SentinelOne

Deploy and manage Safety Endpoint on macOS, Windows, and Linux devices using SentinelOne RemoteOps

This guide covers deploying Safety Endpoint to macOS, Windows, and Linux devices using RemoteOps (Remote Script Orchestration) in the SentinelOne Singularity console. The deployment uses a lightweight script that installs, updates, and verifies Safety Endpoint through the SentinelOne agent.

RemoteOps required. RemoteOps is a licensed SentinelOne add-on and is not included in every Singularity package. Confirm that RemoteOps is enabled for your account and that your console role has permission to upload and run scripts before starting.

Overview

Safety Endpoint is deployed using two RemoteOps components:

1. Script — uploaded once to the Script Library, contains the deployment logic

2. Run Script task — targets the script at your endpoints on demand; recurrence is achieved by re-triggering the task (see the Schedule Recurring Runs step below)

The script downloads the official Safety Endpoint setup script over HTTPS and executes it. On Windows, it first verifies the setup script's Authenticode signature from Safety CLI Cybersecurity Inc. The setup script is idempotent, so re-running it is always safe: the install step is skipped when Safety Endpoint is already up to date, and each run re-verifies enrollment and firewall protection and performs a system scan. On each run, the setup script:

• Installs or updates the Safety Endpoint binary (/opt/safety-cybersecurity/bin/safety on macOS/Linux, C:\Program Files\Safety\bin\safety.exe on Windows)

• Enrolls the device with your Safety organization using the enrollment key

• Configures package-manager firewall protection (pip, uv, poetry, and npm by default — customizable via the script's EXCLUDE_FIREWALL_TOOLS setting)

• Runs a system scan in the context of the logged-in user(s)

Unlike an MDM, RemoteOps is push-based: it does not continuously enforce that software stays installed, and Run Script tasks are one-shot. To keep devices updated and cover machines that were offline, re-run the task periodically — with a time-triggered Singularity Hyperautomation workflow, via the SentinelOne API from your automation platform, or manually on a regular cadence (see the Schedule Recurring Runs step below). The macOS/Linux script includes a built-in 1-hour throttle, so triggering it more frequently than hourly does not cause extra work.

The script reports status through its exit code:

Exit Code	Meaning
0	Safety Endpoint is installed and up to date (or, on macOS/Linux, skipped — last run was less than 1 hour ago)
1	Setup failed — requires manual review

Prerequisites

Before starting, make sure you have:

• SentinelOne console access with a role that can manage the Script Library and run RemoteOps tasks

• RemoteOps enabled for your account and for each target Site — in the Site's configuration, the Remote Script Orchestration option must be checked

• Enrollment key from the Safety Platform — click Manage Enrollment Key → Create Enrollment Key

• Target devices running the SentinelOne agent on macOS 12 or later, Windows 10 or later with PowerShell 5.0+, or a 64-bit Linux distribution (x86_64 or ARM64)

• Outbound HTTPS access from endpoints to getsafety.com (installer downloads) and *.safetycli.com (enrollment, data reporting, and package firewall services)

Deploy Safety Endpoint

1

Get Your Enrollment Key

Log in to the Safety Platform, click Manage Enrollment Key → Create Enrollment Key, and copy the generated key. This key links devices to your Safety organization.

2

Prepare the Script

Copy the script for your target platform and replace REPLACE_WITH_YOUR_ENROLLMENT_KEY with your organization's enrollment key. Save it as a file (run.sh or run.ps1) so you can upload it to the Script Library.

macOS / Linux

run.sh

#!/bin/bash
# Safety Endpoint - Run Script (macOS/Linux)
# Template: values below are populated by the Safety Platform per organization.
# Upload to the SentinelOne Script Library as an action (non-collection) script.
# Requires: root | Re-run on a recurring cadence (suggested: 1 hour)
#
# Downloads the Safety Endpoint setup script and executes it.
# Includes a 1-hour throttle, so being triggered more often than
# hourly does not cause extra work.

