Datto AV for Mac

Datto AV is compatible with both Intel-based and Apple silicon processors.

Datto AV has been tested and verified for macOS version 13 (Ventura) and above.

Yes. For Datto AV to quarantine all file path locations on macOS, Full Disk Access (FDA) permission must be enabled. Refer to the question below for instructions on granting this permission to the agent.

To enable Full Disk Access for the agent on macOS:

1. On the Mac device, click the Settings icon to open the System Settings application.
2. Click the Privacy & Security tab and click Full Disk Access.
   
3. Turn on the agent toggle to grant Datto AV Full Disk Access permission on the endpoint.
   

Datto AV is automatically installed on Mac devices when there is a Datto AV policy assigned to the location and matching device group.

Run one of the following commands on the host machine to confirm:

ps –awx | grep –i ‘savvy’ OR ps aux | grep -i 'savvy'

You should see something similar to the following (dattoav in the path):

/usr/local/share/CentraStage/AEMAgent/RMM.AdvancedThreatDetection/dattoav/savvy datto_av-8NyLTXRL qDhxOWlP8cUxoWPP7zO1zrTK --hostname JQ0W6GM7QC --agent-id fcc79869-1145-49c7-bee7-7a464ee1d7f1

NOTE  As an alternative, you can go to Activity Monitor and search for SAVVY which is the name of the AV service on MacOS endpoints.

When testing the EICARTEST file on a macOS agent, it is important to ensure that Datto AV has Full Disk Access permission on the device. This ensures that Datto AV can quarantine files in directories protected by Full Disk Access.

NOTE  Datto DNS Secure blocks the download of the EICAR text file.

To test real time scanning you can download the EICAR file, unzip and attempt to execute the file. When the file is loaded to memory, real time protection will analyze the file and quarantine any detected threat.

For scheduled scanning you can download the EICAR file and execute an AV quick scan on the device or location. Quick and full scans may take several minutes to an hour based on the number of files being scanned on the endpoint. For detected threats, Datto AV will quarantine or create an alert based on the settings applied in your device's AV policy.

When installing Datto AV on Windows workstations, Windows Defender will be disabled automatically. When installing Datto AV on Windows Server, Windows Defender should be uninstalled automatically. If the Datto AV agent is not able to uninstall Windows Defender, you will need to do so manually, as explained in article Removing Windows Defender when installing Datto AV.

Prior to installing Datto AV on a Mac, users will need to uninstall the other AVs to avoid conflicts.

To start: From the terminal, run the command

launchctl load /Library/LaunchDaemons/com.infocyte.HUNTAgent.plist

To stop: From the terminal, run the command

launchctl unload /Library/LaunchDaemons/com.infocyte.HUNTAgent.plist 

Remove the AV license from the desired endpoint or disable the AV policy. Prior to uninstalling Datto AV, we recommend you restore any files from quarantine that are safe. This is because when you uninstall Datto AV, the quarantined files are also removed and cannot be recovered.

Yes. Datto RMM natively installs the EDR management agent which will automatically install Datto AV provided that the device in your EDR tenant has a Datto AV license and policy assigned to it.