| \n\nCheck definition name\n\n | \n\nCheck definition parameters\n\n | \n\nDescription\n\n |
|---|---|---|
| \n\nos.mac.check-app-cpu-usage\n\n | \n\n- --appName=<application name>\n- --primaryProcess=<primary process name>\n- --secondaryProcesses=<list of secondary processes separated by a pipe symbol>\n- --appSysId=<sys id of the application>\n\n | \n\nChecks the amount of CPU resources being used by the primary process and secondary process of the application.\n\n.\n\n |
| \n\nos.mac.check-app-memory-usage\n\n | \n\n- --appName=<application name>\n- --primaryProcess=<primary process name>\n- --secondaryProcesses=<list of secondary processes separated by a pipe symbol>\n- --appSysId=<sys id of the application>\n\n | \n\nChecks the amount of memory resources being used by the primary process and secondary process of the application.\n\n |
| \n\nos.mac.check-app-listening-ports\n\n | \n\n- --appName=<application name>\n- --primaryProcess=<primary process name>\n- --secondaryProcesses=<list of secondary processes separated by a pipe symbol>\n- --appSysId=<sys id of the application>\n\n | \n\nRetrieves the port numbers that are open and through which incoming network traffic can reach the application.\n\n |
| \n\nos.mac.check-app-last-updated\n\n | \n\n- --appName=<application name>\n- --primaryProcess=<primary process name>\n- --secondaryProcesses=<list of secondary processes separated by a pipe symbol>\n- --appSysId=<sys id of the application>\n\n | \n\nChecks the time and date of the latest application update installation.**Note:** This check definition doesn’t require the application to be in a running state.\n\n |
| \n\nos.mac.check-app-version\n\n | \n\n- --appName=<application name>\n- --primaryProcess=<primary process name>\n- --secondaryProcesses=<list of secondary processes separated by a pipe symbol>\n- --appSysId=<sys id of the application>\n\n | \n\nRetrieves the version number of the application.**Note:**\n\n- This check definition doesn't require the application to be in a running state.\n- If an application doesn’t have a version, the check definition returns the string \"unversioned\" for that application.\n\n |
| \n\nos.mac.check-app-is-installed\n\n | \n\n- --appName=<application name>\n- --primaryProcess=<primary process name>\n- --secondaryProcesses=<list of secondary processes separated by a pipe symbol>\n- --appSysId=<sys id of the application>\n\n | \n\nChecks if the application is installed or not on the device.**Note:** This check definition doesn’t require the application to be in a running state.\n\n |
| \n\nos.mac.check-app-is-running\n\n | \n\n- --appName=<application name>\n- --primaryProcess=<primary process name>\n- --secondaryProcesses=<list of secondary processes separated by a pipe symbol>\n- --appSysId=<sys id of the application>\n\n | \n\nChecks whether the application is in a running state or not.\n\n |
| \n\nos.mac.check-app-uptime\n\n | \n\n- --appName=<application name>\n- --primaryProcess=<primary process name>\n- --secondaryProcesses=<list of secondary processes separated by a pipe symbol>\n- --appSysId=<sys id of the application>\n\n | \n\nChecks the uptime of the given application.\n\n |
| \n\nos.mac.check-app-last-access-time\n\n | \n\n- --appName=<application name>\n- --primaryProcess=<primary process name>\n- --secondaryProcesses=<list of secondary processes separated by a pipe symbol>\n- --appSysId=<sys id of the application>\n\n | \n\nChecks the most recent time when the application was executed or run.**Note:**\n\n- This check definition doesn’t require the application to be in a running state.\n- If the application hasn’t been run by the user within the last 7 days, the last access time is empty.\n\n |
| \n\nos.mac.check-app-io-usage-read\n\n | \n\n- --appName=<application name>\n- --primaryProcess=<primary process name>\n- --secondaryProcesses=<list of secondary processes separated by a pipe symbol>\n- --appSysId=<sys id of the application>\n\n | \n\nChecks the Read I/O \\(Input/Output\\) operations performed by the application's primary and secondary processes.\n\n |
