---
title: Deploying probes on MacOS
description: Deploying probes on MacOS
---

[Skip to content](https://support.preludesecurity.com/docs/macos#main-content)

English

Show submenu for translations

[Contact support](https://support.preludesecurity.com/kb-tickets/new?hsLang=en)

![Prelude\_Wordmark\_Black\_Transparent.png\]](https://support.preludesecurity.com/hs-fs/hubfs/Prelude_Wordmark_Black_Transparent.png?height=50&name=Prelude_Wordmark_Black_Transparent.png)

Open main navigation

Close main navigation

- English
  
  Show submenu for translations
- [Contact support](https://support.preludesecurity.com/kb-tickets/new)
- [Visit the website](https://www.preludesecurity.com/)

[Visit the website](https://www.preludesecurity.com/)

 Find what you're looking for

- There are no suggestions because the search field is empty.

1. [Knowledge Base](https://support.preludesecurity.com/?hsLang=en)
2. [Detect](https://support.preludesecurity.com/detect?hsLang=en)
3. [Probe deployment](https://support.preludesecurity.com/detect?hsLang=en#probe-deployment)

# Deploying probes on MacOS

### Probe Install

All versions of Intel and ARM are supported.

```
curl -sL https://api.preludesecurity.com/download/install/detect.pkg -o detect.pkg
echo "REGISTRATION_STRING='<account>/<token>'" > /tmp/prelude_installer.env
sudo installer -pkg detect.pkg -target /
```

To uninstall and kill the running process use the uninstall script.

```
sudo bash /Library/PreludeSecurity/uninstall
```

### Probe service control

How to check the status and control the probe service.

**Check if Prelude Probe service is running**

```
 sudo launchctl list | grep com.preludesecurity.detect
```

**Stop Prelude Probe service**

```
 sudo launchctl disable system/com.preludesecurity.detect
```

**Start Prelude Probe service**

```
 sudo launchctl enable system/com.preludesecurity.detect
```

**Restart Prelude Probe service**

```
 sudo launchctl kickstart -k system/com.preludesecurity.detect
```

### Logging

**Probe Actions**

All output of the probe is directed to the following directory.

```
/var/log/prelude/probe.log
```

**Probe Startup**

If you need to debug probe startup, you can search

```
 log show --predicate 'subsystem == "system/com.preludesecurity.detect"' --info --debug --style syslog
```

Probes that will not start due to a configuration issue will output logs like

```
2024-12-30 16:23:55.301882-0500  localhost launchd[1]: [system/com.preludesecurity.detect:] Service only ran for 0 seconds. Pushing respawn out by 10 seconds.
2024-12-30 16:23:55.301925-0500  localhost launchd[1]: [system/com.preludesecurity.detect:] internal event: WILL_SPAWN, code = 0
2024-12-30 16:23:55.301928-0500  localhost launchd[1]: [system/com.preludesecurity.detect:] service state: spawn scheduled
2024-12-30 16:23:55.301930-0500  localhost launchd[1]: [system/com.preludesecurity.detect:] service throttled by 10 seconds
```

### Jamf Deployment

This process will walk you through creating a bash script that will download, install and register the MacOS Detect probe (.pkg) via JAMF. The bash script below can be used with any other MacOS MDM tool that can run bash scripts. The Detect Probe handles updates automatically so no additional logic is required to keep your probes up to date.

1. Log in to your JAMF Pro web console
2. Navigate to "Settings" gear icon, top right side
3. Navigate to "Computer Management"
4. Select Scripts and + new Script option
5. Fill out display name like "detect\_install" then move to "Script" tab
6. Ensure Mode is "Shell/Bash" and paste the following Bash Script into the script window, replacing ' / ' with the installation token string from your Detect Environment 
     - Example:`echo "REGISTRATION_STRING='mt04bs6rvobsi3cy2iio4bl9ysznkc6l/3ptupok7-6wni-lltx-l7sx-yku0k896rgrq'" > /tmp/prelude_installer.env`

```
#!/bin/bash# Set the name of the packagepackage_name="detect.pkg"# Check if the package is already installedpackage_installed=$(launchctl list | grep com.preludesecurity.detect &> /dev/null; echo $?)if [ $package_installed -eq 0 ]; then    echo "Package $package_name is already installed."else    echo "Package $package_name is not installed. Installing..."    # Define installation    curl -sL https://api.preludesecurity.com/download/install/detect.pkg -o /tmp/detect.pkg    echo "REGISTRATION_STRING='<account>/<token>'" > /tmp/prelude_installer.env    installer -pkg /tmp/detect.pkg -target /    install_result=$?    if [ $install_result -eq 0 ]; then        echo "Package $package_name installed successfully."    else        echo "Failed to install package $package_name."        exit 1    fifiexit 0
```

