You can manually add Mac endpoints to Malwarebytes Nebula in a few different ways. The most common method is to copy an installer file to the endpoint and run the file from the endpoint. You may also add endpoints using the command line or with a dissolvable remediation tool.
This article covers the following methods:
- Use a downloaded installer and copy it to the endpoint.
- Command line remote installation for Mac endpoints, which can be run silently.
- Dissolvable Unmanaged Remediation Tools installation.
If you have many endpoints, you can use the macOS PKG installer with Mobile Device Manager (MDM) solutions such as JAMF.
Use a downloaded installer
To manually add an endpoint to Malwarebytes Nebula, download the Malwarebytes Endpoint Agent installation file and run the file from the endpoint. Each is pre-configured for your account.
Malwarebytes provides endpoint installers for you to use with your preferred installation method.
Mac Endpoint Installer Notes
- Do not change the name of the downloaded installer file as it retrieves the Nebula accounttoken value from the file's name. Device management tools may remove the accounttoken. In this case, use the following command line instructions here.
- The following items are mandatory for correct operation:
- For macOS 10.13 and 10.14, Approve kernel/security framework extension for Malwarebytes Endpoint Protection on Mac devices
- For macOS 10.15, macOS 11.x, macOS 12.x, and macOS 13.x, Mac endpoint missing Full Disk Access in Nebula
- Endpoints are assigned to the Default Group and use the Default Policy unless you specify a different group. To automatically assign endpoints to a group during installation:
- On the left navigation menu, click Download Center.
- Under the Advanced tools tab, click the Specify group assignment link.
- The Deployment tab has two methods to begin deployment with your Mac users:
- Direct Download: Download the Endpoint Agent installer to your local endpoint.
- Link Sharing: Copy and share the download link to the Endpoint Agent installer. Links expire after 7 days. Choose from the following options:
- Copy installer link: Contains the download link.
- Copy installer link with instructions: Contains the download link and installation instructions.
- com.malwarebytes.ncep.nobody: An account with minimal permissions, created on Mac endpoints during installation. The Malwarebytes agent uses this account to run unprivileged system and service tasks.
Installation process
- On the left navigation menu, click Download Center.
- Select Mac from the platform drop-down menu.
- Click Start download to download the Mac Endpoint Installer to your local device.
- We recommend you keep __xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx___ naming as this is your accounttoken value, which identifies your account to the macOS installer. If removed, see the command line instructions below to set the accounttoken after installation.
- After you have downloaded the installer, copy it to the endpoint and run the installer.
- When the installation process completes, the Endpoint Agent registers and the endpoint shows up in the Nebula console.
- The Endpoint Agent retrieves policy information and configures the endpoint, downloading agents for the configured features. This process takes about 5 minutes until the endpoints is protected and ready to scan.
Command line remote installation for Mac
You may use the terminal command below to perform a silent install on Mac endpoints by software deployment and management systems.
- sudo -E /usr/sbin/installer -pkg Setup.MBEndpointAgent__aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa___.pkg -target /
You may use the terminal command below to perform a silent install on Mac endpoints, while specifying the target group. Group identifiers may be seen in the Nebula Console Downloads Specify group assignment link. This command uses extended file attributes (xattr) to set the Group ID and is shown on multiple lines due to the length of the command.
-
xattr -w MALWAREBYTES_GROUP <GroupID> Setup.MBEndpointAgent.pkg; sudo -E /usr/sbin/installer -pkg Setup.MBEndpointAgent.pkg -target /
Command line set ACCOUNTTOKEN after installation
You may use the terminal command below to set the new accounttoken:
- sudo '/Library/Application Support/Malwarebytes/Malwarebytes Endpoint Agent/EndpointAgentDaemon.app/Contents/MacOS/EndpointAgentDaemon' ACCOUNTTOKEN=<accounttoken>
After setting the account token, restart the Endpoint Agent service using the commands below:
- sudo launchctl unload /Library/LaunchDaemons/com.malwarebytes.agent.daemon.plist
- sudo launchctl load /Library/LaunchDaemons/com.malwarebytes.agent.daemon.plist
Check macOS Services and security extensions
$ sudo launchctl list | grep com.malwarebytes*
Password:
1750 0 com.malwarebytes.ncep.settings.daemon
- 0 com.malwarebytes.UserAgent
1748 0 com.malwarebytes.ncep.rtprotection.daemon
1649 0 com.malwarebytes.EndpointAgent
Check Kernel Extension for: OS X 10.11, 10.12 Sierra, macOS 10.13 High Sierra, and macOS 10.14 Mojave
$ kextstat | grep malwarebytes
187 0 0xffffff7f85a07000 0x8000 0x8000 com.malwarebytes.ncep.rtprotection (3.9.16) 9EF16C6D-E345-31AF-8646-2507C3F781D8 <6 5 3 1>
Check System Extension for: macOS 10.15 Catalina, macOS 11 Big Sur, macOS 12 Monterey, macOS 13 Ventura
$ systemextensionsctl list | grep -i malwarebytes
* * GVZRY6KDKR com.malwarebytes.edr.helper.ext (1.5.136/1.5.136) EDRMacHelperExt [activated enabled]
Dissolvable unmanaged remediation tools
You may prefer to use a dissolvable remediation tool instead of an installer. Under Advanced tools is the Remediation (Unmanaged) section. Here you can download the following Malwarebytes dissolvable unmanaged remediation tool.
Mac Breach Remediation: our dissolvable remediation program for Mac endpoints. For more information, see the Malwarebytes Breach Remediation for Mac Command Line Administrator Guide.
Return to the Malwarebytes Nebula Administrator Guide.