelOne Launch Agents and Launch Daemons</string>
</dict>
<dict>
<key>RuleType</key>
<string>BundleIdentifierPrefix</string>
<key>RuleValue</key>
<string>com.sentinelone.</string>
<key>Comment</key>
<string>Prevent removal of SentinelOne Launch Agents and Launch Daemons</string>
</dict>
</array>
<key>PayloadType</key>
<string>com.apple.servicemanagement</string>
<key>PayloadOrganization</key>
<string>Sentinel Labs, Inc.</string>
<key>PayloadIdentifier</key>
<string>com.apple.servicemanagement.C4050BE2-2915-4548-89B5-F2E16EBCE2DD</string>
<key>PayloadUUID</key>
<string>C4050BE2-2915-4548-89B5-F2E16EBCE2DD</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</array>
<key>PayloadDescription</key>
<string>Provides access to all disk to Sentinel One processes</string>
<key>PayloadDisplayName</key>
<string>SentinelOne - Privacy Control</string>
<key>PayloadIdentifier</key>
<string>SentinelOne.014D9FCD-A9F9-4F66-927D-7214A8B1A0BC</string>
<key>PayloadOrganization</key>
<string>Sentinel Labs, Inc.</string>
<key>PayloadScope</key>
<string>System</string>
<key>PayloadType</key>
<string>Configuration</string>
<key>PayloadUUID</key>
<string>014D9FCD-A9F9-4F66-927D-7214A8B1A0BC</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</plist>
Additional Resources
Refer to the following resources to learn more about NinjaOne MDM: