Datto AV for Mac

Datto AV is compatible with both Intel-based and Apple silicon processors.

Datto AV has been tested and verified for macOS version 13 (Ventura) and above.

No. This is because Datto AV is installed as a root user and not distributed via the Mac App Store. It does not require sandboxing and other permissions to perform scans or quarantine files.

Datto AV is automatically installed on Mac devices when there is a Datto AV policy assigned to the location and matching device group.

Run one of the following commands on the host machine to confirm:

ps –awx | grep –i ‘savvy’ OR ps aux | grep -i 'savvy'

You should see something similar to the following (dattoav in the path):

/usr/local/share/CentraStage/AEMAgent/RMM.AdvancedThreatDetection/dattoav/savvy datto_av-8NyLTXRL qDhxOWlP8cUxoWPP7zO1zrTK --hostname JQ0W6GM7QC --agent-id fcc79869-1145-49c7-bee7-7a464ee1d7f1

NOTE  As an alternative, you can go to Activity Monitor and search for SAVVY which is the name of the AV service on MacOS endpoints.

To test real time scanning you can download the EICAR file, unzip and attempt to execute the file. When the file is loaded to memory, real time protection will analyze the file and quarantine any detected threat.

For scheduled scanning you can download the EICAR file and execute an AV quick scan on the device or location. Quick and full scans may take several minutes to an hour based on the number of files being scanned on the endpoint. For detected threats, Datto AV will quarantine or create an alert based on the settings applied in your device's AV policy.

When installing Datto AV on Windows workstations, Windows Defender will be disabled automatically. When installing Datto AV on Windows Server, Windows Defender should be uninstalled automatically. If the Datto AV agent is not able to uninstall Windows Defender, you will need to do so manually, as explained in article Removing Windows Defender when installing Datto AV.

Prior to installing Datto AV on a Mac, users will need to uninstall the other AVs to avoid conflicts.

To start: From the terminal, run the command

launchctl load /Library/LaunchDaemons/com.infocyte.HUNTAgent.plist

To stop: From the terminal, run the command

launchctl unload /Library/LaunchDaemons/com.infocyte.HUNTAgent.plist 

Remove the AV license from the desired endpoint or disable the AV policy. Prior to uninstalling Datto AV, we recommend you restore any files from quarantine that are safe. This is because when you uninstall Datto AV, the quarantined files are also removed and cannot be recovered.

Yes. Datto RMM natively installs the EDR management agent which will automatically install Datto AV provided that the device in your EDR tenant has a Datto AV license and policy assigned to it.