User Guide

Installing CheckLight on macOS

Razvan Raschitor -

Before you start: Have your CheckLight sign-in and a macOS administrator account ready. CheckLight's agent is named ThreatResponder in the installer and macOS prompts.

Download from the CheckLight portal

Open Endpoints and add an endpoint

  1. Open CheckLight in Chrome and sign in.
  2. Select Endpoints in the navigation bar, then select Add Endpoint at the upper right.
CheckLight portal: Endpoints → Add Endpoint.

Download the Mac package

On a Mac, the Add New Endpoint page automatically shows the Apple icon and Download for Mac. Select this button to download the installer.

Mac download view, adapted from the current CheckLight portal. The red arrow marks Download for Mac.

If you download from a Windows or Linux computer, the main button reflects that operating system. Select the Apple icon under Also available for for the Mac package instead. To prepare a download link for another Mac, use Generate Link → MacOS.

Install and verify on your Mac

Install the package

Choose either the Installer app or Terminal. If the download is a ZIP file, extract it first to find ThreatResponder.pkg.

Option A: Installer app

  1. Open ThreatResponder.pkg and select Continue.
Open the package and continue through the installer.
  1. Follow the installer prompts. At Installation Type, select Install and authenticate with an administrator account when prompted.
Authorize the software installation.
  1. If macOS asks the Installer to access the folder containing the package, select Allow so installation can continue.
Allow access to the folder containing the downloaded package.

Option B: Terminal

For a scripted or remote installation, run the following command, replacing the example path with the location of your downloaded package:

sudo /usr/sbin/installer -pkg /path/to/ThreatResponder.pkg -target /

With either installation method, complete the extension approvals below.

Approve both system extensions

ThreatResponder requires approval for the Endpoint Security Extension and the Network Extension. The exact appearance of System Settings can vary with your macOS version.

Endpoint Security Extension

  1. When macOS asks to use a new endpoint security extension, select Open System Settings.
Open System Settings from the Endpoint Security approval prompt.
  1. In System Settings > General > Login Items & Extensions, open Endpoint Security Extensions and enable ThreatResponder. Authenticate if macOS requests it.
Turn on the ThreatResponder Endpoint Security Extension.

Network Extension

  1. Approve the ThreatResponder Network Extension as well. Use Open System Settings when the network extension prompt appears.
The Network Extension has its own approval.
  1. Enable ThreatResponder in Network Extensions. When macOS asks whether ThreatResponder may filter network content, select Allow.
Select Allow to enable network filtering and monitoring.

Both approvals are required. Approving Endpoint Security does not enable the Network Extension. Complete both before checking component health.

  • Endpoint Security Extension: inspects protected process and file activity for detections and policy enforcement.
  • Network Extension: provides the network filter used for monitoring and network protection.

For managed deployments, your MDM administrator can pre-approve the system and network extensions.

Check Component Health

Open the ThreatResponder menu bar icon > Component Health. Confirm that the agent and maintenance service are healthy, both extensions are enabled, and the configuration is present.

ThreatResponder menu bar icon → Component Health.

Tamper Protection and Containment reflect your endpoint's policy and current state; they are not additional installation approvals.

For a command-line status check, run:

/Library/NetSecurity/ThreatResponder/trctl status

Return to CheckLight > Endpoints and confirm that the Mac appears and reports its status. If a component is pending approval, return to System Settings, complete the relevant approval, and refresh Component Health.

Maintenance and diagnostics

Use trctl locally on the Mac to check status, collect logs, and perform authorized maintenance.

Status and diagnostics

sudo /Library/NetSecurity/ThreatResponder/trctl status
sudo /Library/NetSecurity/ThreatResponder/trctl collect-logs --output /tmp/tr-logs.zip
sudo /Library/NetSecurity/ThreatResponder/trctl file-protection status

These commands do not change protection or containment. The log collection command creates /tmp/tr-logs.zip for troubleshooting.

Service and containment commands

When Tamper Protection is enabled, state-changing commands require the maintenance password. Obtain it from your CheckLight administrator. Where your account permits it, open the endpoint in Endpoints, find Tamper protection > Uninstall password, and select Show password.

Replace <maintenance_password> below with that password. Use only the command needed for your maintenance task:

sudo /Library/NetSecurity/ThreatResponder/trctl start-agent --maintenance-key <maintenance_password>
sudo /Library/NetSecurity/ThreatResponder/trctl stop-agent --maintenance-key <maintenance_password>
sudo /Library/NetSecurity/ThreatResponder/trctl contain --maintenance-key <maintenance_password>
sudo /Library/NetSecurity/ThreatResponder/trctl uncontain --maintenance-key <maintenance_password>

stop-agent stops agent monitoring; start-agent starts it again. contain applies network containment; uncontain removes it.

If Tamper Protection is already disabled, use the same commands without the --maintenance-key argument. For example:

sudo /Library/NetSecurity/ThreatResponder/trctl stop-agent