1. Click Save
2. Now we will create a policy that will run the script on our defined endpoints, navigate to the "Policies" section and " + New"
3. Under Options select "Scripts" and "Configure"
4. Select the Script created above ("detect\_install" in our example) and click "add"
5. Fill out name for policy, for example: "Detect Probe Install Check"
6. Select Trigger and execution frequency (for example, once every week at computer startup)
7. Next define Scope
8. Fill out any other settings that may be applicable to your environment and save

To troubleshoot or confirm the script executed successfully:

- Navigate to any machine in the targeted scope
- Select History, and Policy Logs
- If the script executed you will see it listed here and can see the result by clicking "details

- [Monitor](https://support.preludesecurity.com/monitor?hsLang=en#main-content)

    - [Introduction to Control Monitor](https://support.preludesecurity.com/monitor?hsLang=en#introduction-to-control-monitor)
    - [Configuration](https://support.preludesecurity.com/monitor?hsLang=en#configuration)
    - [Client Hardware Security Integrations](https://support.preludesecurity.com/monitor?hsLang=en#client-hardware-security-integrations)
    - [Device Discovery Integrations](https://support.preludesecurity.com/monitor?hsLang=en#device-discovery-integrations)
    - [EDR Integrations](https://support.preludesecurity.com/monitor?hsLang=en#edr-integrations)
    - [Email Integrations](https://support.preludesecurity.com/monitor?hsLang=en#email-integrations)
    - [Identity Management Integrations](https://support.preludesecurity.com/monitor?hsLang=en#identity-management-integrations)
    - [Endpoint Management Integrations](https://support.preludesecurity.com/monitor?hsLang=en#endpoint-management-integrations)
    - [Vulnerability Management Integrations](https://support.preludesecurity.com/monitor?hsLang=en#vulnerability-management-integrations)
    - [Reporting](https://support.preludesecurity.com/monitor?hsLang=en#reporting)
    - [Troubleshooting](https://support.preludesecurity.com/monitor?hsLang=en#troubleshooting)
- [Detect](https://support.preludesecurity.com/detect?hsLang=en#main-content)

    - [Basics](https://support.preludesecurity.com/detect?hsLang=en#basics)
    - [Integrations](https://support.preludesecurity.com/detect?hsLang=en#integrations)
    - [Probe deployment](https://support.preludesecurity.com/detect?hsLang=en#probe-deployment)
    - [Security tests](https://support.preludesecurity.com/detect?hsLang=en#security-tests)
    - [Alert suppression](https://support.preludesecurity.com/detect?hsLang=en#alert-suppression)
    - [Assurance](https://support.preludesecurity.com/detect?hsLang=en#assurance)
- [Integrations](https://support.preludesecurity.com/integrations?hsLang=en#main-content)

    - [SASE](https://support.preludesecurity.com/integrations?hsLang=en#sase)
- [Account](https://support.preludesecurity.com/account?hsLang=en#main-content)

    - [SSO](https://support.preludesecurity.com/account?hsLang=en#sso)
- [CLI](https://support.preludesecurity.com/cli?hsLang=en)
- [Release Notes](https://support.preludesecurity.com/release-notes?hsLang=en)

[![Origin Technology Logo](https://support.preludesecurity.com/hs-fs/hubfs/origin_logo_inverse_000000.png?width=5000&height=5000&name=origin_logo_inverse_000000.png "Origin Technology Logo")](http://originhq.com)

Prelude Security Knowledge Base

Copyright © 2026, Origin Technology