EDR Release 3.7.1
June 10, 2025
EDR Onboarding for Mac
EDR onboarding is now supported for Mac-based assets, expanding protection to macOS devices. You can onboard Intel-based and Apple Silicon (ARM) Macs through the standard onboarding workflow and deploy the EDR agent directly.
This enhancement extends detection and response capabilities across a broader range of operating systems, enabling unified monitoring and response within your environment. Once onboarded, EDR events, detections, and telemetry from Mac assets are fully integrated and visible in the EDR UI.
Supported macOS Versions for ARM and Intel Macs
The following table lists the supported macOS versions and EPP Status.
| macOS Version | Code Name | EPP Status |
| 15.x | Sequoia | Supported |
| 14.x | Sonoma | Supported |
Supported Hardware Requirements for ARM and Intel Macs
The following table lists the supported hardware requirements.
| Mac Cloud Agent Version | CPU | Memory | Disk Space |
| 6.1.0 (ARM) | 8 Core Processor | 8GB RAM | 1024 MB |
| 6.0.0 (Intel) | 8 Core Processor | 8GB RAM | 1024 MB |
Supported Software Requirements for ARM and Intel Macs
The following table lists the supported software requirements.
| Root Access | Mac Agent requires sudo or root access. |
| SIP enabled Systems | The system should be SIP [System Integrity Protection] enabled. |
Onboarding Steps
Follow these steps to get onboarded in the Cloud Agent application:
- Create a new configuration profile.
- Go to Activations Keys > New Keys.
- Go to Configuration tab and download the cloud agent.
For full instructions, see EDR Onboarding for Mac.
New Permissions Added to EDR Roles in UI Access
As part of this release, we have introduced the following new UI Access permissions to enhance fine-grained access control.
| Category | Permission | Description |
| Remediation Permissions | Remediation View | Grants access to the Remediation tab. Without this permission, the tab is hidden from the UI. |
| Notification Permissions | Notifications View | Grants access to the Notifications tab. Without this permission, the tab is hidden in the UI. |
| EDR Permissions | Saved Searches View | Grants visibility and access to saved searches on all Data List pages within the EDR module. Without this permission, saved searches will not be visible. |
| EDR Antimalware Profile Permissions | EDR Antimalware Set Up | Grants visibility of the Antimalware Setup button in the EDR Antimalware interface. Without this permission, the button is disabled in the UI. |
| EDR Sandbox-RFC Permissions | Asset Exclusions View |
Grants access to the View tab. You must also have either Sandbox View or RFC View permission selected. If none of these supporting permissions are selected, the tab is hidden from the UI. |
| EDR Antimalware Profile Permissions | EDR Antimalware Custom Scan | This permission is sufficient to initiate an asset scan. Without this permission, the Scan Now option is disabled in the UI. |
Renamed 'Notifications' to 'Local Desktop Notifications'
The UI toggle previously labeled Notifications has been renamed Local Desktop Notifications to better reflect its purpose.
Updated EDR Status Information
We have simplified the EDR Status column by removing date and time details. The status will now only display Active, Inactive, or Disabled states to reduce confusion and better reflect the current state.
