Name: Office Hours | Forcepoint DLP Endpoint on MAC (NAM + EMEA)
Uploaded: 2026-05-07T16:16:43.769Z
Duration: 1 h 12 s
Description: Office Hours | Forcepoint DLP Endpoint on MAC (NAM + EMEA)

Transcript for "Office Hours | Forcepoint DLP Endpoint on MAC (NAM + EMEA)": Hello, everyone. Thank you for joining our Forcepoint office hours today. We're gonna be covering the Forcepoint DLP agent for Mac OS. If you are interested in our Windows session that we held in early April, I will also share that registration link for you. We'll give it just a few minutes here for everybody to join, and then we'll go ahead and get started. Alright. Giving another minute here. If you just joined us, thank you so much for joining our Forcepoint office hours today on the Forcepoint DLP agent for Mac OS. I did just post the link in the chat. If you are interested in watching the playback for the Windows session that we held held in early April. Give it just another couple minutes here and wait for folks to join, and then we'll get started. Alright. We're about two and a half minutes in, so let's go ahead and get started. And thank you again, everyone, for joining our Forcepoint office hours today. As a reminder, the presentation is available for download under the docs tab. Please make sure to use our Q and A tab for all questions, in the instead of the chat window. Always there for you, but definitely move them over into the Q and A. Towards the end of the session, we will launch a brief session survey. We do read and appreciate all of your feedback. We have any suggestions for office hour sessions in the future. And as always, an email will be sent tomorrow to watch the playback. Alright. So kicking us off today is John and he's gonna be walking us through our session. Hey. Hello. Hello. Hello. Can you guys hear me right? You're all good. Okay. Alright. Today's today's meeting will be about how to install the f one e endpoint in a Mac environment. And it's nothing very complicated, but we wanted to upgrade update our, how to so that you guys could review it in parallel with the manual. Don't forget that the manual that is being published with every f one e endpoint is the first source of truth, and it's always updated. But, anyways, come back to this, presentation later on if you need to just review the steps as we understand them. Right? There is a poll going on, in the polls, section. We are really eager to understand what is the population, of the MDM, solutions that is being used by our customers. So if you have, jail for, nothing or, I don't know, workspace one or something, let us know. It's very important for us. Right? So what we'll be talking today about? We'll be talking about how to create the DLP package, right, how to deploy it, what can be checked and verified after the deployment, what are the usual mistakes we see, in technical support, and then all kind of questions, during the open floor. So prepare your questions. Use the q and a, to put them there. We can discuss them. The I will have my colleagues, the team, answer those questions, in parallel with me, but we can also air them after that if we have some time. Alright? Okay. Let's move through the package creation. And that's, important. First of all, I would like to say that we have a lot of velocity in, development of the endpoint and the associated, components like, browser extension and so forth. So whenever you plan about installing or upgrading your endpoint, first, you have to do is to check the support metrics. Do not aim in upgrading your endpoint to an older version if there is a newer version present. In 99% of cases, the newer version is always better than the old one. The first, accent that we put is always, improving the existing functionality and adding on top only after that. So, for example, if we'll be talking we'll be talking today about extensions. And extensions in 2025 advanced a lot. So every month, we were publishing a new version. Yes. It was a little bit annoying, but during this year, the extensions matured a lot. So always check the support metrics. If you see that older versions are supported, that doesn't mean you have to install them. Right? Install the latest version, and, try to never use anything that is not into this grill. Because in most cases, if we remove it from here, it means that some part of the functionality might not be fully, supported by the operating system, by the browsers, by some security things. So if you don't see it here, that's a sign for you to move forward and upgrade to the very last version. One thing to say here is we do not have a direct matching between versions. It doesn't mean that, for example, for the version 26 endpoint, you must have a DLP, let's say, ten four specifically or ten five. The compatibility between endpoints and servers is broad. So you can have an older endpoint server or an older DLP. It can be version ten zero, ten one, whatever, ten five, and your endpoint of version 26, 25, even 24 will still be working. Right? Something else might not be working, but the compatibility between server versions will, will remain. It is forward and backward compatible, so you can have an older DLP if you are not ready to have it upgraded and still have the very last, latest endpoint, deployed in your environment and vice versa, of course. Let's go next. So just as an overview, right, what we wanna make sure we have before we go and install the endpoint. So first of all, we wanna make sure that our antiviruses or any other security software, monitoring software, scanning software has our folders excluded. That's important because the endpoint acts in very let's say, the endpoint analyzes all the very small transactions that you are doing in your system. That means Outlook, browser, networking, I don't know, USB, and so on. And it it's not, so