Palo Alto Traps For Mac is not like a standard application.
Here is where the Palo Alto Traps For Mac installs on the local computer:
However within Traps for Mac Client Agent, there are no static/local configurations. The specific location where there are configurations which is in config folder is synced with the Palo Alto Server that manages the client. So if you are updating these xml files, it will get over written when the Traps client checks in with the server. The only configurations that you can edit during installation time is the Palo Alto Traps Server address Traps Client should initially connect (server.xml) to which is located in the install zip file provided by the person that manage your Palo Alto Servers:
Thought I would add to my original response since I had to make documentation for my company on how to build this installer:
Prerequisites
- Traps for Mac Installer from console. Usually comes in a ZIP file.
- Custom XML file provided by Traps Administrator with organization server addresses in xml format
Process
1. Place Traps installer, .version, xml file in a folder named Traps_macOS_installer and move folder to a temporary location on your computer. I usually use /tmp (/private/tmp). This way it will be removed at next restart.
2. Open Composer.
3. Create a new package by dragging and droping the Traps folder located in your temporary location into composer.
4. Go to the Scripts folder within your new Traps Source Package in Composer and create a postinstall script.
- Enter the following as shown in screenshot:
#!/bin/sh
## postinstall
wait 10
/usr/sbin/installer -allowUntrusted -pkg /private/tmp/Traps_macOS_installer/Traps.pkg -target /
exit 05. Build as PKG file since you have setup the postinstall script other wise the script will be stripped from the compiled installer/dmg.
Note: As long as you keep the Traps_macOS_installer consistant and all the file names are the same then you will just need to updated the .version file and traps.pkg file and recompile.
Oh wow, I came to this page after googling for Jamf palo alto traps and i was the OP.....
I managed to get it working and just couldnt remember this thread...
Here how i got it working.
FYI, this is for the Cloud version and should be the same as ESM Version.
Composer - Put the Installer under /Users/Shared
Post install Script
#!/bin/bash logFile="/Users/Shared/Traps_Install.log"Check for Log file
if [ -f $logFile ]; then echo "$(date)" >> $logFile echo "Log Present" >> $logFile else touch $logFile echo "$(date)" >> $logFile echo "Log file Created" >> $logFile fiInstall the package
echo "Installing Traps Package..." >> $logFile /usr/sbin/installer -pkg "/Users/Shared/TRAPS_Cloud_Agent_macOS_6_1.0/Traps.pkg" -target / echo "Package installed..." >> $logFileLaunch Traps Service
echo "launch Traps plist..." >> $logFile sudo launchctl load /Library/LaunchDaemons/com.paloaltonetworks.trapsd.plistRemove installer file
sudo rm -rf "/Users/Shared/TRAPS_Cloud_Agent_macOS_6_1.0" echo "deleting Traps folder" echo "complete" >> $logFile
My Policy
Extension Attribute
#!/bin/bash if [ -f /Library/Application Support/PaloAltoNetworks/Traps/version.txt ]; then version=$(cat /Library/Application Support/PaloAltoNetworks/Traps/version.txt | tail -1) echo "<result>$version</result>" else echo "<result>Not Installed</result>" fi
Hi, just wanted to post in this thread to see if anyone was able to resolve the issue when deploying (using Matin's steps of making a custom package in Composer) and getting a System Extension blocked pop-up for Security & Privacy. It pops up and but still allows the install to take place. What am I doing wrong that causes the pop-up?
I have the below Configuration Profile payload for Approved Kernel Extensions that is pushed before I run the policy to install the software.
Approved Team ID
DISPLAY NAME
Palo Alto Traps
TEAM ID
PXPZ95SK77
Approved Kernel Extensions(Optional) Approve the following bundle IDs only
DISPLAY NAME KERNEL EXTENSION BUNDLE ID
com.paloaltonetworks.GlobalProtect.gplock
com.paloaltonetworks.GlobalProtect.gpsplit
com.paloaltonetworks.traps-agent
com.paloaltonetworks.kext.pangpd
com.paloaltonetworks.driver.kproc-ctrl
@villap5 I only have the Team ID entered. I don't have anything listed under the Optional Bundle IDs. The Bundle IDs, I believe, would only allow those particular things. I've added a screenshot of my Config Profile.
