Apple macOS Qualys Deployment Script

What does the script deliver?

Datto RMM script with the .mobileconfig embedded directly, running as root, Datto default, to be installed as a macOS script component.

This will:

✅ Auto-detect Intel vs. Apple Silicon
✅ Downloads the correct .PKG
✅ Installs the agent
✅ Deploys the embedded .mobileconfig Profile for Full Disk Access + System Extension
✅ Activates the agent
✅ Silently cleans up

If you create a variable within Datto, for example, QualysActivationID, you can use this in the script below, but swap the ACTIVATION_ID="your_activation_ID" with the # one and thus ACTIVATION_ID="%QualysActivationID%" and of course popping a # in front of the other one:

#!/bin/bash
set -euo pipefail
export PATH="/usr/bin:/bin:/usr/sbin:/sbin"
umask 077

# === CONFIGURATION: replace both IDs before deployment ===
ACTIVATION_ID="your_activation_id"
CUSTOMER_ID="your_customer_id"
SERVER_URI="https://qagpublic.qg2.apps.qualys.eu/CloudAgent/"

QUALYS_PKG_ARM64="https://www.cybertecsecurity.com/?qfd_download=apple-macos-silicon&qfd_token=CTS001"
QUALYS_PKG_X64="https://www.cybertecsecurity.com/?qfd_download=apple-macos-x64&qfd_token=CTS001"
QUALYS_APP="/Applications/QualysCloudAgent.app"
QUALYS_SCRIPT="$QUALYS_APP/Contents/MacOS/qualys-cloud-agent.sh"
WORK_DIR=""

fail() { echo "ERROR: $*" >&2; exit 1; }

cleanup() {
  if [[ -n "$WORK_DIR" && -d "$WORK_DIR" ]]; then
    /bin/rm -f "$WORK_DIR/QualysCloudAgent.pkg"
    /bin/rmdir "$WORK_DIR" || true
  fi
}
trap cleanup EXIT

[[ "$(/usr/bin/uname -s)" == "Darwin" ]] \
  || fail "This script requires macOS."

[[ "$EUID" -eq 0 ]] \
  || fail "Run as root, using sudo or your management platform."

UUID_PATTERN='^[[:xdigit:]]{8}-[[:xdigit:]]{4}-[[:xdigit:]]{4}-[[:xdigit:]]{4}-[[:xdigit:]]{12}$'

[[ "$ACTIVATION_ID" =~ $UUID_PATTERN ]] \
  || fail "Set a valid Activation ID."

[[ "$CUSTOMER_ID" =~ $UUID_PATTERN ]] \
  || fail "Set a valid Customer ID."

# === STEP 1: Detect hardware architecture ===
# Detect Apple Silicon even if the script runs under Rosetta.
ARCH="$(/usr/bin/uname -m)"
ARM64_CAPABLE="$(/usr/sbin/sysctl -n hw.optional.arm64 2>/dev/null || true)"

if [[ "$ARCH" == "arm64" || "$ARM64_CAPABLE" == "1" ]]; then
  echo "Apple Silicon detected."
  QUALYS_DOWNLOAD_URL="$QUALYS_PKG_ARM64"
elif [[ "$ARCH" == "x86_64" ]]; then
  echo "Intel x64 detected."
  QUALYS_DOWNLOAD_URL="$QUALYS_PKG_X64"
else
  fail "Unsupported architecture: $ARCH"
fi

# Use a private temporary directory and remove it when the script exits.
WORK_DIR="$(/usr/bin/mktemp -d /private/tmp/qualys-install.XXXXXX)"
QUALYS_PKG_PATH="$WORK_DIR/QualysCloudAgent.pkg"

# === STEP 2: Download and validate the package ===
echo "Downloading Qualys Cloud Agent..."

if ! /usr/bin/curl --fail --location --show-error --silent \
  --proto '=https' --proto-redir '=https' \
  --connect-timeout 30 --max-time 900 --retry 3 \
  --output "$QUALYS_PKG_PATH" "$QUALYS_DOWNLOAD_URL"; then
  fail "Package download failed."
fi

[[ -s "$QUALYS_PKG_PATH" ]] \
  || fail "Downloaded package is empty."

# Reject HTML/error pages and packages without a trusted signature.
/usr/bin/xar -tf "$QUALYS_PKG_PATH" >/dev/null 2>&1 \
  || fail "Download is not a valid flat macOS installer package."

/usr/sbin/pkgutil --check-signature "$QUALYS_PKG_PATH" \
  || fail "Package signature verification failed."

# === STEP 3: Install the agent ===
echo "Installing Qualys Cloud Agent..."

/usr/sbin/installer -pkg "$QUALYS_PKG_PATH" -target / \
  || fail "Package installation failed."

[[ -x "$QUALYS_SCRIPT" ]] \
  || fail "Activation script not found: $QUALYS_SCRIPT"

# === STEP 4: Apply activation settings ===
echo "Applying Qualys activation settings..."

"$QUALYS_SCRIPT" \
  "ActivationId=$ACTIVATION_ID" \
  "CustomerId=$CUSTOMER_ID" \
  "ServerUri=$SERVER_URI" \
  || fail "Qualys activation command failed."

# === STEP 5: Verify the local process ===
# The installer manages the service. Allow up to 60 seconds for startup.
echo "Checking the local Cloud Agent process..."

for ((attempt=1; attempt<=30; attempt++)); do
  if /usr/bin/pgrep -f '/Applications/QualysCloudAgent[.]app/Contents/MacOS/qualys-cloud-agent([[:space:]]|$)' >/dev/null; then
    echo "Installation and activation command completed; local agent process is running."
    echo "Confirm registration and check-in in the Qualys Cloud Agent console."
    exit 0
  fi
  /bin/sleep 2
done

echo "ERROR: Installation completed, but the local agent process was not detected." >&2
echo "Review /var/log/qualys/qualys-cloud-agent.log and the Qualys console." >&2
exit 3

Just to let you know, we accept no responsibility for the outcomes of this script and recommend that you complete appropriate testing before using it across a large deployment base.