excluding the AV is important, not just because the AV will block something, but because the AV can be keeping our, temporary and cache files busy by scanning them. It will scan the file. It will not block it. It will say the file is cool. You'll see nothing on the antivirus side. But on the endpoint side, because of that file being scanned at the same time when we need to access it, you might have a failed analysis. You might have a time out. You might have a problem. So, that's why it's very, very important whenever you prepare the architecture, prepare your environment, prepare the solution to always have the list of antivirus and security EDR software, all kind of that works on the files and services, to have the AV exclusions that we provide in our manual. And that would be the first step. The second very important thing is to not have file level or folder level encryption for the destination where our endpoint will be installed. We fully support the the, binary level, the disk level encryption, but not the file and folder. At least one endpoint server must be accessible via network, right, as soon as you install the endpoint. For the endpoint, to right away download the policies and update itself and know what to do. If you do not have the server install accessible let's say you have a VPN and the users are not used to use the VPN, and you installed the endpoint, but it never connected, there is a possibility that the user will feel sluggishness and slowness, and browsing won't be as smooth as expected. And that's all because the endpoint has no idea what it needs to enforce and how to work, and it's in a half, started state. So please always, whenever you deploy the endpoint, make sure that the IP that you put in the and we'll show it later. Right? In the endpoint configuration, the initial configuration IP or FKDN, it must be accessible as soon as possible by the endpoint after it gets installed. Be that on a VPN, be that on Internet, doesn't matter, but it must have access to have at least one policy download. Alright? Also, for macOS, if you're using Outlook, we can only analyze Outlook traffic if there is, our Outlook add in deployed, to these users. So before you deploy our endpoint, you wanna work with your Exchange admin to make sure they get the correct add in and have it deployed to correct users. After that, you will get the Outlook, protection right away as soon as you install the endpoint. If you do not deploy this add in and just have the endpoint installed, there will be no protection for Outlook for the time period. Don't forget that it takes to the exchange, for the exchange to synchronize across the the Outlooks. It takes hours sometimes sometimes, so be careful. Don't expect right away to appear in the Outlook. There are some prerequisites that must be done on the endpoint side and on the package side, let's say. And we'll go into details later, but that is about creating some pairs of certificates for the SSL identity. And just to make sure everyone is synced up, what this SSL identity is, we need a pair of certificates to encrypt the communication between our, microservices within the MAC, endpoint itself. And that is a, prerequisite. It's and I know we have a an early question about that. That is not something that we just want to have. That is one of the prerequisites coming from the Outlook, and then it just scaffolded, to some to everything else. So we must have this. We will need to have it. And there is another certificate pair that we'll be talking about, so called NP root CA. That is not the CACR that you see in the default install package. That's an additional certificate that is needed for us to be able to, perform, inline SSL analysis and use this certificate to encrypt the last mile of the communication starting from our endpoint towards the browser. I will talk into this into details later on. And, yeah, the the very last, but very important prerequisite is to have all your, gem for, let's say, MDM profiles ready and deployed on the Mac before you install the endpoint. It's a multitude of them. You see here, we have at least, like, six of them. It's very different from and we'll talk about it from Windows install, but all of them must be either manually, all these configurations done on the endpoint, or deployed via your MDM before you install the endpoint. Otherwise, the the endpoint won't be fully installed, or it will be installed fully but will be partially started, or it will be fully started, but it will not be, analyzing any traffic. So in any ways, it won't be working. Okay? I wanted to have a word about about, what's the why we have so many things to do in Mac installs, and we have none of them in Windows. Windows approach Windows software development approach, right, from the Windows from the Microsoft side is, totally different from, Apple side. Microsoft automated everything, and they gave us the possibility to perform all the needed, actions during the install process to not need any additional interventions in terms of, policies, profiles, GPOs, and so on. So in a very simple deployment, we don't need any GPOs at all. In a little bit more more customizable one, we might need one GPO policy for browser extensions, but that's all easy, smooth. On the Apple side, I'm sure, most I mean, most of you being Apple admins, you guys know that during the last, I don't know, three, five years, there were a lot of changes towards improving the security stance of of, macOS. And a lot of things that were acceptable before and were permitted for us to do to be done main automatically by the endpoint by the installer are now not permitted at the software at the OS level. So, for example, if before we were able to normally install certificates, trust these certificates, now we cannot do this. And that's why we have the the certificates profiles. Before, we didn't need the FDA full disk access settings. Now we need them. Before, we didn't need to, show the developer IDs in trust the background running, services. Now we need it, and now it's part as well of this profile. So a lot a lot of things changed during the years. And with every Apple deployment, they're creating stricter and stricter rules, which we have to pretty much, you know, obey. Right? So one of the latest one was, Safari extensions. If up until last year, we could just install the Safari extension, trust it, enable it automatically by by ourselves. Now since last year, the user must enable the Safari extension manually, and we would not be able to do it in any kind of automations before. Things have changed a little bit. We have Jamf now who is able to do this. But for what I know, other MDM, solutions still lack it. Okay? So that's why we have these many, profiles, and we'll be talking about them later on as well. Alright. Let's move next. Package building. It's easy. It's straightforward. We'll go through each of them, and we'll have screenshots for each of them as well. Okay. You will download you'll always download our endpoint only from one source, and that is the Forcepoint hub inside the endpoint DLP, page inside the DLP. You can when you open the endpoint DLP page, you will see the first point one endpoint, line, which is the endpoint itself. You will also possibly see older versions within same, year, a little bit lower. Like, for example, you may see twenty six zero two here. But when the next one will come up, you might still see twenty six zero five and twenty six zero two, lower. And the lower, you'll see a few, decryption tools. It's not something that you really need. Now we'll only concentrate on this one line, the download link for the, endpoint. Now when you download the endpoint when you download the endpoint, the first on the top left corner and by the way, Jennifer or or, Drasti, do you guys see my mouse pointing somewhere? You don't see. Right? I'm. yeah. I would like to have a pointer somewhere, but I don't know how to how to show it. Alright. Anyways, on the top left side, you see the default the default structure of the client folder inside data security. And this is where you wanna dump the extracted downloaded endpoint installer package just inside the client. What I observe a lot of people forget to do is they forget and that's in the manual, so I'm just letting you know. The WebSens e p classifier package, that is your analysis engine. If you don't update it, you will have a new endpoint, but with all the analysis logic and flows. Right? So what you wanna do when you download everything and put it in the client folder, you wanna take the WebSens CP classifier package zip and put it inside the o s space x o s x, folder. In the brand new environments, the o s six folder is not present, so you wanna create it. Create folder o s six and then move the Webex and CP classifier package in there. Now this is the only place where you can start the DLP, creation. If you will start the DLP install or creation in any other folder, let's say, in in downloads or outside the FSM server, you will end up with a nonworking endpoint. So and it it shouldn't actually give you the possibility to even select the DLP product. So, again, as a rule, you put it always in the client folder. You move the EP classifier package inside o six. Now you can double click the WebSense endpoint package builder, and you will see the screenshot on the left button that is giving you the option to select the products. As you can see, I already selected here the DLP endpoint. The thing is, by default, the selection is in the first row, which is Forcepoint web security endpoint. In most cases, you don't have this product, so you can, you can disable it, and you should disable it. Remove the check mark from the first option, and just select the first point DLP endpoint. The discussion about web security endpoints, PCEP, DCEP, is out, you know, out the scope of today's call. But for those who have hybrid solution and has the web security as well, then, yes, you can you should you must keep both, check marks. Okay? The next screen will give you another option, to select. It would be the operating system. I like to have everything synchronized across the environment, so I usually check mark Windows 64 bit and Mac at the same time, and I create the installer. And only after that, I, you know, even if I don't need the Windows installer today, but I know that I will have now the package of both of them ready whenever I need. So in this case, I just selected Mac to, showcase it. The below, part with the password, and password confirmation, that is your uninstall password, and that's your anti tampering password. You know we have the functionality of protecting our install folder and files from being tempered, changed. That is to protect the endpoint from being, you know, phished, from being disabled, things like that. So you always wanna have protect installation directory check mark. But if it's not very, you know, critical for you, I would propose you do not put here the passwords or you use some known default default, let's say, starting password that you will not forget about. And that will come important later on. I want you to know that you can manage your passwords from our FSM, from our server. Right? You whatever password you put here, it it can be, I don't know, 12345678. Right? If you download the policy successfully for the first time, whatever password is set on the server will be overwriting this default password here. And the server gives you possibility to update that password as as many times as you want. So all the password security is on that side. Here is initial protection. And in a lot of cases, I do not see