Updating our MDM Configuration for macOS

Preparing Your MDM for the 4.1 macOS Agent

Make these changes before your Macs upgrade to agent 4.1 to avoid users seeing approval prompts. If your Macs have already upgraded, you can still make them now.

Field Effect MDR agent 4.1 for macOS adds two system extensions that must be approved and configured by your MDM: Host-Based Network Sensor (HBNS) and DNS Proxy.

This can be done either using your organization's MDM tool, or manually. This article covers both methods and covers the following topics: 

• Enable the Network Extensions with an MDM Tool
  • Reference Value
  • Step 1: Approve the new system extensions
  • Step 2: Deploy the HBNS profile
  • Step 3: Deploy the DNS Proxy profile
  • Uploading the Profiles
  • Verification
• Enable the Network Extensions Manually

Enable the Network Extensions with an MDM Tool

1. Add the two new extensions to your existing Field Effect System Extension profile.
2. Deploy the HBNS profile.
3. Deploy the DNS Proxy profile.

Your existing Full Disk Access and license profiles do not change.

Reference Value

KSBE8M6M6F

com.fieldeffect.covalence.esext

com.fieldeffect.covalence.hbns

com.fieldeffect.covalence.dnsproxy

Step 1: Approve the new system extensions

Edit your existing Field Effect System Extension profile. Do not create a second one, as most MDMs treat two System Extension profiles for the same Mac as a conflict and apply neither.

Under team identifier KSBE8M6M6F, add the two new bundle IDs next to the existing one:

<key>AllowedSystemExtensions</key>
<dict>
    <key>KSBE8M6M6F</key>
    <array>
        <string>com.fieldeffect.covalence.esext</string>
        <string>com.fieldeffect.covalence.hbns</string>
        <string>com.fieldeffect.covalence.dnsproxy</string>
    </array>
</dict>

If your profile allows extensions by type, allow both Endpoint Security Extension and Network Extension.

Microsoft Intune: go to Devices > macOS > Configuration, open your Field Effect System Extension profile, select Configuration settings > Edit, add the two bundle IDs under Allowed System Extensions for KSBE8M6M6F, then Review + save.

Other MDMs: add the two bundle IDs in the System Extensions payload of your Field Effect profile. If you uploaded it as a .mobileconfig file, update the file as shown above and re-upload it to the same profile.

Step 2: Deploy the HBNS profile

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"&gt;
<plist version="1.0">
<dict>
    <key>PayloadDisplayName</key>
    <string>Field Effect Host-Based Network Sensor</string>
    <key>PayloadDescription</key>
    <string>Field Effect MDR Host-Based Network Sensor (HBNS) configuration</string>
    <key>PayloadOrganization</key>
    <string>Field Effect Software Inc.</string>
    <key>PayloadIdentifier</key>
    <string>com.fieldeffect.covalence.mdm.hbns</string>
    <key>PayloadUUID</key>
    <string>DC5E1565-1A34-4A5B-8743-907D691749E6</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
    <key>PayloadScope</key>
    <string>System</string>
    <key>PayloadRemovalDisallowed</key>
    <true/>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>PayloadDisplayName</key>
            <string>Field Effect Host-Based Network Sensor</string>
            <key>PayloadIdentifier</key>
            <string>com.fieldeffect.covalence.hbns</string>
            <key>PayloadUUID</key>
            <string>f2539c5e-cc6f-4420-ab25-635c2b7b0c03</string>
            <key>PayloadType</key>
            <string>com.apple.webcontent-filter</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <key>FilterType</key>
            <string>Plugin</string>
            <key>UserDefinedName</key>
            <string>Covalence HBNS</string>
            <key>Organization</key>
            <string>Field Effect Software Inc.</string>
            <key>PluginBundleID</key>
            <string>com.fieldeffect.covalence</string>
            <key>FilterDataProviderBundleIdentifier</key>
            <string>com.fieldeffect.covalence.hbns</string>
            <key>FilterDataProviderDesignatedRequirement</key>
            <string>identifier "com.fieldeffect.covalence.hbns" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] and certificate leaf[field.1.2.840.113635.100.6.1.13] and certificate leaf[subject.OU] = KSBE8M6M6F</string>
            <key>FilterSockets</key>
            <true/>
            <key>FilterBrowsers</key>
            <false/>
            <key>FilterGrade</key>
            <string>inspector</string>
            <key>VendorConfig</key>
            <dict>
                <key>FilterLevel</key>
                <integer>1</integer>
            </dict>
        </dict>
    </array>
</dict>
</plist>

