Installing Deep Instinct via Addigy

Deep Instinct is an AI-powered endpoint security platform that provides deep learning-based threat prevention for Mac devices. This guide walks you through deploying Deep Instinct silently across your fleet using Addigy Smart Software, including all required Device Settings (MDM Profiles) for Full Disk Access and System Extension permissions.

Overview

A complete Deep Instinct deployment in Addigy requires three components, which must be configured and deployed in this order:

1. PPPC Device Setting (MDM Profile) — grants Full Disk Access to Deep Instinct processes
2. System Extensions Device Setting (MDM Profile) — whitelists Deep Instinct's system extension
3. Smart Software item — silently installs Deep Instinct using your organization's deployment credentials

Important: Deploy both Device Settings to your devices before deploying the software. Installing the software first may result in permission prompts appearing for end users.

Prerequisites

• Your organization's Deep Instinct deployment link (ends in .deepinstinctweb.com)
• Your Deep Instinct deployment token
• The Deep Instinct DMG installer file

Step 1: Create the PPPC Profile (Full Disk Access)

This profile grants Deep Instinct the Full Disk Access permissions it needs to scan and protect devices without prompting end users.

1. Navigate to Catalog > Device Settings and click New.
2. Select PPPC.
3. Configure both the Access to Protected Files and Access to System Admin Files sections with the same set of entries below. For each entry, click Add New, fill in the fields, and make sure Allowed is checked.

Add the following entries to both PPPC sections:

4. Click Save in the bottom right.

Step 2: Create the System Extensions Profile

This profile whitelists Deep Instinct's system extension so it can load automatically without user approval.

1. Navigate to Catalog > Device Settings and click New.
2. Select System Extensions.
3. Under Allowed Team Identifiers, enter: MV9BR98H24
4. Click Save.

Note: The Team Identifier MV9BR98H24 authorizes all system extensions signed by Deep Instinct. Do not add this value under Allowed System Extensions — it belongs only under Allowed Team Identifiers.

Step 3: Deploy Both Device Settings to Your Policy

Before proceeding to the software installation, add both Device Settings to the relevant Policy and confirm they have been applied to your target devices. You can verify delivery under GoLive > Device Settings > Installed Device Settings.

Step 4: Create the Smart Software Item

Once the profiles are deployed, create the Smart Software item to silently install Deep Instinct.

1. Navigate to Catalog > Software and click New.
2. Enter a name (e.g., Deep Instinct).
3. Under Installation Files, click Select File(s) and upload your Deep Instinct DMG file.
4. Once uploaded, paste the following into the Installation Command field, substituting your actual file name, deployment link, and token:

[ -d "/Library/Application Support/Deep Instinct" ] || mkdir "/Library/Application Support/Deep Instinct"

cp -R "YOUR_DMG_FILENAME.dmg" "/Library/Application Support/Deep Instinct/"

hdiutil attach -nobrowse "/Library/Addigy/ansible/packages/Deep Instinct (1.0)/YOUR_DMG_FILENAME.dmg"

sudo "/Volumes/Deep Instinct/installer.sh" YOUR_LINK_HERE.deepinstinctweb.com -token YOUR_TOKEN_HERE

hdiutil detach "/Volumes/Deep Instinct/"

Replace the following placeholders before saving:

• YOUR_DMG_FILENAME.dmg — the exact filename of the DMG you uploaded (e.g., 3.1.0.104_Deepinstinct.dmg). This must match in both the cp and hdiutil attach lines.
• YOUR_LINK_HERE.deepinstinctweb.com — your organization's Deep Instinct deployment URL
• YOUR_TOKEN_HERE — your Deep Instinct deployment token

5. Click Save in the bottom right.

Tip: If your DMG filename includes spaces or special characters, make sure they are preserved exactly — including parentheses and version numbers — as the script is case- and character-sensitive.

Frequently Asked Questions

Why do I need to deploy the Device Settings before the software?

macOS requires that Full Disk Access and System Extension permissions be granted via MDM before a security agent like Deep Instinct runs for the first time. If the software installs first, macOS may prompt end users to grant permissions manually, or the agent may not function correctly.

Where do I find my Deep Instinct deployment link and token?

These are provided by Deep Instinct when you configure a deployment in the Deep Instinct management console. Contact your Deep Instinct administrator or account representative if you don't have these values.

Related Articles

• How to Create a PPPC Payload for Full Disk Access (FDA)
• Allow System Extensions with Addigy MDM
• Smart Software Overview
• Creating Smart Software