the need to have this password enabled because, let's say, the admin who created the installer, installed it, and then he forgot the password or he didn't put the password down somewhere. And he did an error he has an error in the configuration, the endpoint doesn't update with the FSM. Now you have a problem that you have to solve in a nonstandard way because the lack of the password will not permit you to just uninstall the endpoint, Simply uninstall it. Right? You have to do some additional steps which you might not want to do. So, normally, I would suggest you keep it open here, and it will update from whatever you set up on the centralized on the FSM. But you can also have a password here, and your endpoint will be protected as soon as it gets installed. Alright. Let's go next. The next step is pretty much the set the the next screens. Here we have an interesting option, and we'll we'll be reading the screenshots left to right, top to down. Right? So the first screenshot permits you to, specify an active directory domain name, and there is a lot of confusion here. Let me try to explain. If your endpoint is not, connected associated with the Windows Active Directory, your endpoint will always be seen in your reports as host name dot local, and that would be its host name, instead of having, say, your your domain, in it, like, I don't know, force point slash and your host name. Now you have this option here to override how the host name is seen in the reports. So, for example, if you're here in default domain, we'll type force point, then instead of the domain being local in reports, you will see force point slash and the real host name of the endpoint. However, that is very important here. It does not help you to create rules with, with host names as a domain here. Okay? Because your MAC is not domain related. Whatever rules are domain based, they will not apply here. It's just a visual. Okay? It works a little bit differently for the web endpoints, but, again, that is, out of the scope of this call right now. Now, you also have the opportunity here to disable or enable, Firefox extensions. That is something you can do if you don't wanna have your extensions automatically, loaded, for example, for the Firefox or Safari because Chrome, anyways, is MDM, deployable. But don't forget that if you have MDM, it will overwrite. I would not mess with this. It shouldn't be a problem. All the extensions should be working normally. And if you are disabling them here, you're, by default, losing part of the functionality for a moment. I've for the next screen, we have interactive and stealth mode. Stealth mode means that you don't see the endpoint icon in the in in your notification area, in your tray area. You don't see, you can't open the user interface of the endpoint. You can see its status and so on. It's not helpful. I would usually recommend to have interactive installer, meaning that your the user will see that the endpoint is running. And let's say, this is now normal standard, and and I hardly see any use any customer to still be using the stealth mode. Okay. The next one is very important, and that's what I was talking about, the IP address and host name. Here, you will put the IP of your FSM or of any of your endpoint servers if you have multiple of them. You can use internal IP, external IP. You can use FQDN, anything that works for the endpoint to connect to that server. And it's very important that you, first confirm for yourself that your endpoint will be able to open this destination when it will be installed on the destination machine. Right? So, if your endpoint server does not have Internet access and only has, VPN access. Right? You wanna use the internal IP address or maybe some internal, FQDNs. However, if your endpoint servers are configured to go outside to the Internet, you wanna use your external IP address that you already routed towards it. Right? So be careful here what IP address you are placing. By default, it is the internal IP of your FSM, and that is not what you want in a lot of cases. So be careful. Save location should be easy. There's the pop up, on the bottom middle. There's the pop up that you'll see that everything is right. And on the right side bottom, that is the default view of the installer package, which is not ready to be deployed yet. This is the default view, and this is the default, list of files inside. But we wanna work with it and improve it before we go into any deployment and installment. So it's not fully functional at this point. Alright. We technically finished creating the package, the endpoint package using the installer. And now we wanna talk about that SSL identity I was thought I was describing before. So, again, for our endpoints to work, we need a pair of certificates. It would be a certificate and a key, that will be placed into the installer package. And the certificate also must be installed in the keychain and trusted. K? You can see here how to create the certificate. On the left side, you have the example of the certificate. Only the red the red, text can be changed. Everything else must stay in place. By the way, this is a selectable text. So, if the presentation is downloadable, you should be able to copy this text. It's downloadable. Right, Jennifer? We we should be able to I mean, the guys can can have this presentation at the end of the call. Yes. The presentation is available for download even right now under the. chat. tab. So so all the links that you see here, they are clickable. The the text here is downloadable. It's not a screenshot, so you should be able to copy it and use it for your needs. Only change the red text, and please follow the format. For example, it's important for the, for the C, which is the country to be a two letters thing. You and there's there are some other Apache standards here. You don't wanna space have spaces, things like that. Anyways, when you have this, created, you can save it as a local host config file. And if you run the command, on the right side from inside the folder where you have the config file, you will end up having the server PM and KPM. And in black, you can see how it looks like when you run the command and what the, what the outcome is, lower. Now these three these two files, server PM and KPM, they must be copied and placed into that, folder that we created earlier with, with the installer. So just copy it there. There is one step, step number four, and that is for Jamf specifically. I don't know for other MDMs, but I know that Jamf cannot work with PM files. So there is that bold command in the bottom that you have to run to generate a server dot der file that can be used in a Jamf policy for deployment of the certificates in the key chain and trusting it automatically so that you don't do it manually. K? The link below is the one that describes the full process from our installer manual install guide. Okay. Now that we created that pair of certificates, we have one more pair to create. And this pair is, this is the root CA or NP root CA certificate. By the way, what I didn't specify is that this process must be done only once. You don't need to do it with all of your endpoint installers. Do it once, back up the files, and reuse these files with all your newer versions, upgrades, and so on. So once you generated these files and let's go back one slide. Next time when you'll create your new installer, let's say twenty six zero five, 27, whatever, o two, and so on, when you'll create it, you go back to your backed up files, copy server PM, KPM, put it there, and you can reuse it. You can reuse it across your versions, across your, company, across your computers. It's just one pair that needs to be in all the installer packages. Okay? No need to recreate it every time. Same goes for this, pair of certificates. Create it once and, also, the same way, you you take both certificates, copy it, and put it in that folder that we created two steps ago. So how to create how to do this? On your Mac, inside the folder that we created and let me go back to slides. This this folder on the right bottom here where where we list all the files, you see there is a file called generate root CA in the middle. So the generate root CA is actually a binary, a macro a MAC binary that you must run-in your MAC to generate another pair of certificates. What you do, you and and that you can see in the on the right side, in the screenshot, with black background. You see that we are already inside the endpoint installer folder, and we run two commands. First one is CH mode. Well, in the screenshot, you see seven seven seven, but I would say CH mode plus six to make it executable, and then the generate root CA. They will make the generate root CA an executable binary. And lower, you just run it with a dot dash. And on the left side, you have the commands that can be copied as well. The screenshot shows you the outcome. You'll see the info lines, but that's pretty much all what you'll see. And as a as deliverables, you'll see f p n p d dot file and c a underscore c a c r file. So these two files, if you ran the generator inside the installer, they should already be into that big installer with all other files together. This pair is also reusable, and, you will use the underscore CACR in Jamf profiles to push it towards the, towards the MAC. Okay? Now with this, prepared and, again, you have the link where you can check it step by step how it needs to be done. With this prepared, this is the final view of your endpoint installer. As you see, you have underscore CACR that we just created. But lower, you have the default files that were generated by the installer. And then you can see FP and PD that that was created. Then you can see key PM that was created and server PM that was created. All these certificates, we placed here manually, to have a final, package. That is the package that you wanna deploy manually or using your MDM. Okay? If your package looks anyway different, you might wanna review it and, bring it to this, view. Okay. Now what are other prerequisites for a, successful install? And and don't forget that if you don't have some of these, some of the profiles below, you will still be able to install the endpoint, but the user will see some unneeded pop ups of the installer, and the installer might not be fully functional. So let's go and check. Now we have a few like I said, we have six, things that we would like to use MDM to deploy across the environment. The four the first and the most important one is the, oh, it's it's actually the third here. But okay. The first is the SSL identity. We talked about it. How to deploy it? You can see it in the link here. The c a c r underscore c a c r, we discussed it. There is a link here into how to deploy it using Jamf. Main PPC profile, that's the one of the most important profiles we have. Again, there is a link to to the page of the manual where it is. What it contains, it contains a list of things. It contains about four or five full disk access lines, so binaries that should be granted full disk access on your Mac. It also contains, some system extension permissions, some network filtering permissions, and it is lacking now accessibility settings, but I foresee it to be updated in the near future. They will also have some accessibility settings, in it as well. After you have this one, you still need to deploy your, browser extensions. For Chrome, there is a link into how to deploy Chrome. I wanna say that we will soon also be supporting edge, in Mac. It's not coming in the next release, but after that, I I I'm pretty sure it will be available, so this summer. And you'll be able to deploy, Edge extension the same way like you deploy the Chrome extension. And then you have to deploy your Outlook. Like I said, you need your Exchange admin for this, and the link here is for them. Okay. That is the pre prerequisites, and you have to have check marks on each of them to make sure that things are smoothly rolled out. I was talking about the that big PPC profile. Part of it is to have the full disk access. Now on the left side, you can see you have one, two, three, four. You have four binaries that need full disk access, and you can add them manually if you don't use any MDM, or you can have, it deployed using Jam for MDM. And Mac 26 MacOS 26 have a very big improvement from the visual, quality of life here is you can actually check that your MDM permissions were granted, not by looking into the profiles and reading it line by line, but by visually checking the full disk access. That's what you see in the screenshot here. Before, you would only see, items that were added manually. Now you also see the items added by the MDM, and you see here there is a signature saying that this setting has been configured by a profile, which is handy and, pretty visual. I think same goes for accessibility as well. There are a few details here. If you if you think that your your FDA wasn't fully applied, you can check it by running some of the commands to read the database and the MDM, override list. Okay? Alright. With this being discussed about, that's, the accessibilities, settings example. Like I said, at this point, the big PPC profile, I think, does not have these three lines with accessibility. So, normally, you would need to create your own PPC profile and add this, accessibility to it and deploy it separately. We are working toward improving our main one, so, hopefully, they will all be into one of them. But that's how your accessibility list should be looking should be should look like with a e server, ease daemon bundle, and WebSons endpoint helper in it being added manually or by the MDM. Now as you know, with the version 25, we twenty five zero nine, we, improved our notifications. If before, the notifications would have been in the bottom right corner in Mac, they are now using the Mac, default notification system, the native system. So all notifications in Mac now are in the top right corner. They're coming from all the applications, and we also starting using it. And to enable it, you see here the configuration that needs to be placed. It is part of the profile and an example of notification in the bottom, how it looks like. Okay. Now I said about deploying the Outlook add in, and there is a lot of confusion into how to do it and which add in to choose. With the changes that Microsoft have done to the Outlook itself, before it was a Java, let's say, Java based, application, like classic Outlook. The new Outlook is a web application based. It's like a browser, let's say, in the background. It uses the web view EXE in Windows and an analogy here in Mac. So before, in Windows even, we were able to, analyze all Outlook traffic without having an add in at all. But with the change towards the new add in now in Windows and in Mac at the same time, we need to have the add ins. There are different approaches to how to analyze all the new Outlook, data. And my let's say, the best scenario would be for your company to be strictly on one or the other version of the Outlook. And I really believe that the classic Outlook should be, going, away already, and new Outlook should be the default for companies. But you have two options here. The DLP office add in no max schedule means that you can use the classic Outlook, and you can use the new Outlook, both of them. But there is one caveat. The scheduled emails on Mac will not be, analyzed and sent. So if you are using scheduled emails, that's not the best option for you. In this case, you you has the other option. It has a totally different approach into how to analyze things. However, these APIs are not available in the classic Outlook. So if you only have new Outlook in your environment, I would strongly suggest you only use the second option. If you have classic and new Outlook, I would strongly suggest you use the first option. But there is the caveat of caveat of the scheduled sent, emails. Right? So that is the different bit difference between these two, Outlook add ins. Again, if you have classic and new Outlook, both of them, use the first one. If you have only new guaranteed, like, across the company, you have good knowledge, then you just take the second one. You have to talk to your, exchange admin, provide him this Outlook, this add in, and ask him to be pushed to the users who are, Mac users. K? There is one thing here, discussion here, and that's, just how things work. The new Outlook, starts using, links towards shared OneDrive file when sending bigger files. If you have this option enabled, then, there is a possibility that we'll not be able to analyze the file because there is no file being sent. It's just a link. So, you might wanna restrict this functionality in, in, exchange to avoid this kind of possible exfiltration. Okay. Browser extensions. Yeah. So we have the m v three, came early last year, and for during the whole year, we were improving it. We have a very good functioning Chrome based m v three. We have a very good functioning Firefox based, m v three extension. We are adding the Edge, extension to this. Like I said, during the summer summer, it should be, hopefully, released. You need Jamf deployment for Chrome. You cannot manually, deploy Chrome here. You need you must use the mobile config file with Jamf to deploy the extension. By the way, each of the extensions have different IDs. So if you wanna deploy, newer endpoint with newer extension, you have to go back to