Skip to content

Commit 923e3a7

Browse files
natasha-moore-elasticmergify[bot]
natasha-moore-elastic
authored and
mergify[bot]
committed
Fixes style issue on Deploy with MDM page (#6163)
(cherry picked from commit d0eab8a) # Conflicts: # docs/serverless/edr-install-config/deploy-with-mdm.asciidoc
1 parent 093f8eb commit 923e3a7

File tree

2 files changed

+149
-7
lines changed

2 files changed

+149
-7
lines changed

‎docs/management/admin/deploy-with-mdm.asciidoc‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -71,13 +71,13 @@ image::images/content-filtering-jamf.png[]
7171
. Under **App Name**, enter `Elastic Security.app`.
7272
. Under **Bundle ID**, enter `co.elastic.alert`.
7373
. In the **Settings** section, include these options with the following settings:
74-
.. **Critical Alerts**: **Enable**.
75-
.. **Notifications**: **Enable**.
76-
.. **Banner alert type**: **Persistent**.
77-
.. **Notifications on Lock Screen**: **Display**.
78-
.. **Notifications in Notification Center**: **Display**.
79-
.. **Badge app icon**: **Display**.
80-
.. **Play sound for notifications**: **Enable**.
74+
.. **Critical Alerts**: Enable
75+
.. **Notifications**: Enable
76+
.. **Banner alert type**: Persistent
77+
.. **Notifications on Lock Screen**: Display
78+
.. **Notifications in Notification Center**: Display
79+
.. **Badge app icon**: Display
80+
.. **Play sound for notifications**: Enable
8181
. Save the configuration.
8282

8383
[role="screenshot"]

