# macOS Installation
## Pre-Requirements
The CyberCyte' s macOS agent requires a offical or local repository. The system will download "osquery" with latest version.
Optionally the agent will download "nmap" and "Docker" with latest verison. For Docker repositories, please allow connection to these registries:
* registry.community.greenbone.net
* hub.docker.com
The CyberCyte macOS agent supports the distributions listed below:
* macOS 10.12 and above
## The Agent Settings
The Agent installer link is created dynamically when downloaded. Once the agent is downloaded, it is available from "Settings & Reporting" -> "Deployment Management".
From this section, basic agent parameters can be configured by clicking the "macOS Agent Settings" button.
**Agent Configurations**
| Settings Name | Explanation |
| -------------------------- | ------------------------------------------- |
| Communication Interval | Agent communication interval to the Server |
| Data Sending Interval | Agent data send interval to the Server |
| Update Check Interval | Agent update check interval from the Server |
| Service Iteration Interval | Agent sleeps for this time after each cycle |
| Upload Data Chunk Size | Number of uploaded entries by one query |
Once the settings are defined, click the "Save" button, and the system will redirect to the download page. Click the "Download Installer" button to download the agent. This action will start to download the installer. After downloading the installer, please download the config file with the "Download Config File" button. The agent (.pkg) and the config file must be downloaded and they need to be in the folder. To install the agent, please double-click on the downloaded pkg file. The installation will start automatically. Alternatively, the below command can be used.
```bash
sudo installer -pkg /path/to/package.pkg -target /
```
After installing the agent, the machine information can be seen under the "Asset Management" -> "Endpoint Management".
## Adding Necessary Policies and Endpoints to the macOS Devices Group
Once the agents appear in the Endpoint Management, add them to the Linux Servers Group. Please navigate to "Rules & Policies" -> "Policy Management" -> "Group Management". Select the group named "macOS Devices Group". Assign the policy to the required field and click on the "Save" button placed below on the page.
In some cases, users need to edit/create a new policy. For a new policy please navigate to "Rules & Policies" -> "Policy Management" -> "Policy Rules" and click on the "+ Policy" button. Edit the field as needed and save the policy. After successfully creating a policy, go to "Group Management" and select the "macOS Devices Group". Assign the policy to the group.
When policies are assigned to the groups, data collection starts. Users must wait for the next iteration of the collection to see the results.
## Checking the Installation
Please navigate to "Endpoints & Network Devices" -> "Endpoint Management" -> "Asset Management" on the portal. All machines are synced with the table; users can observe the machine/agent information from there.
Agents should be able to access CyberCyte Server on Port 443 and [https://download.cloudcyte.com](https://download.cloudcyte.com/) websites. If the agent is not shown here, please check access to the portal on the client first. If the entry is successful, please wait for communication interval settings.
## Checking the Agent Status
* Using Shell:
* Execute this command in the shell:
* `sudo launchctl list | grep cyber`
* Using CyberCyte Portal:
* Go to the "Endpoints & Network Devices" -> "Endpoint Management" -> "Asset Management" on the portal. All of the agents will be listed under this page.
## Uninstalling/Disabling the Agent
* Using Shell:
* Execute this command in the shell:
* `sudo /usr/local/bin/CyberCyteAgent --uninstall`
* Disabling the Agent:
* Go to the "Endpoints & Network Devices" -> "Endpoint Management" -> "Asset Management" on the portal. Right-click on the machine and disable the agent. This action only disables agent data collection, the agent will update itself but not collect any data.
## Troubleshooting
If the agent is not appeared under the "Endpoints & Network Devices" -> "Endpoint Management" -> "Asset Management", please follow these steps to finding the root cause:
* Check the connection between device and CyberCyte portal, the device must communicate CyberCyte via 443 port.
* Check the logs under "/Library/Application Support/CyberCyteAgent/logs".
* Check the temp folder of the agent under "/tmp/CyberCyteAgent".
* Restart the agent with this command `" --restart" or "`/usr/local/bin/CyberCyteAgent --restart"
* Check the agent status with details:
* `sudo launchctl list com.cybercyte.macagent`\
`{`\
`"LimitLoadToSessionType" = "System";`\
`"Label" = "com.cybercyte.macagent";`\
`"OnDemand" = false;`\
`"LastExitStatus" = 0;`\
`"PID" = 80216;`\
`"Program" = "/usr/local/bin/CyberCyteAgent";`\
`};`
* Check the agent service on the device. If it is not working, please try to uninstall and re-install again.
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://docs.cloudcyte.com/pre-requirements-and-initialization-of-the-platform/agent-installations/macos-installation.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.