Prismara Endpoint SecurityHow-to guide

Deploy the Prismara Endpoint Security sensor

Applies to Administrators
⏱ 15 min

Each device you want to protect needs the Prismara Endpoint Security sensor. When you install the sensor with your organisation’s onboarding token, the device appears in the Endpoint Security console and starts reporting.

Before you begin

You need the Endpoint Security administrator role in Prismara.
You need local administrator (Windows), administrator (macOS) or sudo (Linux) rights on each device, or a device management tool that installs software with those rights.
If the devices already run Microsoft Defender or other endpoint protection, you can leave it in place. The sensor can run alongside Microsoft Defender while you move across.
Tell your security team before a wide rollout, so they can allow the sensor in any other security software first.

Get the installer and onboarding token

Sign in to the Endpoint Security console at https://endpoint.prismara.eu.
Select Settings > Onboarding.
Choose the Device group the devices should join. Devices onboarded with this token are placed in that group and receive its policy.
Select Copy next to Onboarding token, and download the installer for each platform you need.

Screenshot pendingOnboarding page showing the device group selector, masked onboarding token with Copy button, and Windows, macOS and Linux download buttons

Install the sensor

Interactive install

Run PrismaraEndpointSensor.msi as an administrator.
When prompted, paste the onboarding token and select Install.
Select Finish. You don’t need to restart the device.

Silent install with your device management tool

Deploy PrismaraEndpointSensor.msi as an MSI application with this command line:

msiexec /i PrismaraEndpointSensor.msi /qn ONBOARDINGTOKEN="<your-onboarding-token>"

Assign the app to a device group, not a user group, so that it installs whether or not anyone is signed in.

Open PrismaraEndpointSensor.pkg and follow the installer. Enter the onboarding token when prompted.
When macOS shows System Extension Blocked, open System Settings > Privacy & Security and select Allow next to the Prismara Endpoint Security message.
In System Settings > Privacy & Security > Full Disk Access, turn on Prismara Endpoint Security. Without this, the sensor can’t check every file on the device.

Screenshot pendingmacOS Privacy and Security settings with Prismara Endpoint Security turned on under Full Disk Access

On Macs managed by a device management tool, you can deploy the .pkg and pre-approve the system extension and Full Disk Access with a configuration profile, so users aren’t prompted.

Copy the package for your distribution to the device.

Install it, passing the onboarding token:

# Debian or Ubuntu
sudo PRISMARA_ONBOARDING_TOKEN="<your-onboarding-token>" apt install ./prismara-endpoint-sensor_amd64.deb

# Fedora or RHEL
sudo PRISMARA_ONBOARDING_TOKEN="<your-onboarding-token>" dnf install ./prismara-endpoint-sensor.x86_64.rpm

Check that the sensor is running:
Terminal window
```
systemctl status prismara-endpoint-sensor
```

Deploy with Prismara Core

If your devices are enrolled in Prismara Core, you can deploy the sensor from Core instead of installing it on each device.

In the Prismara Core console, select Apps > Add app.
Select Prismara Endpoint Security sensor from the list of Prismara apps. Core fills in the installer and your organisation’s onboarding token for you.
Assign the app to one or more device groups, and select Save.

Screenshot pendingPrismara Core Add app panel with Prismara Endpoint Security sensor selected and a demo device group Contoso Laptops assigned

Core installs the sensor the next time each device checks in. You can then use the device’s protection status in your Core compliance policies.

Verify

In the Endpoint Security console, select Devices.
Check that the new device appears in the correct device group with the status Protected. This can take a few minutes after installation.

Screenshot pendingDevices list showing three demo devices (CONTOSO-LT01, CONTOSO-SRV01, fabrikam-ws02) all with status Protected