Traps™ Agent Administrator's Guide

Use the Traps Agent for Mac

• Open the Traps application.
  Use one of the following methods:

  • Browse to the Traps application in Finder.
  • If you enabled access to the Traps console, click the Traps icon (

    

    ) in the menu bar, and select Open Console.
• View status information about the Traps agent:

  

  • Version—Displays the Traps agent version.
  • Protection—Displays the active policies in bold.
  • Connection—Displays the connection status and, if connected, includes the server to which the agent is connected.
  • Last Check-in—Displays the local time on the endpoint of the last check-in with the server.
• Manually connect to the server.
  The Traps agent periodically communicates with the server to send status information and retrieve the latest security policy. The Traps agent performs this operation transparently at regular intervals so it is not typically necessary to connect to the server manually. If your Connection status is Not Connected, you can manually retry your connection. This option is available if you do not want to wait for the automated communication interval to begin.

  To initiate a manual check-in with the server: On the home page of the Traps console, click Check In Now. If the agent successfully establishes a connection with the server, the Connection status changes to indicated the service to which the agent is connected.
• View and send logs.
  • Send logs—Click Send Support File to collect Traps logs. The logs can help you further analyze any recent security events and Traps issues that you encountered.
  • View logs—Click Open Log File to view logs generated by the Traps agent. The logs display in your default text editor in chronological order with the most recent logs at the bottom.
• View recent security events that occurred on your endpoint.

  

  For each event, the Traps console displays the local Time an event occurred, the name of the Process that exhibited malicious behavior, the Module that triggered the event, and the mode specified for the type of event (Termination or Notification).
• View protected processes on the Mac endpoint.

  

  The Protection tab of the Traps console displays all running processes in which Traps is injected to prevent malicious execution or behavior. The Traps console also indicates the process ID (PID) associated with each process.
• Configure proxy communication.
  Traps can communicate with the ESM Server using the system proxy server that you define for the endpoint. For information on How to Enter Proxy Settings, see the documentation for your Mac operating system version.