| \n\nos.mac.check-app-io-usage-write\n\n | \n\n- --appName=<application name>\n- --primaryProcess=<primary process name>\n- --secondaryProcesses=<list of secondary processes separated by a pipe symbol>\n- --appSysId=<sys id of the application>\n\n | \n\nChecks the Write I/O \\(Input/Output\\) operations performed by the application's primary and secondary processes.\n\n |
| \n\nos.mac.check-app-domain-network-latency\n\n | \n\n- --appName=<application name>\n- --primaryProcess=<primary process name>\n- --secondaryProcesses=<list of secondary processes separated by a pipe symbol>\n- --appSysId=<sys id of the application>\n- --domain=<domain of the application>\n\n | \n\nFetches network latency of the application domain.\n\n |
| \n\nos.mac.check-app-crashes\n\n | \n\n- --appName=<application name>\n- --primaryProcess=<primary process name>\n- --secondaryProcesses=<list of secondary processes separated by a pipe symbol>\n- --appSysId=<sys id of the application>\n\n | \n\nFetches number of crashes and crash details of the application.\n\n |
| \n\nos.mac.check-app-freezes\n\n | \n\n- --appName=<application name>\n- --primaryProcess=<primary process name>\n- --secondaryProcesses=<list of secondary processes separated by a pipe symbol>\n- --appSysId=<sys id of the application>\n\n | \n\nFetches number of app freezes in the last 5 minutes and freeze details of the application.\n\n |
| \n\nos.mac.check-app-zscaler-service-status\n\n | \n\n- --appName=<application name>\n- --primaryProcess=<primary process name>\n- --secondaryProcesses=<list of secondary processes separated by a pipe symbol>\n- --appSysId=<sys id of the application>\n\n | \n\nRetrieves the Zscaler service status information.\n\n |
| \n\nCheck definition name\n\n | \n\nDescription\n\n |
|---|---|
| \n\nos.mac.check-system-cpu-usage\n\n | \n\nChecks the CPU utilization.\n\n |
| \n\nos.mac.check-system-cpu-details\n\n | \n\nRetrieves the CPU name, number of physical and logical cores, and architecture information.\n\n |
| \n\nos.mac.check-system-memory-usage\n\n | \n\nChecks system memory utilization.\n\n |
| \n\nos.mac.check-system-last-access-time\n\n | \n\nChecks the last time that the current device was accessed. **Note:** This check definition works on locked and unlocked devices.\n\n |
| \n\nos.mac.check-system-uptime\n\n | \n\nChecks the amount of time elapsed since the system was last booted.\n\n |
| \n\nos.mac.check-system-time\n\n | \n\nChecks the current time in Coordinated Universal Time \\(UTC\\) using UNIX timestamp.\n\n |
| \n\nos.mac.check-system-device-crashes\n\n | \n\nRetrieves details of different crashes on your device.**Note:** This check fetches Kernel Panics present in the device logs in the last five minutes.\n\n |
| \n\nos.mac.check-system-device-details\n\n | \n\nRetrieves the type, model, and serial number of the chassis.\n\n |
| \n\nos.mac.check-system-device-events\n\n | \n\nRetrieves the details of events that occurred on the device during the specified time interval. Events for macOS include: Last boot, logged-in users, installed software, updated software, added users, and reset passwords.\n\n |
| \n\nos.mac.check-system-disk-details\n\n | \n\nRetrieves disk details such as total space, used space, and free space in bytes.\n\n |
| \n\nos.mac.check-system-disk-io-usage-read\n\n | \n\nRetrieves disk bytes read per second.\n\n |
| \n\nos.mac.check-system-disk-io-usage-write\n\n | \n\nRetrieves disk bytes written per second.\n\n |
| \n\nos.mac.check-system-disk-usage\n\n | \n\nRetrieves the disk used space as a percentage of the total space.\n\n |
| \n\nos.mac.check-system-os-details\n\n | \n\nRetrieves the name, version, platform, architecture, and installation date of the operating system.\n\n |
| \n\nos.mac.check-system-net-bytes-incoming\n\n | \n\nRetrieves the incoming network bytes per second across all network devices.\n\n |
| \n\nos.mac.check-system-net-bytes-outgoing\n\n | \n\nRetrieves the outgoing network bytes per second across all network devices.\n\n |
| \n\nos.mac.check-system-logged-in-users\n\n | \n\nRetrieves the detail of users currently logged in to the device.\n\n |
| \n\nos.mac.check-system-session-details\n\n | \n\nRetrieves the session time of currently logged-in users in minutes.\n\n |
