The Malwarebytes Endpoint Agent installs and uses the following components to provide functionality on a Mac endpoint. Some components only exist if the associated feature, capability, or plugin is enabled in the policy assigned to the endpoint.
Directories
The following directories contain files utilized by the Malwarebytes Endpoint Agent and its plugins on a Mac endpoint:
| Path | Description |
|
/Library/Application Support/Malwarebytes/Malwarebytes Endpoint Agent |
Application files for the Malwarebytes Endpoint Agent and component plugins. |
|
/Library/Application Support/Malwarebytes/NCEP |
Application files used by Malwarebytes Endpoint Protection (NCEP Mac SDK). |
|
/Users/USERNAME/Library/Application Support/Malwarebytes |
User-specific application data for the Malwarebytes Endpoint User Agent. |
|
/Library/Application Support/Malwarebytes/Malwarebytes Endpoint Agent/Plugins |
Folder where plugins reside. |
Daemons
The following table lists the daemons or system processes that run on a Mac endpoint:
| Friendly Name | Name | Path | Description |
|
EndpointAgentDameon |
com.malwarebytes. |
/Library/Application Support/ Malwarebytes/Malwarebytes Endpoint Agent/EndpointAgentDaemon.app/ |
The Malwarebytes Endpoint Agent Daemon provides the Endpoint Agent Engine, plugin framework, and communication to Malwarebytes Nebula. |
|
Malwarebytes Protection |
com.malwarebytes. |
/Library/Application Support/ |
The Malwarebytes NCEP Real-Time Protection Daemon provides the protection layers and scanning engine of Malwarebytes Endpoint Protection and Malwarebytes Incident Response. |
|
SettingsDameon |
com.malwarebytes. |
/Library/Application Support/ |
The Malwarebytes NCEP Settings Daemon provides functionality used by Malwarebytes Endpoint Protection and Malwarebytes Incident Response. |
Agents
The following table lists the agents or users) that run on a Mac endpoint:
| Friendly Name | Name | Path | Description |
|
UserAgent |
com.malwarebytes. |
/Library/Application Support/ |
Provides user-level and UI capabilities of the Malwarebytes Endpoint Agent |
|
Malwarebytes Agent |
com.malwarebytes. |
/Library/Application Support/ |
Provides user-level capabilities of NCEP used by Malwarebytes Endpoint Protection and Malwarebytes Incident Response. |
Network Extensions
The following table lists the network extensions that run on a Mac endpoint endpoint:
| Name | Path | Description |
|
com.malwarebytes.edr.helper.ext |
/Library/SystemExtensions/CACB1477-716D-46CA-9942-134D1C5FB959/ |
Network Extension required to provide Endpoint Detection & Response functionality on Mac. |
Processes
The following table lists common processes that run on a Mac endpoint:
| Path | Description |
|
/Library/Application Support/ |
The Malwarebytes Endpoint Agent Daemon provides the Endpoint Agent Engine, plugin framework, and communication to Malwarebytes Nebula. |
|
/Library/Application Support/ |
The Malwarebytes NCEP Real-Time Protection Daemon provides the protection layers and scanning engine of Malwarebytes Endpoint Protection and Malwarebytes Incident Response. |
|
/Library/Application Support/ |
The Malwarebytes NCEP Settings Daemon provides functionality used by Malwarebytes Endpoint Protection and Malwarebytes Incident Response. |
|
/Library/Application Support/ |
Provides user-level and UI capabilities of the Malwarebytes Endpoint Agent. |
|
/Library/Application Support/ |
Provides user-level capabilities of NCEP used by Malwarebytes Endpoint Protection and Malwarebytes Incident Response. |
Plugins
The following table lists the Plugins that the Malwarebytes Endpoint Agent utilizes on a Mac endpoint for product functionality:
| Name | Path | Description |
|
Asset Manager |
/Library/Application Support/ |
Enables the Malwarebytes Asset Manager for hardware and software asset inventory and the OPSWAT OESIS SDK for Vulnerability Assessment and Patch Management features. |
|
Endpoint Protection (EP) (aka MBAM Plugin or NCEP Plugin) |
/Library/Application Support/ |
Enables the following features:
|
|
Endpoint Detection and Repsonse (EDR) |
/Library/Application Support/ |
Enables the following EDR features:
|
For information on system components for other operating systems, see the links below: