Deploying Coro on macOS devices

This guide describes the process for deploying the Coro Agent to macOS devices.

Prerequisites and system requirements

Before you begin, make sure your macOS device meets the following prerequisites:

Coro Security Platform utilizes a Bitdefender Software Development Kit (SDK). To avoid conflicts that may interfere with the installation of the Coro Agent, Bitdefender and any other antivirus software based on Bitdefender must be uninstalled prior to installing the Coro Agent.
macOS devices must meet the minimum specifications .
You must have administrative permissions to install applications on your macOS device.

Deployment options

Install the Coro Agent through one of the processes described below:

Self-install on single devices : An admin user provides specific users with an installer link via email. Users select the link and follow the on-screen instructions to install the software on their devices.

Mass deployment : An admin user downloads the Agent installer package and deploys it across all devices using a mass deployment tool.

Coro provides a number of articles covering mass deployment scenarios. To learn more:

Note

While deploying the Coro Agent to macOS devices, end users typically receive a pop-up warning requesting confirmation to allow or not allow the Coro Agent to filter network content:

Filter Network Content confirmation dialog

This warning is a security feature included with macOS and applies to all apps installed on the device that require such access. If you are deploying the Coro Agent via MDM tools to one or more devices and want to provide a silent installation, use the following configuration to automatically allow this component and bypass the warning:

Expand for configuration listing

Copy

Copied

<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1">
    <dict>
        <key>PayloadUUID</key>
        <string>7E53AC50-B88D-4132-99B6-29F7974EAA3C</string>
        <key>PayloadType</key>
        <string>Configuration</string>
        <key>PayloadOrganization</key>
        <string>Coronet Cyber Security</string>
        <key>PayloadIdentifier</key>
        <string>7E53AC50-B88D-4132-99B6-29F7974EAA3C</string>
        <key>PayloadDisplayName</key>
        <string>Coro System Extensions</string>
        <key>PayloadDescription</key>
        <string/>
        <key>PayloadVersion</key>
        <integer>1</integer>
        <key>PayloadEnabled</key>
        <true/>
        <key>PayloadScope</key>
        <string>System</string>
        <key>PayloadContent</key>
        <array>
            <dict>
                <key>PayloadUUID</key>
                <string>2BA070D9-2233-4827-AFC1-1F44C8C8E527</string>
                <key>PayloadType</key>
                <string>com.apple.webcontent-filter</string>
                <key>PayloadOrganization</key>
                <string>Coronet Cyber Security</string>
                <key>PayloadIdentifier</key>
                <string>CEBF7A71-D9A1-48BD-8CCF-BD9D18EC155A</string>
                <key>PayloadDisplayName</key>
                <string>Approved Network Extension</string>
                <key>PayloadDescription</key>
                <string/>
                <key>PayloadVersion</key>
                <integer>1</integer>
                <key>PayloadEnabled</key>
                <true/>
                <key>FilterType</key>
                <string>Plugin</string>
                <key>UserDefinedName</key>
                <string>Coro Network Extension</string>
                <key>PluginBundleID</key>
                <string>net.coro.endsec.Coro</string>
                <key>FilterSockets</key>
                <true/>
                <key>FilterDataProviderBundleIdentifier</key>
                <string>net.coro.endsec.TrafficService</string>
                <key>FilterDataProviderDesignatedRequirement</key>
                <string>identifier &quot;net.coro.endsec.TrafficService&quot; and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = E3P52EVK39</string>
            </dict>
        </array>
    </dict>
</plist>

Save this configuration to a file on your local workstation. This file can then be used on any MDM platform that supports custom policies. Refer to your MDM platform for specific instructions on deploying custom policies.

Downloading and installing the Agent

Admin users with sufficient permissions download the Agent from the Agent Deployment tab on the Control Panel > Devices page:

macOS Agent list

The Channel column on the Coro Agent deployment list categorizes each available version of the Agent based on its current stage within the Agent release lifecycle as follows:

Release Stage	Description
Beta	The initial development and promotion phase of the Agent.
Release Candidate	Quality assurance testing starts, followed by the initial internal deployment of the Agent.
Gradual Rollout	Incremental update rollout starts for the stable Agent. Coro gradually rolls out new Agent versions to all customers.
General Availability	The incremental rollout concludes, and the Agent is fully released to all Coro protected users.