Step 3: Deploy the DNS Proxy profile

Note: Upload this file rather than building the DNS Proxy in your MDM's settings. Most MDM consoles cannot set ProviderDesignatedRequirement, and the DNS Proxy will not work without it.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"&gt;
<plist version="1.0">
<dict>
    <key>PayloadDisplayName</key>
    <string>Field Effect DNS Proxy</string>
    <key>PayloadDescription</key>
    <string>Field Effect MDR DNS Proxy configuration</string>
    <key>PayloadOrganization</key>
    <string>Field Effect Software Inc.</string>
    <key>PayloadIdentifier</key>
    <string>com.fieldeffect.covalence.mdm.dnsproxy</string>
    <key>PayloadUUID</key>
    <string>02050746-1D66-484A-837D-0F822D95E818</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
    <key>PayloadScope</key>
    <string>System</string>
    <key>PayloadRemovalDisallowed</key>
    <true/>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>PayloadDisplayName</key>
            <string>Field Effect DNS Proxy</string>
            <key>PayloadIdentifier</key>
            <string>com.fieldeffect.covalence.dnsproxy</string>
            <key>PayloadUUID</key>
            <string>56c3e737-53ed-4099-8026-b036dbbfc852</string>
            <key>PayloadType</key>
            <string>com.apple.dnsProxy.managed</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <key>AppBundleIdentifier</key>
            <string>com.fieldeffect.covalence</string>
            <key>ProviderBundleIdentifier</key>
            <string>com.fieldeffect.covalence.dnsproxy</string>
            <key>ProviderDesignatedRequirement</key>
            <string>identifier "com.fieldeffect.covalence.dnsproxy" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] and certificate leaf[field.1.2.840.113635.100.6.1.13] and certificate leaf[subject.OU] = KSBE8M6M6F</string>
        </dict>
    </array>
</dict>
</plist>

Uploading the Profiles

Paste each sample into a plain-text editor and save it as a .mobileconfig file (for example, Field-Effect-HBNS.mobileconfig and Field-Effect-DNS-Proxy.mobileconfig). Do not change any values.

Upload each file to your MDM as a custom profile at device scope, and assign it to the same devices as your existing Field Effect profiles.

If you previously created your own Web Content Filter or DNS Proxy profile for Field Effect, remove it.

Verification

On a Mac running agent 4.1, run:

systemextensionsctl list

All three Field Effect extensions (team ID KSBE8M6M6F) should show [activated enabled], with an asterisk in both the enabled and active columns. If any show [activated waiting for user], the System Extension profile from Step 1 has not applied to that Mac.

Enable the Network Extensions Manually

If the HBNS or DNS Proxy extension is waiting for approval on a Mac, a local administrator can enable it on the device. The HBNS and DNS Proxy profiles from Steps 2 and 3 are still required.

Note: This must be done at the Mac. The Allow controls ignore clicks sent through remote control tools such as Screen Sharing.

macOS 15 and later:

1. Open System Settings > General > Login Items & Extensions.
2. Under Extensions, select the (i) next to Network Extensions.
3. Turn on Covalence HBNS and Covalence DNS Proxy, and enter administrator credentials when prompted.

macOS 13 and 14:

1. Open System Settings > Privacy & Security.
2. Scroll to the message that system software was blocked from loading, and click Allow (or Details…).
3. Select Covalence HBNS and Covalence DNS Proxy, and click OK.

Run systemextensionsctl list again to confirm both extensions show [activated enabled]. If either remains waiting, restart the Mac and check again.

Troubleshooting

Need help? If you need support with any of these steps, including updating your System Extension profile, contact Field Effect support through the Portal and we can assist.