NetWitness Endpoint on macOS

[SeanMcAdam]

It's his literally been years, & several versions where the macOS client will not install. Has anyone been able to get this working, & if so, how?

Thanks for any help you can provide.

[MichaelGotham · Accepted solution]

Sean,

What version of the agent are you using? The security controls added in  El Capitan did indeed break the agent install for 4.2 or older agents. However last January the agent was rewritten and released in 4.3 to address this. Please upgrade to at least 4.3 and advise. Thx

[MichaelGotham]

Also the 4.3+ agent supports all the way through High Sierra. 

[SeanMcAdam]

Sorry I forgot to include info on the environment. We are still running 4.2.0.2, so will have to work on getting that upgrade.

Thanks for your help on this issue.

[MichaelGotham]

I’d recommend going to 4.4.0.0 or 4.4.0.1 (when released sometime in the coming weeks). There are a significant number of improvements and fixes cumatively through 4.4. Also the agents in 4.4 are using WFP instead of TDI for the network monitor which can further help performance on machines with a high number of network connections (domain controllers, file servers, web servers, etc.)

Make sure to upgrade all your agents to the latest version too!

[SeanMcAdam]

That's great. Thanks for the tips on the updates.