Elastic Agent Installation on macOS via JumpCloud and ManageEngine

Overview

This article provides a step-by-step guide for installing the Elastic Agent on macOS systems using JumpCloud Commands or ManageEngine scripts. The Elastic Agent helps collect logs and performance data from endpoints, enabling centralized visibility and analytics through the Elastic Fleet.

The installation scripts are organization-specific, and each deployment requires an enrollment URL and token generated from your Elastic Cloud portal.

Step 1 – Get the Elastic Agent Script

Log in to your Elastic Central Portal and retrieve the deployment script.

It typically includes the following base command structure:

curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-8.9.0-darwin-x86_64.tar.gz
tar xzvf elastic-agent-8.9.0-darwin-x86_64.tar.gz
cd elastic-agent-8.9.0-darwin-x86_64
sudo ./elastic-agent install --url=https://<organization-fleet-url>:443 --enrollment-token=<token>

Replace the enrollment URL and token with the values unique to your Elastic organization.

Step 2 – Installation via JumpCloud

You can deploy the Elastic Agent to all macOS devices through JumpCloud’s Commands section.

Template Script:

#!/bin/bash

# Download and extract Elastic Agent
curl -L -O { download URL }
tar xzvf { file name }
cd { file name }

# Prepare the input for the installation command
enrollment_url="enrollment url link"
enrollment_token="token key"
input="yes\n"  # Automatically sends "yes" to confirmation prompt

# Run the installation command and automatically answer "Yes"
echo -e $input | sudo ./elastic-agent install --url="$enrollment_url" --enrollment-token="$enrollment_token"

Example of Converted Script:

#!/bin/bash

# Download and extract Elastic Agent
curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-8.9.0-darwin-x86_64.tar.gz
tar xzvf elastic-agent-8.9.0-darwin-x86_64.tar.gz
cd elastic-agent-8.9.0-darwin-x86_64

# Prepare the input for the installation command
enrollment_url="https://48c25d55a65547b5a9b4f355524440c6.fleet.asia-south1.gcp.elastic-cloud.com:443"
enrollment_token="VHhINllva0JtSVFPSHlkbnhmeUU6WUFSZ0xEdGtRdzJtX2hLaWZzVllFZw=="
input="yes\n"

# Run the installation command with confirmation
echo -e $input | sudo ./elastic-agent install --url="$enrollment_url" --enrollment-token="$enrollment_token"

Once created in JumpCloud:

1. Assign the command to the required macOS device group.
2. Click Run Command to start deployment.
3. Verify successful installation via the Elastic Fleet console.

Step 3 – Installation via ManageEngine

You can also automate Elastic Agent deployment using ManageEngine Endpoint Central with a similar shell script.

Template Script:

#!/bin/bash

# Download and extract Elastic Agent
curl -L -O { download url }
tar xf { file name }
cd { file name }

# Prepare the input for the installation command
enrollment_url="enrollment url"
enrollment_token="token key"

# Run the installation command silently
sudo ./elastic-agent install --url="$enrollment_url" --enrollment-token="$enrollment_token" -f

Example of Converted Script:

#!/bin/bash

# Download and extract Elastic Agent
curl -L -O https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-8.9.0-darwin-x86_64.tar.gz
tar xf elastic-agent-8.9.0-darwin-x86_64.tar.gz
cd elastic-agent-8.9.0-darwin-x86_64

# Prepare the input for the installation command
enrollment_url="https://48c25d55a65547b5a9b4f355524440c6.fleet.asia-south1.gcp.elastic-cloud.com:443"
enrollment_token="VHhINllva0JtSVFPSHlkbnhmeUU6WUFSZ0xEdGtRdzJtX2hLaWZzVllFZw=="

# Run the installation silently
sudo ./elastic-agent install --url="$enrollment_url" --enrollment-token="$enrollment_token" -f

This version runs silently without prompts, ideal for bulk deployment via MDM.

Step 4 – Verification

After installation:

• Check the Elastic Fleet Dashboard for new agents.
• Ensure logs and metrics are streaming from connected macOS devices.
• Validate that the agent appears under the correct organizational policy group.

If an installation fails, verify:

• Internet connectivity to the Elastic Fleet URL.
• Sufficient user permissions on the macOS endpoint.
• The token validity (tokens usually expire after a period).