The All channels option allows admin users to select which release channels are allowed in the workspace:

All channels

The following options are available:

Stable release channels : Only Gradual Rollout and General Availability release channels are allowed in the workspace.
All release channels : All release channels are allowed in the workspace.

Show release channels

To download and install (or upgrade) the Coro Agent:

Sign into the Coro console .
Select Control Panel :
Select Devices > Agent Deployment .
Scroll to the macOS section:
Select ACTIONS for the version you want to install:

Choose from the following actions:
- Obtain a download link URL for the Agent installer:
  1. Select Copy link .
    A Copy Download Link dialog is displayed, which contains a URL link to the Agent installation file:
  2. Select COPY .
    The download link is copied to your clipboard.
  3. Paste the link into a web browser and follow the instructions to install.
  note
  Admin users can distribute this link to endpoint device users for direct installation of the Agent. Additionally, you can use the same link for mass deployment tools.
- Download the installer file:
  1. Select Download .
    The Agent installation file is downloaded to your local device.
    
    warning
    Do not rename the downloaded Agent installation file.
  2. After the download is complete, open the installation file and follow the instructions to install.

After the installation is complete, depending on the security posture of your macOS device, the Agent may require additional Privacy & Security settings enabled. This is identified by the Coro Agent notification:

macOS agent notification

note

If you are installing on macOS 14 or earlier, see Deploying Coro Agent on macOS 14.

If you are installing on macOS 15, see Deploying Coro Agent on macOS 15.

Deploying Coro Agent on macOS 14

If you are installing on macOS 14 or earlier, you may need to set additional settings. For example, macOS can require you to explicitly allow the Coro Endpoint Protection app to function.

Select Apple > System Settings > Privacy & Security > Security. In Allow applications from, select App store & identified developers, and then for System software from application Coro Endpoint Protection.app was blocked from loading, select Allow:

macOS privacy and security settings

In addition, macOS may block the Coro Agent from access to data on your device hard disk:

macOS full disk access

Select Apple > System Settings > Privacy & Security > Full Disk Access, and then select CoroService.

After the installation and security configuration is complete, the Agent may download additional updates:

Updates Banner

After the installation and update process is complete, you can view the Agent settings and notifications by opening the Agent from the macOS menu bar:

Agent Icon

note

After the installation is complete, ensure you disable any firewall rules that may interfere with Coro Agent connectivity.

Deploying Coro Agent on macOS 15

note

During the setup wizard, two system extension prompts appear in quick succession. If you have not enabled the first setting before selecting Open System Settings in the second prompt, both might disappear without directing you to the correct setting. Full instructions for locating both settings are included in this article.

For macOS 15, ignore the instructions provided in the Coro Agent.

If you are installing the Agent on macOS 15, you may need to explicitly turn on the following settings:

Enabling Network Extensions
Enabling Endpoint Protection
Enabling Full Disk Access

Enabling Network Extensions

Select Apple > System Settings > Privacy & Security > General > Login Items & Extensions . Select adjacent to Network Extensions .
Turn on Coro Endpoint Protection :
Enter your macOS password to validate your identity.
When prompted to allow Coro Endpoint Protection to filter network content, select Allow .
Select Done .

Enabling Endpoint Protection

Select Apple > System Settings > Privacy & Security > General > Login Items & Extensions .
Locate Endpoint Security Extensions and select adjacent to Endpoint Security Extensions .
Turn on Coronet Cyber Security Ltd :
Enter your macOS password to validate your identity.
Select Done .

Enabling Full Disk Access

Select Apple > System Settings > Privacy & Security > Full Disk Access .
Locate and turn on Coro Endpoint Protection and CoroService :

note

After the installation is complete, ensure you disable any firewall rules that may interfere with Coro Agent connectivity.