This advisory describes the changes and steps administrators can take to deploy Mac Connector 1.14.

Mac Connector version 1.14 introduces a number of changes that require user attention. Most notably, this Connector release includes changes to full disk access approvals and adds support for macOS 11 (Big Sur) System Extensions.
Since the inital 1.14 launch, compatibility issues have been discovered with 3rd party applications on macOS 10.15 Catalina when system extensions are in use. Apple will be addressing these issues in future releases of macOS 11 but will not be fixing these issues in macOS 10.15. Consequently, starting with version 1.14.1, the Mac Connector will use legacy kernel extensions instead of system extensions on all versions of macOS 10.15.
Mac Connector 1.14 is required to ensure endpoint protection on macOS 11. Older Mac Connectors will not work on this version of macOS.
It is highly recommended to deploy the Mac Connector with an MDM profile that grants the required approvals. MDM profiles must be installed before installing or upgrading the Mac Connector to ensure the needed permissions are recognized. Refer to the Known Issues section later in this document if MDM cannot be used.

Minimum OS Requirements

Empia Software Macos 10.15 Version

MacOS Catalina (version 10.15) is the sixteenth major release of macOS, Apple Inc.' S desktop operating system for Macintosh computers. It is the successor to macOS Mojave and was announced at WWDC 2019 on June 3, 2019 and released to the public on October 7, 2019. Nov 01, 2019 Way 1: Apple menu → System Preferences → Software Update Choose Apple menu on your Mac, then choose System Preferences. Then click Software Update and Hit on the Update Now button next to the macOS 10.15 Update. After you do this, an installer will appear in span of a few seconds. BT1120 interface out only preview funtion EM28283 / EM28284 support Mac 10.67 OS (Option) and Linux (Option) Support Windows 32 / 64 bit platform. JMP 15; JMP Pro, Version 15; OS: macOS Big Sur (11.0, JMP 15.2 and above) macOS Catalina (10.15) macOS Mojave (10.14) macOS High Sierra (10.13) macOS Sierra (10.12) RAM.: 4 GB or more recommended: Drive Space: 600 MB: Database: UNICODE compliant ODBC 3.5 or higher (required only if connecting to database) Other Compatible Software (not required.

AMP for Endpoints Mac Connector 1.14.0 supports the following macOS versions:

macOS 11, using macOS system extensions.
macOS 10.15.5 and later, using macOS system extensions.
macOS 10.15.0 through macOS 10.15.4, using macOS kernel extensions
macOS 10.14, using macOS kernel extensions.

AMP for Endpoints Mac Connector 1.14.1 supports the following macOS versions:

macOS 11, using macOS system extensions.
macOS 10.15 using macOS kernel extensions.
macOS 10.14, using macOS kernel extensions.

For deployments that include endpoints running older macOS versions, consult the OS Compatibility Table for compatible Mac Connector versions.

Important Changes

Mac Connector 1.14 introduces important changes in three areas:

Empia Software Macos 10.15 Version Download

Approving AMP macOS Extensions to load
Full Disk Access
New Directory Structure

Approving Mac Connector macOS Extensions

The Mac Connector uses either System Extensions or legacy Kernel Extensions to monitor system activities, depending on the macOS version. On macOS 11, System Extensions replace the legacy Kernel Extensions that are unsupported in macOS 11. User approval is required on all versions of macOS before either type of extension is allowed to run. Without approval, certain Connector functions such as on-access file scan and network access monitoring will be unavailable.

Mac Connector 1.14 introduces two new macOS system extensions:

An Endpoint Security extension, named AMP Security Extension, to monitor system events
A Network Content Filter extension, named AMP Network Extension, to monitor network access

The two legacy Kernel Extensions, ampfileop.kext and ampnetworkflow.kext, are included for backwards compatibility on older macOS versions that don't support the new macOS System Extensions.

The following approvals are required for macOS 11** and later:

Approve AMP Security Extension to load
Approve AMP Network Extension to load
Allow AMP Network Extension to filter network content

** Mac Connector version 1.14.0 also required these approvals on macOS 10.15. These approvals are no longer required on macOS 10.15 when running Mac Connector 1.14.1 or later.

The following approvals are required for macOS 10.14 and macOS 10.15:

Approve AMP Kernel Extensions to load

These approvals can be granted using the macOS Security & Privacy Preferences on the endpoint, or by using Mobile Device Management (MDM) profiles.

Approving Mac Connector macOS Extensions at the Endpoint

System and Kernel extensions can be approved manually from the macOS Security & Privacy Preferences pane.

Approving Mac Connector macOS Extensions using MDM

NOTE: macOS Extensions cannot be retroactively approved via MDM. If the MDM profile is not deployed prior to installing the Connector then the approvals will not be granted and additional intervention will be required in one of the following forms:

1. Manual approval of the macOS Extensions on endpoints that had the management profile deployed retroactively.
2. Upgrading the Mac Connector to a newer version than the one currently deployed. Endpoints that had themanagement profile deployed retroactively will recognize the management profile after upgrade and gain approval once the upgrade completes.

AMP extensions can be approved using a management profile with the following payloads and properties:

Payload	Property	Value
SystemExtensions	AllowedSystemExtensions	com.cisco.endpoint.svc.securityextension, com.cisco.endpoint.svc.networkextension
	AllowedSystemExtensionTypes	EndpointSecurityExtension, NetworkExtension
	AllowedTeamIdentifiers	DE8Y96K9QP
SystemPolicyKernelExtensions	AllowedKernelExtensions	com.cisco.amp.fileop, com.cisco.amp.nke
SystemPolicyKernelExtensions	AllowedTeamIdentifiers	TDNYQP7VRK
WebContentFilter	AutoFilterEnabled	false
	FilterDataProviderBundleIdentifier	com.cisco.endpoint.svc.networkextension
	FilterDataProviderDesignatedRequirement	anchor apple generic and identifier 'com.cisco.endpoint.svc.networkextension' and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists / or certificate 1[field.1.2.840.113635.100.6.2.6] / exists / and certificate leaf[field.1.2.840.113635.100.6.1.13] / exists */ and certificate leaf[subject.OU] = DE8Y96K9QP)
	FilterGrade	firewall
	FilterBrowsers	false
	FilterPackets	false
	FilterSockets	true
	PluginBundleID	com.cisco.endpoint.svc
	UserDefinedName	AMP Network Extension

Full Disk Access

MacOS 10.14 and later require approval before an application can access parts of the filesystem that contain personal user data (e.g. Contacts, Photos, Calendar, and other applications). Certain Connector functions such as on-access file scan will be unable to scan these files for threats without approval.

Previous Mac Connector versions required the user to grant Full Disk Access to the ampdaemon program. Mac Connector 1.14 requires Full Disk Access for:

'AMP for Endpoints Service' and
'AMP Security Extension'

The ampdaemon program no longer requires Full Disk Access starting with this new Mac Connector version.

Full Disk Access approvals can be granted using the macOS Security & Privacy Preferences on the endpoint, or by using Mobile Device Management (MDM) profiles.