Deploy and Monitor the Status of the Skyhigh Client Proxy (SCP) in macOS using Intune

Enroll the Device

Enrolling the device in Microsoft Intune helps you in enabling centralized management, enforcing policies, and remotely deploying the SCP.

Create SCP Profiles

In this section, you can create profiles to configure the SCP client: the System Extensions Profile, Content Filter Profile, and App Proxy Filter (VPN) Profile. This ensures effective security and traffic filtering on managed devices.

1. Create the following profiles:

• System Extensions Profile
• Content Filter Profile
• App Proxy Filter (VPN) Profile

2. Push profiles to the endpoint.

Deploy SCP and Apply SCP Policy

Deploying the SCP and applying the policies on managed devices ensures consistent security enforcement and effective traffic control.

1. Navigate to Apps > Platform > macOS apps > Create.

2. Select macOS app (PKG) for app type.

3. Browse and select the SCP package (.pkg) file.
4. Click Ok.

5. Enter the following settings:
   • Name = Skyhigh Security 
   • Description = Skyhigh Client Proxy
   • Publisher = Skyhigh Security
   • Ignore app version = Yes
   • Category = Other app
   • Show this as a featured app in the Company Portal = Yes
   • Developer= Skyhigh Security
   • Owner = Skyhigh Security
   • Logo = Select the Skyhigh Security Logo

6. Click Next.
7. In the Program tab, under the post-install script, run the script to place scppolicy.opg under usr/local/McAfee/SCP/policy.

#!/bin/bash

#Define the source and destination paths

SOURCE="/Users/test/Documents/scppolicy.opg"

DESTINATION="/usr/local/McAfee/Scp/policy/scppolicy.opg"

# Define the permissions mode (e.g., 755 for read/write/execute for owner, read/execute for others)

PERMISSION_MODE="755"

cp -f "$SOURCE" "$DESTINATION"  # Copy the file with sudo

#chmod "$PERMISSION_MODE" "$DESTINATION"  # Set the file permissions

exit 0

 

8. Click Next.
9. In the Requirements tab, select macOS Monterey 12.0 as the minimum operating system.

10. Click Next.
11. In the Detection rules tab, enter the following details: 
    • Ignore app version > Yes
    • Add the Bundel ID’S: 

App Bundle ID (CF BlunderIdentifier)	App version (CFBundleShortVersionString)
com.mcafee.Menulet	10.7.10
com.trellix.agentMonitor.helperApplication	10.7.10
com.mcafee.maStatusMonitorHelper	10.7.10
com.mcafee.console	10.7.10
com.trellix.containerapp	10.7.10
com.skyhighsecurity.epclient	4.9.3

 

12. In the Assignments tab, select Add group, Add all users, and Add all devices.
13. Click Next.

14. Review the Add App and click Create.

Create an SCP Compliance Script to Monitor SCP Status 

Create a script that monitors the SCP status on managed devices. This script ensures that the client is installed, running, and functioning properly.

1. Navigate to Devices >  Platform > macOS > Scripts > Add.

The Add script window opens. 

2. In the Basics tab, enter the following details: 
   
   Name - Enter a name for the script.
   Description - Enter a description for the script.

3. Click Next.
4. In the Script settings tab:  
   1. Upload the script file. 
   2. Toggle Run script as signed-in user to No.
   3. Hide script notifications on devices to Not Configured.
   4. Script frequency to Not Configured.
   5. Max number of times to retry if script fails to Not Configured. 

5. Click Next.
6. In the Assignments tab, select Add groups, Add all users, and Add all devices. 

7. Click Next.
8. Review the SCP compliance script and click Add.