Quick question. Would this script work to upgrade from different versions? Say going from 1.7.0 to current?

This discussion was brought to my attention by AMP team so I wanted to share the gist of how we install AMP via Jamf internally at Cisco.

ciscoAMPPath="/Applications/Cisco AMP/AMP for Endpoints Connector.app/Contents/Info.plist"

redirectingURL="https://console.amp.cisco.com/install_packages/REDACTED/download?product=MacProduct"

localInstallerVolume="/Volumes/ampmac_connector"

localInstallerPackage="ciscoampmac_connector.pkg"

tmpFolder="/Library/CiscoIT/tmp"



checkAndGetURLs()

{

dmgURL=$(curl --head "$redirectingURL" | grep "Location:" | awk '{print $2}')

if [[ -z $dmgURL ]]

  then

    writeLog "Unable to retrieve DMG url. Exiting..."

    exit 1

fi



writeLog "DMG URL found. Continuing..."



dmgFile=$(basename "$(echo $dmgURL | awk -F '?' '{print $1}')")

dmgName=$(writeLog "${dmgFile%.*}")

}



downloadInstaller()

{

mkdir -p "$tmpFolder"

writeLog "Downloading $dmgFile..."

/usr/bin/curl -L -s "$redirectingURL" -o "$tmpFolder"/"$dmgFile" --location-trusted

}



installPackage()

{

if [[ -e "$tmpFolder"/"$dmgFile" ]]

  then

    hdiutil mount "$tmpFolder"/"$dmgFile" -nobrowse -quiet

    if [[ -e "$localInstallerVolume"/"$localInstallerPackage" ]]

      then

        writeLog "$localInstallerPackage found. Installing..."

        /usr/sbin/installer -pkg "$localInstallerVolume"/"$localInstallerPackage" -target /

        if [[ $(echo $?) -gt 0  ]]

          then

            writeLog "Installer encountered error. Exiting..."

            hdiutil unmount "$localInstallerVolume"

            rm -f "$tmpFolder"/"$dmgFile"

            exit 1

          else

            writeLog "Successfully installed "$localInstallerPackage". Exiting..."

            hdiutil unmount "$localInstallerVolume"

            rm -f "$tmpFolder"/"$dmgFile"

            exit 0

        fi

    fi

  else

    writeLog "$dmgFile failed to download. Exiting..."

    exit 1

fi

}

Essentially, we download the latest DMG directly from the AMP console, mount it, and run the PKG installer from the mounted DMG. That's it. We've used this method on over 50K machines all properly reporting into the AMP console. No need to update and repackage when new versions are released.

Hi iJake, 

How does Cisco deploy the PPPC and Approved Kernel Extensions via Jamf? 

I'm trying to do this on Big Sur with AMP v1.16 and it seem things have changed from Catalina.  

It's all documented here: https://www.cisco.com/c/en/us/support/docs/security/amp-endpoints/216089-advisory-for-amp-for-endpoints-mac-conne.html

@Echterling This is what my configuration profile looks like. My deployment is based on this post and its working fine.

Could someone check my work and see if I've built these correctly? 

I'm still getting the "requests to allow" prompts in security and privacy when installing it.

Also, any suggestion on how to push the config for full disk access?

macOS Big Sur 

Cisco Amp v1.16.0841

Could someone check my work and see if I've built these correctly? 

I'm still getting the "requests to allow" prompts in security and privacy when installing it.

Also, any suggestion on how to push the config for full disk access?

macOS Big Sur 

Cisco Amp v1.16.0841

@winterboerHere are my profiles, all separate for scoping.  These work for us, provided they are installed to Big Sur and the system rebooted before Cisco AMP is installed.  Note, Kernel extensions aren't scoped to Big Sur.

Observation:

when installing AMP 1.16.1 via @iJake 's script on MacOS Monterey (last Beta before release: Build 21A5552a), the standard script kept failing with the latest URL. It worked fine in a browser though.

When running the script manually, I kept getting the "Unable to retrieve DMG url. Exiting..." error. So after changing the script a little and changing the download URL in the policy, doing the following made it work:

1. removed the "?product=MacProduct" part of the download URL as provided by Cisco's console. Not sure why this made it work...

2. changed the case of the 'L' of "Location" to lowercase so that it shows:

dmgURL=$(curl --head "$redirectingURL" | grep "location:" | awk '{print $2}')

This worked because it seems as if the http headers return 'location:' and not 'Location:' which the script looks for with grep. I assume there's a grep switch to ignore case, but my script-foo is weak, so just got it working and rolling with it for now until some script guru can come up with a proper fix 🙂

Hope this helps if anyone else comes across this issue

@tsylwest the syntax you’re looking for is grep -i “string” That turns on grep’s case insensitivity mode. 

Observation:

when installing AMP 1.16.1 via @iJake 's script on MacOS Monterey (last Beta before release: Build 21A5552a), the standard script kept failing with the latest URL. It worked fine in a browser though.

When running the script manually, I kept getting the "Unable to retrieve DMG url. Exiting..." error. So after changing the script a little and changing the download URL in the policy, doing the following made it work:

1. removed the "?product=MacProduct" part of the download URL as provided by Cisco's console. Not sure why this made it work...

2. changed the case of the 'L' of "Location" to lowercase so that it shows:

dmgURL=$(curl --head "$redirectingURL" | grep "location:" | awk '{print $2}')

This worked because it seems as if the http headers return 'location:' and not 'Location:' which the script looks for with grep. I assume there's a grep switch to ignore case, but my script-foo is weak, so just got it working and rolling with it for now until some script guru can come up with a proper fix 🙂

Hope this helps if anyone else comes across this issue

I guess I don't know how to use the script that @iJake has kindly offered up. I've loaded it up in jamf and see this.  What am I missing or doing wrong?

@winterboerMight want to remove your AMP URL from that photo. Might not. 😉  Your download works, I see it's 32 MB.  I'm deploying 1.15.6.842 (29.2 MB) tested and still working this morning.  Perhaps something has changed with a newer version?

Also, as noted above, Location changed to location (which I edited in my script).  Perhaps you just need to add a -i to the grep command.

++grep Location: to ++grep -i Location:

Line 13 in my script:

dmgURL=$(curl --head "$redirectingURL" | grep -i "Location:" | awk '{print $2}')

@winterboerMight want to remove your AMP URL from that photo. Might not. 😉  Your download works, I see it's 32 MB.  I'm deploying 1.15.6.842 (29.2 MB) tested and still working this morning.  Perhaps something has changed with a newer version?

Also, as noted above, Location changed to location (which I edited in my script).  Perhaps you just need to add a -i to the grep command.

++grep Location: to ++grep -i Location:

Line 13 in my script:

dmgURL=$(curl --head "$redirectingURL" | grep -i "Location:" | awk '{print $2}')