Skip to main content

I am trying to modify the Restart the Automox Notifications worklet to restart notifications for Sentinel one.  In the notifications panel the Sentinel One notifications are listed as SentinelAgent.

 

I have modified the Evaluation code to be for Sentinel Agent

#!/bin/bash

# capture logged in user
CONSOLE_USER=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ && ! /loginwindow/ { print $3 }')
if f -n "$CONSOLE_USER" ]]; then
CONSOLE_USER_GUI=$(dscl . read /Users/"$CONSOLE_USER" UniqueID | awk '{print $2}')
fi

# detect for Sentinel AgentNotifier service
if launchctl asuser $CONSOLE_USER_GUI launchctl list | grep com.sentinelagent.notifier; then
exit 1
fi

exit 0

And the Remediation code

#!/bin/bash

# capture logged in user
CONSOLE_USER=$(scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ && ! /loginwindow/ { print $3 }')
if f -n "$CONSOLE_USER" ]]; then
CONSOLE_USER_GUI=$(dscl . read /Users/"$CONSOLE_USER" UniqueID | awk '{print $2}')
fi

# Bootout Sentinel One Notifier
if launchctl asuser $CONSOLE_USER_GUI launchctl list | grep com.automox.notifier; then
launchctl asuser $CONSOLE_USER_GUI launchctl bootout gui/$CONSOLE_USER_GUI/com.sentinelone.notifier
fi

exit 0

When I run the worklet and view the Activity Log this is what is showing

And the Notifications do not get turned on.

Be the first to reply!

Reply