Agent Setup for MAC OS

To complete the assessment of a MAC device, you must install an agent onto the device. The agent installation is a simple task but does require some command-line access (Terminal)

Official Installation Guide - shortcut below

Manual Deployment of the Agent

You will need administrative (sudo) access to your device to install the agent.

1. Download the macOS installation package for your device: Here
   
   
2. Open Finder / Downloads
   
3. Open an additional Finder Window (thus you will have two Finders open, one in downloads and another one.
   
4. From the top menu, click "Go" and select "Go to Folder", then type "/Users/Shared" and press return.
   
   
5. You can now move or copy/paste your downloaded file into the shared folders so any user can see the file. This is important, as when you later sudo, your user context will change, therefore, you may not be able to see your download folder.
6. You will then need to open a Terminal Window to install the Agent. Use Finder to search for "Terminal" and open it.
   
7. You can now sudo su {your admin account}. Then, after confirming the password for your admin account, you can cd /Users/Shared, to move into the folder where you copied the Qualys installer, then ls, to confirm you can see the QualysCloudAgent.pkg file.
   
8. You can then execute the installation command by editing the text you have created on screen with the drag and drop of the file from your downloads folder - alternatively, copy the command from below, paste that into the Terminal Window and edit the {your username} replacing it with the login name you use for your MAC.
   
   Where I have had an issue, I have dragged the file from my downloads into the /users folder root (needs elevation) and then it's available for you with a cd/users on the command line.
   

   sudo installer -pkg /Users/Shared/QualysCloudAgent.pkg  -target /

   
9. Once you see the installation has been completed successfully, as above, you have one further command to execute (we have emailed this to you, but the example is below)

   sudo /Applications/QualysCloudAgent.app/Contents/MacOS/qualys-cloud-agent.sh ActivationId=SeeYourEmail CustomerId=SeeYourEmail ServerUri=https://qagpublic.qg2.apps.qualys.eu/CloudAgent/

   You should see the Terminal Window display that some permissions have been amended for the root account and the group wheel (or similar)
   

10. At this point, you can terminate the Terminal Session by typing "Exit" into the Terminal Window and then closing the Terminal Application. 
    
11. You will need to add the Permissions for the Privacy Features and Service manually
    1. MacOS 10.15 and onwards, applications need to be granted appropriate permissions for
       privacy features and services.
    2. QualysCloudAgent.app does not install kernel extensions (KEXT) or System Extensions.
       QualysCloudAgent.app needs to be explicitly added to the allow list for below privacy
       feature:
    3. Enable Full Disk Access (FDA)
       1. Permissions for the Privacy Features and Service
          This privacy permission can be manually managed by users in System Preferences 
       2. Security & Privacy > Privacy > Full Disk Access.
       3. To grant authorization for FDA for QualysCloudAgent.app with the help of MDM, like Jamf/Meraki, use below Bundle Identifier and Team Identifier:
          Bundle Identifier=com. Qualys.cloud-agent
          TeamIdentifier=CLRUMG7LZ6

QUALYS UNINSTALL / REMOVAL

When we conclude the assessment, your assessor will select to remove you from our Qualys system. Once you remove your installed Qualys agents, they will self-remove the next time they check in to the platform. This works only once, so if you have a script installing Qualys, it will reinstall, and you will have to remove it manually.

You can manually uninstall Qualys using the uninstall command from a terminal session of your macOS device, using the following command: 

"sudo /Applications/QualysCloudAgent.app/Contents/MacOS/qagent_uninstall.sh"