| \n\nos.mac.check-system-network-details\n\n | \n\nRetrieves the network details, including Ethernet, Wi-Fi, and other relevant information.\n\n |
| \n\nos.mac.check-system-battery-details\n\n | \n\nRetrieves battery-related data, including the remaining battery percentage, the designed voltage, the estimated run time, and the battery's maximum capacity.**Note:**\n\n- This check definition doesn't apply to virtual machines \\(VMs\\) or desktops because they don't have batteries.\n- If current capacity is greater than designed capacity, the battery is rounded off to 100%.\n\n |
| \n\nos.mac.check-system-battery-charge-percentage\n\n | \n\nRetrieves the charge percentage of batteries present on the device.**Note:**\n\n- This check definition doesn't apply to virtual machines \\(VMs\\) or desktops because they don't have batteries.\n- If current capacity is greater than designed capacity, the battery is rounded off to 100%.\n\n |
| \n\nos.mac.check-system-firewall-enabled\n\n | \n\nChecks if the operating system firewall is active and enabled.\n\n |
| \n\nos.mac.check-system-pending-updates\n\n | \n\nChecks the status of pending software updates.\n\n |
| \n\nos.mac.check-system-admin-users\n\n | \n\nRetrieves all user accounts with local administrative privileges.\n\n |
| \n\nos.mac.check-system-reboot-details\n\n | \n\nRetrieves the reboot details for the device.\n\n |
| \n\nos.mac.check-system-os-setup-details\n\n | \n\nRetrieves the approximate OS age for the device.\n\n |
| \n\nos.mac.check-system-compliance-details\n\n | \n\nRetrieves the system’s compliance details. This includes the list of all configured apps and metric values that are non-compliant, and calculates a compliance rating based on that.\n\n **Note:**\n\n- This check definition provides the following details:\n - **Condition for app to be said as compliant**: Every process mentioned in primary process should be running.\n - **Condition for metric value to be said as compliant**: Value should be matching with the configured expected value.\n- The score is then calculated using this formula: Score = \\( Complaint Application + Compliant metric value\\) / \\(Total Applications and metric value - Failed Ones\\) \\*100\n\n |
| \n\nos.mac.check-system-vpn-details\n\n | \n\nGet the VPN details for your device.\n\n |
| \n\nos.mac.check-system-energy-consumption\n\n | \n\nGets Energy consumed by Mac machine in coming 5 minutes.**Note:** It's important to consider the following:\n\n- /usr/bin/powermetrics must be added to sudo Permissions.\n- The check takes approximately five minutes to get completed as it’s calculating energy consumed in the coming five minutes\n- This check definition doesn't work if agent is installed with rosetta enabled on M1, M2, M3 machines.\n\n |
| \n\nos.mac.check-system-power-consumption\n\n | \n\nGets Power consumption for mac device.\n\n |
| \n\nos.mac.check-system-custom-query-on-change\n\n | \n\nExecutes the custom query provided in the parameters. Returns value only when changed.\n\n |
| \n\nos.all.check.internal.get-device-configuration-on-change\n\n | \n\nGets the configurations of a device. For example: sudo configured, debug on, agent user, and so on. Runs only if value changes.\n\n |
| \n\nos.mac.action-kill-zombie-orphan-process\n\n | \n\nTakes an app name as input, identifies zombie and orphan processes for that app using the app\\_process\\_data.sh script, and kills them. Returns output in the format \\{isSuccess: true/false, message: \"success/failure message\", output: \\{\"killedProcessPids\": \\[array of pids\\]\\}\\}\n\n |
| \n\nCheck definition name\n\n | \n\nCheck definition parameters\n\n | \n\nDescription\n\n |
|---|---|---|
| \n\nos.mac.check-app-process-ids\n\n | \n\n--process\\_name=<process name>\n\n | \n\nRetrieves the Process IDs \\(PIDs\\) of both the parent and all the child processes associated with the application.\n\n |
| \n\nos.mac.check-process-cpu\n\n | \n\nNone\n\n | \n\nRetrieves a list of all running processes along with their CPU usage percentage, CPU time, Process ID \\(PID\\), Parent Process ID \\(PPID\\), and name.\n\n |