your, profile in Jamf and update the ID of the extension there, and then you'll swap the technically, swap the extensions. For Firefox, you don't need an MDM profile. It will automatically enable the extension. However, it will not be, automatically enforcing it for what I know. You can use a MDM profile, and that's, just normal m m v three approach to, force the enablement of the extension in Firefox. For Safari, until now, like I said, and starting from last year, you would need to have the user specifically enable to run on our extension, and we couldn't enforce it. We could just ask the user, have pop ups for the user saying that your extension is not enabled. Please enable. However, with the new Jamf, functionality, you can do it, without issues. The only thing I know, I think it's just for Jamf. Right? That's it about extensions, I think. Let's see what other slides we have because I think we are also in on time. Yeah. The issues we see and 90% of all the issues are missing certificates, not trusted certificates, wrong certificates. For example, you are reusing your server p m server CR in your Jamf. Your Jamf is still pushing the old servers here, but the admin created a new pair, and they don't match, and and it doesn't work. Or the same for your c underscore CACR. The Jamf is pushing an older CACR, but you don't have your FTNPD into your installer for that CR, so it doesn't match as well. And that's the biggest the bulk of the issues we see being reported. Not having the PPC profile with full disk access is also something that we see a lot, or the PPC profile not being, installed, before the install of the endpoint, not being pushed before the install of the endpoint. That's another thing we see. And what we also see is, the users usually update the endpoint but forget to update the extension ID in their in their browsers, in the Jamf, deployments to their to their Chrome. So they have a new endpoint but old extension. Pretty much these would be the the biggest challenges that we see in terms of nonworking endpoints, and and a lot of times, AV exclusions. If you have a very aggressive EDR on your machine, that's a recipe, so for for failure as well. Alright. Yeah. I think everyone already knows how to collect our logs. Please do not open cases without this, related to endpoints. There is pretty much nothing to discuss if the case is open saying that endpoint is not working and it's not doing something and not providing the logs. Do not provide just one log. We don't need one log. Usually, we need the old picture, and the old picture can come from, collecting the client info. That is our set of logs and configurations that we need. The process is simple. You open system settings. You scroll down until you find force point at the very bottom. You select it, and you save debug logs to desktop. Depending on the max speed and depending on how many processes you have going on, it may take, a few minutes for the process to finish. But after that, you'll see your, archive package on your desktop, and all you need is to just upload it to the case when opening the case. It will give us a pretty good picture. And in a lot of cases, we can come back with a resolution right away or at least be prepared for the call and not not, you know, use the first half an hour just checking the basics. Yeah. I wanted to talk about, two things that were introduced as functionality in the m v three browser extension. Be because of how the extension work, it has some JavaScript injections in the background that we don't see. But they can some from time to time, they can interfere with, the browser with the websites on inside the browser and the bomb, there. So, there are a few very specific issues that we observed. Some of the websites, if you have an interactive search button where you usually type, like, half a word and it right away gives you, you know, online results of whatever you search, If you type here, you may not get those results. That's one of the reported issues. And the other on very few websites, if you type something in forms, like, input, inside the website in a form, input fields. You can type type type, press submit, or save, or whatever, and things that were typed here would not be saved or would be submitted as empty. It's not common. It's not on all websites on some of them. We during the year, we improved the functionality a lot, so it's less and less. And twenty six zero two endpoint has very few of them. However, if you encounter this kind of functionality, you have two options. The default and the best option is to, is to change the engine behind the analysis on that website. So, for example, if you have a Salesforce website Salesforce based website and you have, field data input issues, you can always add this, here as a WebSocket approach, meaning that we will not be using Java injections here, and we will be going towards a different backup engine we have to analyze it in a smoother manner and less intrusive. And then in 99% of cases, the issues you see will go away. If this doesn't help or if you have destinations that are trusted and you don't actually need to analyze anything, for example, you have your corporate portals, and there is no need to analyze files being uploaded there because you expect them to be uploaded there. And you wanna lower the use of endpoint. You wanna lower possible timeouts. You wanna lower the false positives for these destinations. The best way, instead of doing that on the on the policy level, right, like excluding policy level your corporate destinations, the best way is to do it here, by using the EXT, approach, which is exclude. Whatever you put here, will not our extension at the browser level before any analysis, before any analytics will just be skipping it. And they will pretty much remove all the load related