Huntress - ethan's notes

# MacOS Deployment > To take full advantage of all Huntress EDR capabilities, macOS endpoints must have the Huntress Agent, our system extension, and the network content filters configured to allow Huntress access. Without this, Huntress does not have the ability to isolate the endpoint and might be blocked from accessing some directories. > > This process has two steps that must be done in this order: > > 1. [Create an MDM policy](https://support.huntress.io/hc/en-us/articles/21286543756947#01HBGNECDDGTK0X7SA3E3ED840) to set permissions and push the policy to your endpoints. > 2. [Deploy the Huntress Agent](https://support.huntress.io/hc/en-us/articles/21286543756947#01J1GAD2AZK285467FQ6WQ4C4D) through a script.^[https://support.huntress.io/hc/en-us/articles/21286543756947-Instructions-for-the-MDM-Configuration-for-macOS] ## MDM Features > Using an MDM installs the Huntress Agent on your macOS endpoints without being visible to the end user. The MDM policy bundles the necessary FDA and approvals for the Agent, the system extension, and the network content filter. > \- [Critical Steps for Complete MacOS EDR Deployment](https://support.huntress.io/hc/en-us/articles/25013857741331-Critical-Steps-for-Complete-macOS-EDR-Deployment#h_01J18RD44RE7ZF2BMTRC2VNMAR) ## Deployment Scripts - Addigy https://github.com/huntresslabs/deployment-scripts/tree/main/Addigy ## No Internet after Huntress installation (MacOS) 1. Uninstall Huntress from the computer 1. Open up Terminal and paste in the following ```bash sudo bash /Applications/Huntress.app/Contents/MacOS/Uninstall -S ``` (the S must be capitalized for a silent uninstall) ## No Internet after Huntress installation (MacOS) 1. Uninstall Huntress from the computer 1. Open up Terminal and paste in the following ```bash sudo bash /Applications/Huntress.app/Contents/MacOS/Uninstall -S ``` (the S must be capitalized for a silent uninstall) 2. Redeploy Huntress through Addigy 1. Visit GoLive > Software > Smart Software and Deploy "Huntress Agent Installer" ![[Pasted image 20250326081116.png]]