‎docs/serverless/edr-install-config/deploy-with-mdm.asciidoc‎

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
[[security-deploy-with-mdm]]
2+
= Deploy {elastic-defend} on macOS with mobile device management
3+
4+
// :description: Configure access for deploying {elastic-defend} on macOS with mobile device management.
5+
// :keywords: security, how-to, secure
6+
7+
++++
8+
<titleabbrev>Deploy on macOS with MDM</titleabbrev>
9+
++++
10+
11+
preview:[]
12+
13+
To silently install and deploy {elastic-defend} without the need for user interaction, you need to configure a mobile device management (MDM) profile for {elastic-endpoint}—the installed component that performs {elastic-defend}'s threat monitoring and prevention. This allows you to pre-approve the {elastic-endpoint} system extension and grant Full Disk Access to all the necessary components.
14+
15+
This page explains how to deploy {elastic-defend} silently using Jamf.
16+
17+
[discrete]
18+
[[security-deploy-with-mdm-configure-a-jamf-mdm-profile]]
19+
== Configure a Jamf MDM profile
20+
21+
In Jamf, create a configuration profile for {elastic-endpoint}. Follow these steps to configure the profile:
22+
23+
. <<security-deploy-with-mdm-approve-the-system-extension,Approve the system extension>>.
24+
. <<security-deploy-with-mdm-approve-network-content-filtering,Approve network content filtering>>.
25+
. <<security-deploy-with-mdm-enable-notifications,Enable notifications>>.
26+
. <<security-deploy-with-mdm-enable-full-disk-access,Enable Full Disk Access>>.
27+
28+
[discrete]
29+
[[security-deploy-with-mdm-approve-the-system-extension]]
30+
=== Approve the system extension
31+
32+
. Select the **System Extensions** option to configure the system extension policy for the {elastic-endpoint} configuration profile.
33+
. Make sure that **Allow users to approve system extensions** is selected.
34+
. In the **Allowed Team IDs and System Extensions** section, add the {elastic-endpoint} system extension:
35+
+
36+
.. (Optional) Enter a **Display Name** for the {elastic-endpoint} system extension.
37+
.. From the **System Extension Types** dropdown, select **Allowed System Extensions**.
38+
.. Under **Team Identifier**, enter `2BT3HPN62Z`.
39+
.. Under **Allowed System Extensions**, enter `co.elastic.systemextension`.
40+
. Save the configuration.
41+
42+
[role="screenshot"]
43+
image::images/deploy-with-mdm/system-extension-jamf.png[]
44+
45+
[discrete]
46+
[[security-deploy-with-mdm-approve-network-content-filtering]]
47+
=== Approve network content filtering
48+
49+
. Select the **Content Filter** option to configure the Network Extension policy for the {elastic-endpoint} configuration profile.
50+
. Under **Filter Name**, enter `ElasticEndpoint`.
51+
. Under **Identifier**, enter `co.elastic.endpoint`.
52+
. In the **Socket Filter** section, fill in these fields:
53+
+
54+
.. **Socket Filter Bundle Identifier**: Enter `co.elastic.systemextension`
55+
.. **Socket Filter Designated Requirement**: Enter the following:
56+
+
57+
[source,txt]
58+
----
59+
identifier "co.elastic.systemextension" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "2BT3HPN62Z"
60+
----
61+
. In the **Network Filter** section, fill in these fields:
62+
+
63+
.. **Network Filter Bundle Identifier**: Enter `co.elastic.systemextension`
64+
.. **Network Filter Designated Requirement**: Enter the following:
65+
+
66+
[source,txt]
67+
----
68+
identifier "co.elastic.systemextension" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "2BT3HPN62Z"
69+
----
70+
. Save the configuration.
71+
72+
[role="screenshot"]
73+
image::images/deploy-with-mdm/content-filtering-jamf.png[]
74+
75+
[discrete]
76+
[[security-deploy-with-mdm-enable-notifications]]
77+
=== Enable notifications
78+
79+
. Select the **Notifications** option to configure the Notification Center policy for the {elastic-endpoint} configuration profile.
80+
. Under **App Name**, enter `Elastic Security.app`.
81+
. Under **Bundle ID**, enter `co.elastic.alert`.
82+
. In the **Settings** section, include these options with the following settings:
83+
+
84+
.. **Critical Alerts**: Enable
85+
.. **Notifications**: Enable
86+
.. **Banner alert type**: Persistent
87+
.. **Notifications on Lock Screen**: Display
88+
.. **Notifications in Notification Center**: Display
89+
.. **Badge app icon**: Display
90+
.. **Play sound for notifications**: Enable
91+
. Save the configuration.
92+
93+
[role="screenshot"]
94+
image::images/deploy-with-mdm/notifications-jamf.png[]
95+
96+
[discrete]
97+
[[security-deploy-with-mdm-enable-full-disk-access]]
98+
=== Enable Full Disk Access
99+
100+
. Select the **Privacy Preferences Policy Control** option to configure the Full Disk Access policy for the {elastic-endpoint} configuration profile.
101+
. Add a new entry with the following details:
102+
+
103+
.. Under **Identifier**, enter `co.elastic.systemextension`.
104+
.. From the **Identifier Type** dropdown, select **Bundle ID**.
105+
.. Under **Code Requirement**, enter the following:
106+
+
107+
[source,txt]
108+
----
109+
identifier "co.elastic.systemextension" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "2BT3HPN62Z"
110+
----
111+
+
112+
.. Make sure that **Validate the Static Code Requirement** is selected.
113+
. Add a second entry with the following details:
114+
+
115+
.. Under **Identifier**, enter `co.elastic.endpoint`.
116+
.. From the **Identifier Type** dropdown, select **Bundle ID**.
117+
.. Under **Code Requirement**, enter the following:
118+
+
119+
[source,txt]
120+
----
121+
identifier "co.elastic.endpoint" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "2BT3HPN62Z"
122+
----
123+
+
124+
.. Make sure that **Validate the Static Code Requirement** is selected.
125+
. Add a third entry with the following details:
126+
+
127+
.. Under **Identifier**, enter `co.elastic.elastic-agent`.
128+
.. From the **Identifier Type** dropdown, select **Bundle ID**.
129+
.. Under **Code Requirement**, enter the following:
130+
+
131+
[source,txt]
132+
----
133+
identifier "co.elastic.elastic-agent" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "2BT3HPN62Z"
134+
----
135+
+
136+
.. Make sure that **Validate the Static Code Requirement** is selected.
137+
. Save the configuration.
138+
139+
[role="screenshot"]
140+
image::images/deploy-with-mdm/fda-jamf.png[]
141+
142+
After you complete these steps, generate the mobile configuration profile and install it onto the macOS machines. Once the profile is installed, {elastic-defend} can be deployed without the need for user interaction.

0 commit comments

Comments
 (0)