Technical Tip: How to Trigger an event in the console for macOS to verify if FortiEDR is working Correctly with SysSanityTester tool

[kwernecke]

Description	This article describes the testing tool SysSanityTester and how to use it on macOS.
Scope	FortiEDR.
Solution	SysSanityTester is used for macOS and is a connectivity test tool that will generate a security event on macOS. If the event appears in the FortiEDR Manager, then connectivity between the Collector and Aggregator and Manager is working.  SysSanityTester can be executed in the following methods: Submit a Support Ticket To Request the tool. Verify in the Console where there is an Execution Prevention Policy with the Malicious file Detected rule enabled and applied to the correct group. 'Double-click' on the file to execute it which will open a Terminal prompt window. Via Terminal: cd to file location run cmd: chmod +x SysSanityTester  In Terminal run:./SysSanityTester A popup notification on the macOS will appear. The event will be visible in the Console: Note: To run the tool again on the same device, it will be necessary to delete the event in the console.