Upgrading ThreatLockDown agents on macOS systems

Follow these steps to upgrade ThreatLockDown agents locally on macOS systems. If you want to perform a remote upgrade, check the Remote agent upgrade section to learn more.

Note

To perform the agent upgrade, administrator privileges are required.

Download the latest macOS installer:
- Intel: wazuh-agent-4.9.0-1.intel64.pkg.
- Apple silicon: wazuh-agent-4.9.0-1.arm64.pkg.
Run the macOS installer by using the command line interface (CLI) or the graphical user interface (GUI).
To upgrade the ThreatLockDown agent by using the command line, select your architecture, and run the installer:
# installer -pkg wazuh-agent-4.9.0-1.intel64.pkg -target /
# installer -pkg wazuh-agent-4.9.0-1.arm64.pkg -target /

Note

Packages earlier than 4.5.1 are not available for ARM64 architectures.
Using the GUI will perform a simple upgrade. Double click on the downloaded file and follow the wizard. If you are not sure how to answer some of the prompts, simply use the default answers.

Note

When upgrading agents from versions earlier than 4.x, make sure that the communication protocol is compatible. Up to that point, UDP was the default protocol and it was switched to TCP for later versions. Edit the agent configuration file ossec.conf to update the protocol or make sure that your ThreatLockDown manager accepts both protocols.