Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Authorizing the Apex One (Mac) XDR Sensor

    • Updated:
    • 12 May 2021
    • Product/Version:
    • Apex One (Mac)
    • Platform:

XDR Sensor uses a different bundle identifier from Apex One (Mac) and is needed when Endpoint Sensor is enabled. This article discusses how to authorize the sensor to ensure proper functionality.


Components that should be enabled

The following components should be enabled for XDR Sensor:

  • System Pop-up – Opens automatically and prompts users to allow the extension to be loaded.
  • Kernel Extension – From macOS10.13 to macOS10.15 require user approval before loading new, third-party kernel extensions. Apex One (Mac) uses kernel extensions for the real-time protection features.
  • System Extension - Starting from macOS Big Sur, Kernel Extension will not be loaded by the system. To comply with changes to the Apple guidelines for software developers, we have updated our Endpoint Security and Network Extension frameworks.

  • Web Content Filter: An on-device network content filter examines user network content as it passes through the network stack and determines if that content should be blocked or allowed to pass on to its final destination.

    Reference: Apple Developer Documentation on Content Filter Providers

  • Full Disk Access: Full Disk Access permission is a privacy feature introduced in macOS Mojave (10.14) that prevents some applications from accessing your important data, such as Mail, Messages, TimeMachine, and Safari files. This means you need to manually grant permission for certain applications to access these protected areas of your Mac. In earlier versions of macOS (10.13 and lower), this permission is automatically granted during installation of your product.

    If Full Disk Access is not enabled, your product is unable to scan all areas of your Mac. This means Apex one for Mac cannot fully protect your Mac against malware and other network security threats, and product can only scan a limited portion of your system folders and hard drive, potentially resulting in unnecessary clutter remaining on your Mac.

Enabling XDR Sensor

The following is a detailed guide on how to enable the XDR Sensor on a machine with macOS Big Sur:

  1. The System Extension Blocked pop-up window appears after enabling Endpoint Sensor.

    System Extension Blocked

  2. The Set Up Required Permissions prompt should appear. Click on Continue.

    Set Up Required Permissions prompt

  3. Follow the steps on the prompt to allow System Extension.

    follow steps to allow System Extension

  4. Follow the steps on the next prompt to Allow Full Disk Access.

    follow steps to allow Full Disk Access

  5. Once steps have been successfully completed, the prompt “Endpoint sensor enabled successfully” should be shown.

    Endpoint sensor enabled successfully

Apex One (Mac) Endpoint Sensor supports macOS Big Sur, macOS Catalina, macOS Mojave and macOS High Sierra.

This can be deployed via an MDM Solution (Jamf Now). Refer to the KB article: Enabling Apex One (Mac) Permissions via JAMF Now.

Solution Id:
Did this article help you?

Thank you for your feedback!

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.