Allow network filter for Endpoint Detection and Response on macOS - OneView

When you enable Endpoint Detection and Response (EDR) for macOS on a policy, the device tries to load a system extension and network filter. These items must be permitted for EDR to operate on macOS devices. There are two methods to permit the system extension and network filter:

• An admin can use a .mobileconfig profile with a Mobile Deployment Management (MDM) tool to remotely allow the system extension and certificate.
• Individual users can manually allow the system extension in the macOS system settings.

Upload .mobileconfig profile to MDM

1. Download the mobileconfig files at the bottom of the article. Both are required: 
   • Malwarebytes_Protection_profile_general.mobileconfig
   • Threatdown Protection - Malicious Web Access Control (MWAC).mobileconfig
2. Upload the profiles to your MDM.
3. Deploy the profiles to your Mac endpoints. Refer to your MDM provider’s user guide for instructions on deploying configuration profiles.

Manually allow system extension

1. On the Mac device, click on the Apple icon > System Settings.
2. Follow the steps to manually allow the system extension based on your operating system version:
   • macOS 26 Tahoe
     1. Navigate to General > Login Items & Extensions.
     2. Click the information button next to Malwarebytes Endpoint Detection and Response (EDRMacHelperExt).
     3. Toggle on Network extension.
   • macOS Sequoia 15 and older
     1. Navigate to Privacy & Security.
     2. Under Security, click Allow to allow the Malwarebytes Endpoint Detection and Response system extension. A window to add EDRMacHelperExt opens. 
   • Note: If you have other system extensions awaiting approval, this section may appear different. To manage the list of pending extensions, click on Details and toggle on EDRMacHelperExt.
3. If prompted for the user's password, enter the password.
4. Click Allow.

Download mobileconfig