|
1 | 1 | [[sensor-full-disk-access]] |
2 | | -= Enable full disk access |
| 2 | += Enable Full Disk Access |
3 | 3 |
|
4 | | -Elastic Endpoint Security requires full disk access to protect you from malware and other cybersecurity threats. Full Disk Access permissions is a new privacy feature introduced in macOS Mojave (10.14) that prevents some applications from accessing your data. This means you need to manually grant permission for Elastic Endpoint Security to access these protected areas of your Mac. |
| 4 | +Elastic Endpoint Security requires Full Disk Access to protect you from malware and other cybersecurity threats. Full Disk Access permissions is a new privacy feature introduced in macOS Mojave (10.14) that prevents some applications from accessing your data. This means you need to manually grant permission for the Endgame sensor and Elastic Endpoint to access these protected areas of your Mac. |
5 | 5 |
|
6 | | -This article describes how to enable full disk access for both the Elastic Agent, required in order to enable Elastic Endpoint Security, and the legacy Endgame sensor. |
| 6 | +This article describes how to enable Full Disk Access for the required security system extensions, the Elastic Endpoint sensor, and the legacy Endgame sensor. |
| 7 | + |
| 8 | +[discrete] |
| 9 | +[[macos-permissions]] |
| 10 | +== macOS permissions |
| 11 | + |
| 12 | +The behavior of the Endgame sensor and Elastic Endpoint differs based on your macOS version. MDM/JAMF users can pre-approve all Full Disk Access without granting permission to the sensors. However, depending on the macOS version and sensor type, non-MDM/JAMF users may be prompted to enable Full Disk Access for required security files. |
| 13 | + |
| 14 | +**Endgame Sensor** |
| 15 | + |
| 16 | +- `10.13, 10.14, 10.15`: Users cannot proceed with installation without first granting the sensor the ability to load a <<enable-kernel-extension,kernel extension>>. During installation, you will be prompted to go to **System preferences** and approve loading the kernel. Upon approval, installation proceeds. |
| 17 | + |
| 18 | +- `11.0` (Big Sur): Users cannot proceed with installation without first granting the sensor the ability to load <<system-extension>>. During installation, you will be prompted to go to **System preferences** and approve loading the system extension. Upon approval, a second prompt appears to enable **Network Filtering**. Approve this final prompt for installation to proceed. |
| 19 | ++ |
| 20 | +You also must grant Full Disk Access to `com.endgame.systemextension`. |
| 21 | + |
| 22 | +- `10.14.6+, 10.15, 11.0`: Grant the <<endpoint-endgame-sensor,esensor>> Full Disk Access. |
| 23 | + |
| 24 | + |
| 25 | +**Elastic Endpoint** |
| 26 | + |
| 27 | +No prompts appear to approve the <<enable-kernel-extension,kernel>>, <<system-extension>>, or <<endpoint-endgame-sensor,elastic-endpoint>>, due to installation happening through the {agent}. After installation, Endpoint policies **will fail** to detect events until you approve and enable kernel or system extension loading and Full Disk Access for each version, as reflected in the **Administration > Endpoints** page of the security application. |
| 28 | + |
| 29 | +- `10.13, 10.14, 10.15`: Approve the <<enable-kernel-extension,kernel-extension>>. |
| 30 | + |
| 31 | +- `11.0` (Big Sur): Give Full Disk Access to the <<system-extension>>, as well as `co.elastic.systemextension`. |
| 32 | + |
| 33 | +- - `10.14.6+, 10.15, 11.0`: Grant the <<endpoint-endgame-sensor,elastic-endpoint>> Full Disk Access. |
| 34 | + |
| 35 | +[discrete] |
| 36 | +[[system-extension]] |
| 37 | +== System extension |
| 38 | + |
| 39 | +To fully protect endpoints from malware and other cybersecurity threats when using Elastic Endpoint with system extensions, Full Disk Access must be enabled for the system extension during <<install-endpoint,installation>> on macOS Big Sur (11.0) and later. |