| \n\nos.mac.check-process-memory\n\n | \n\nNone\n\n | \n\nRetrieves a list of all running processes along with their memory usage in kilobytes \\(KB\\), Process ID \\(PID\\), Parent Process ID \\(PPID\\), and name.\n\n |
| \n\nos.mac.check-process-data\n\n | \n\nNone\n\n | \n\nRetrieves the CPU usage, memory usage, and disk usage of all currently running processes.\n\n |
| \n\nos.mac.check-process-disk\n\n | \n\nNone\n\n | \n\nRetrieves a list of all running processes along with their disk usage in Bytes, Process ID \\(PID\\), Parent Process ID \\(PPID\\), and name.\n\n |
| \n\nos.mac.check-traceroute\n\n | \n\n--url=<url>--max\\_hops = <default value is 65>\n\n--timeout = <default value is 5>\n\n | \n\nRetrieves the IP address, domain name, and round-trip time \\(RTT\\) for each network hop.\n\n |
| \n\nos.mac.check-ping-test\n\n | \n\n--url=<url>\n\n | \n\nSends a ping request to the provided URL and returns the connectivity status, indicating whether the URL is reachable or not.\n\n |
| \n\nos.mac.check-services-data\n\n | \n\nservice\\_type =<Type of service\\(one of user, system or all\\)\n\n | \n\nRetrieves the list of all services with PID, Service Name, Status, Service Type.\n\n |
| \n\nCheck definition name\n\n | \n\nCheck definition parameters\n\n | \n\nDescription\n\n |
|---|---|---|
| \n\nos.mac.action-kill-process\n\n | \n\n--pid=<process id>OR\n\n--process\\_name=<executable file name>\n\n**Note:** The process ID takes priority over the application name.\n\n | \n\nTerminates a running process or multiple processes specified by their Process ID \\(PID\\) or executable \\(.app\\) file name.\n\n |
| \n\nos.mac.action-restart-service\n\n | \n\n--service\\_name=<service name>\n\n | \n\nRestarts logged user services that take a service name as input to the system.\n\n |
| \n\nos.mac.action-execute-jamf-policy\n\n | \n\n--Policy ID - policy\\_id\n\n | \n\nExecute the Jamf policy either with a policy ID or with a predefined action. Predefined actions are set by the DEX admins in dex\\_jamf\\_policy table. The service desk agents are able to select and run the predefined actions as they might not have access to Jamf policy IDs. Jamf policy has information about the application name, package version information, action to be performed \\(for example, install or uninstall\\), information on enabled on self service, defined in the Jamf server.**Note:** Jamf client must be installed on the device to execute the Jamf policy.\n\n |
| \n\nos.mac.action-clear-app-cache\n\n | \n\nauto\\_close = <True/False whether you want the process to be closed before clearing the cache>process\\_name = <Process name>\n\napp\\_name = <Application name>\n\ncache\\_path = <Path to the cache folder>\n\n | \n\nClears the application cache.**Note:** Cache path is supported for Zoom, Microsoft Outlook, and Microsoft Teams. Enter cache path without the path to the user. For example, if the cache is at path C:\\\\User\\\\<UserName>\\\\AppData\\\\Roaming\\\\Zoom\\\\data enter AppData\\\\Roaming\\\\Zoom\\\\data.\n\n |
| \n\nos.mac.action-zscaler-zpa-reconnect\n\n | \n\nNone\n\n | \n\nResolves Zscaler connectivity issues.\n\n |
| \n\nos.mac.action-restart-one-drive\n\n | \n\nNone\n\n | \n\nRestarts one drive on the end-user's machine.\n\n |
| \n\nos.mac.action-clear-google-chrome-browsing-data\n\n | \n\nremove\\_web\\_data = <True/False whether you want to remove the web data>\n\n | \n\nRemoves all the browsing data on Google Chrome from all the Google Chrome profiles.\n\n |
| \n\nos.mac.action-purge-recycle-bin\n\n | \n\nNone\n\n | \n\nPurging Recycle Bin will clear all the files in the recycle bin.\n\n |
| \n\nos.mac.action-reset-google-chrome-settings\n\n | \n\nNone\n\n | \n\nThis action clears the settings and removes all the installed Google Chrome extensions on all the Google Chrome profiles.\n\n |
| \n\nos.mac.action-toggle-power-mode\n\n | \n\npower\\_mode - Automatic, High power, Low power.\n\n | \n\nThis action toggles through different power modes in a user mac device.\n\n |
| \n\nos.mac.action-elevate-temporary-admin\n\n | \n\nduration\n\n user\\_id = ID of the user\n\n | \n\nElevates temporary admin access to users for a period of time to perform specific tasks without compromising on security.\n\n |