to this traffic for the endpoint, and the traffic will smoothly go. So if there are some unsolvable issues that you see that the issues cannot be solved with the WebSocket approach, you use the second option, and they will for sure solve it. Now, when this functionality was first thought about half a year ago in September, we had no, user interface in the DLP side, on the server side, to configure things. And without that, we were, choosing between two things. We could wait for another year until we have a new deploy a new, release of the DLP with new UI and new functionality so that you can have the endpoint and the DLP server with this functionality. They can configure things. Or we could reuse some older functional, and that's what we did here, and that's what we proposed to use. There is the improved detection functional that was used before with older extensions that is not used anymore. If you have anything there old from your old m v two extensions approach, you can surely delete it. It's not needed there. It's not used by the m v three anymore. But this, state can be used for the, for the new approach, for the web and e x t, approach described here. You have the links below. They show the user manual, how things can be done and configured and deployed and so on. A great functionality. So, please use it. Okay. I think we are done with slides, and, we are just a few minutes shy of the hour, Jennifer. Yeah. Absolutely. So we just got a question that came in. So if the macOS is upgraded, what will be the impact on the agent and its installation files of features? That's a great question. That's actually the question that, drives, a lot of our cases. So let's say this. You have an endpoint that you deployed in a year ago with an older macOS version 14, and you were sitting on Maxx four 14. You were updating it, Maxx 14 dot one, fourteen dot eight, whatever. And at some point, you decided you wanna move to macOS 26. Well, I would say first check our, compatibility metrics, my first web my first slide, and see if macOS 26 is compatible with that version of the endpoint that you have installed. Why? Because, like I said, Apple likes to add a lot of new functionality, and it will break like that as soon as you upgrade. Okay? So if, for example, you have a version 24 endpoint, let's say, twenty four zero six or something, and you upgrade to Mac OS 26, I'm pretty sure something will not be working. So, our my enterprise customers that I work with, they have most of them have the simple procedure of the Mac admins are checking the compatibility first with the DLP team, and DLP team says yes or no. You can go with full upgrade or no. Or maybe we need a test, machine to test things and so on. And the DLP team usually tests the the metrics for compatibility. In a lot of cases, the company will have to postpone the the deployment of the new OS if it's not tested to avoid big impacts across the company. Alright. So let's see. I think it's? a two. parter question coming in about the Jamf. I see the GIF. Yeah. I didn't touch it. Let me touch it now. So and by the way, what's the we have the polls. Right? What are the results? I will don't see a voting. I wanna I wanna see voting in the polls. Otherwise, I cannot help you guys. Okay? poll. K. If I had if if. you don't provide us if you don't provide us your feedback of what you are using, everyone will think that Jamf is the only and the best solution. Okay? So before, at some point, Jamf was indeed the standard to go for MDM deployments. And we have some resources that are versed in Jamf, to provide help and provide all these profiles. Right? As a software provider, we usually don't have to do this. And our approach a few years ago was here is your manual configurations. Here's how it should look when it's good. Whatever MDM you have, you do your job. You do your magic. You create your profiles yourself. Okay? Now because we can help on the Jamf side and we know that Jamf is pretty used, we are providing now by default these policies and these profiles. However, we do not provide them for all other MDMs, at least at this point. It's possible things will change in future. But at this point, the solution is you have an example on how it's done in Jamf. You can always read the PPC profiles using a profile reader, and you're just duplicating your MDM of choice. Or you can check our manual steps for postcodes. In the manual step, we'll say, full disk access. Put this, this, this, this in. And now that you know that and you have your expertise in your MDM solution, please go and create your own profiles in the MDM solution and confirm them with our manual steps. That's pretty much the the the answer here. And, again, we would like to provide back to our product, the real the field usage, the real feedbacks from the customers. And, if we see a lot of traction on other MDMs, we will most likely be I mean, it will be taken into consideration. Right? I still have that pull up for about just a little bit less than a minute here until the top of the hour. It looks like Microsoft Intune is the popular MDM, for this session. it is popular. Yes. It is getting popular. We see it a lot in, maybe smaller companies, in some, other companies as well. We see it we see it also a lot, and that's something, that's, you know, it's in the air. I don't have any ATAs. I don't have any commitments. I don't have anything in terms of how it will be in future. For now, I already explained what we have, and, we'll for sure be discussing the Intune and other options as well. Awesome. Well, we're right about fifteen seconds here before the session ends. Thank you all so much. I really appreciate everybody's time today and for joining us for our office hour session, and be on the lookout for more in the future. Thank you all so much. happy. Thank you.