| 40 | + |
| 41 | +-- |
| 42 | +image::images/system-extension-prompt.png[System Extension Prompt] |
| 43 | +-- |
| 44 | + |
| 45 | +If you select **OK** and continue installation, you'll receive a prompt to **Filter Network Content**. Select **Allow**, and then use the following steps to enable Full Disk Access for the system extension. |
7 | 46 |
|
8 | 47 | 1. Open the **System Preferences** application. |
9 | 48 | + |
10 | | -2. Click **Security and Privacy**. On the Security and Privacy panel, select the **Privacy** tab. |
| 49 | +2. Click **Security and Privacy**. On the Security and Privacy panel, select the **Privacy** tab. |
11 | 50 | + |
12 | 51 | 3. In the left pane, select **Full Disk Access**. |
13 | 52 | + |
14 | 53 | -- |
15 | 54 | image::images/select-fda.png[Select Full Disk Access] |
16 | 55 | -- |
17 | 56 | + |
18 | | -4. In the lower-left corner of the panel, click the **Lock button** and enter your username and password. You can now add the `elastic-agent` or `esensor` file. |
| 57 | +4. In the lower-left corner of the panel, click the **Lock button** and enter your username and password. |
| 58 | ++ |
| 59 | +5. Click the + button to view Finder. Find the system extension `com.endgame.systemextension` (Endgame sensor) or `co.elastic.systemextension` (Elastic Endpoint) and select. |
| 60 | + |
| 61 | +The system extension now has Full Disk Access. However, for both the {agent} and Elastic Endgame sensor to detect events from a macOS host, you must enable Full Disk Access for the file most relevant to your security setup. |
| 62 | + |
| 63 | +[discrete] |
| 64 | +[[endpoint-endgame-sensor]] |
| 65 | +== Elastic Endpoint and Endgame sensor |
| 66 | + |
| 67 | +The `elastic-endpoint` files appear after you've downloaded and installed the {agent} with <<install-endpoint,Endpoint Security Integration>>. Similarly, the `esensor` file for Elastic Endgame appears once you've downloaded the sensor on your host. |
| 68 | + |
| 69 | + |
| 70 | +1. Open the **System Preferences** application. |
| 71 | ++ |
| 72 | +2. Click **Security and Privacy**. On the Security and Privacy panel, select the **Privacy** tab. |
| 73 | ++ |
| 74 | +3. In the left pane, select **Full Disk Access**. |
| 75 | ++ |
| 76 | +-- |
| 77 | +image::images/select-fda.png[Select Full Disk Access] |
| 78 | +-- |
| 79 | ++ |
| 80 | +4. In the lower-left corner of the panel, click the **Lock button** and enter your username and password. You can now add the `elastic-endpoint` or `esensor` file. |
| 81 | + |
| 82 | +5. Click the + button to view Finder. Select the file that pertains most to your Endpoint configuration: |
| 83 | ++ |
| 84 | +- Endpoint Security: Navigate to `/Library/Elastic/Endpoint/` and select the `elastic-endpoint` file. |
| 85 | ++ |
| 86 | +- Elastic Endgame: Navigate to `/Library/Endgame` and select the `esensor` file. |
19 | 87 |
|
20 | | -5. Click the + button to view Finder. Navigate to the `/Library/Endgame` directory, select the `elastic-agent` or `esensor` file, and then click *Open*. |
| 88 | +6. After you've selected the applicable file, click **Open**. |
21 | 89 |
|
22 | | -6. In the **Privacy** tab, confirm that the `elastic-agent` or `esensor` file appears in the list of applications that have full access permission, as seen in the following image: |
| 90 | +7. In the **Privacy** tab, confirm that the `elastic-agent` or `esensor` file appears in the list of applications that have Full Disk Access permissions. |
23 | 91 |
|
24 | 92 |
|
25 | | -Elastic Endpoint Security now has the access required to fully protect your system. |
| 93 | +Elastic Endpoint now has the access required to fully protect your system. |
0 commit comments