Worklet help with modifying the Restart Automox Notifications worklet for MacOS

slammert

May 23, 2024 at 4:09 pm UTC

I am trying to modify the Restart the Automox Notifications worklet to restart notifications for Sentinel one. In the notifications panel the Sentinel One notifications are listed as SentinelAgent.

I have modified the Evaluation code to be for Sentinel Agent

bash14 lines

#!/bin/bash

# capture logged in user
CONSOLE_USER=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ && ! /loginwindow/ { print $3 }')
if [[ -n "$CONSOLE_USER" ]]; then
    CONSOLE_USER_GUI=$(dscl . read /Users/"$CONSOLE_USER" UniqueID | awk '{print $2}')
fi

# detect for Sentinel AgentNotifier service
if launchctl asuser $CONSOLE_USER_GUI launchctl list | grep com.sentinelagent.notifier; then
	exit 1
fi

exit 0

And the Remediation code

bash14 lines

#!/bin/bash

# capture logged in user
CONSOLE_USER=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ && ! /loginwindow/ { print $3 }')
if [[ -n "$CONSOLE_USER" ]]; then
    CONSOLE_USER_GUI=$(dscl . read /Users/"$CONSOLE_USER" UniqueID | awk '{print $2}')
fi

# Bootout Sentinel One Notifier
if launchctl asuser $CONSOLE_USER_GUI launchctl list | grep com.automox.notifier; then
	launchctl asuser $CONSOLE_USER_GUI launchctl bootout gui/$CONSOLE_USER_GUI/com.sentinelone.notifier
fi

exit 0

When I run the worklet and view the Activity Log this is what is showing

And the Notifications do not get turned on.

This discussion is archived and closed to replies. Continue it in the Automox Community Slack.

Discuss on Slack