# ── Organization Configuration ───────────────────────────────────────
ENROLLMENT_KEY="REPLACE_WITH_YOUR_ENROLLMENT_KEY"
# Comma-separated list of firewall tools to exclude (e.g. "pip,npm")
EXCLUDE_FIREWALL_TOOLS=""
# ─────────────────────────────────────────────────────────────────────

set -euo pipefail

SETUP_URL="https://getsafety.com/cli/setup.sh"
USER_AGENT="Safety-Endpoint/1 (run)"
STAMP_FILE="/var/tmp/.safety-endpoint-last-run"
THROTTLE_SECONDS=3600
MAX_STAMP_AGE=86400  # 24h — treat older/invalid stamps as stale

# ── Throttle: skip if last successful run was less than 1 hour ago ───
should_run=true
if [ -f "$STAMP_FILE" ]; then
    last=$(cat "$STAMP_FILE" 2>/dev/null) || last=""
    now=$(date +%s)

    if echo "$last" | grep -qE '^[0-9]+$'; then
        age=$((now - last))
        if [ "$age" -lt 0 ] || [ "$age" -gt "$MAX_STAMP_AGE" ]; then
            echo "[Safety Endpoint Setup] Stamp has invalid age (${age}s). Removing stale stamp."
            rm -f "$STAMP_FILE"
        elif [ "$age" -lt "$THROTTLE_SECONDS" ]; then
            echo "[Safety Endpoint Setup] Last run was ${age}s ago (< ${THROTTLE_SECONDS}s). Skipping."
            should_run=false
        fi
    else
        echo "[Safety Endpoint Setup] Stamp file corrupt. Removing."
        rm -f "$STAMP_FILE"
    fi
fi

if [ "$should_run" = "false" ]; then
    exit 0
fi

# ── Download and execute ─────────────────────────────────────────────
echo "[Safety Endpoint Setup] Downloading $SETUP_URL ..."

# Build optional arguments
SETUP_ARGS="--enrollment-key $ENROLLMENT_KEY"
[ -n "$EXCLUDE_FIREWALL_TOOLS" ] && SETUP_ARGS="$SETUP_ARGS --exclude-firewall-tools $EXCLUDE_FIREWALL_TOOLS"

if command -v curl >/dev/null 2>&1; then
    # shellcheck disable=SC2086
    curl -fsSL -A "$USER_AGENT" "$SETUP_URL" | bash -s -- $SETUP_ARGS
elif command -v wget >/dev/null 2>&1; then
    # shellcheck disable=SC2086
    wget -qO- --user-agent="$USER_AGENT" "$SETUP_URL" | bash -s -- $SETUP_ARGS
else
    echo "[Safety Endpoint Setup] ERROR: curl or wget required" >&2
    exit 1
fi

# ── Mark successful run (atomic write) ───────────────────────────────
tmp_stamp=$(mktemp "${STAMP_FILE}.XXXXXX")
date +%s > "$tmp_stamp"
mv -f "$tmp_stamp" "$STAMP_FILE"

Windows

run.ps1

# Safety Endpoint - Run Script (Windows)
# Template: values below are populated by the Safety Platform per organization.
# Upload to the SentinelOne Script Library as an action (non-collection) script.
# Requires: SYSTEM | Re-run on a recurring cadence (suggested: 1 hour)
#
# Downloads the Safety Endpoint setup script, verifies its Authenticode
# signature is from Safety CLI Cybersecurity Inc, and executes it.

# ── Organization Configuration ───────────────────────────────────────
$EnrollmentKey = "REPLACE_WITH_YOUR_ENROLLMENT_KEY"
# Comma-separated list of firewall tools to exclude (e.g. "pip,npm")
$ExcludeFirewallTools = ""
# ─────────────────────────────────────────────────────────────────────

$ErrorActionPreference = "Stop"
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

$setupUrl = "https://getsafety.com/cli/setup.ps1"
$tmpFile  = Join-Path $env:TEMP "safety-mdm-setup-$(Get-Random).ps1"

# ── HttpClient with proxy support (same as install.ps1 / setup.ps1) ─
Add-Type -AssemblyName System.Net.Http -ErrorAction Stop

$handler = [System.Net.Http.HttpClientHandler]::new()

$proxyUrl = @($env:HTTPS_PROXY, $env:ALL_PROXY, $env:HTTP_PROXY) |
    Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | Select-Object -First 1

if ($proxyUrl) {
    $proxyUri = [Uri]$proxyUrl
    $proxy = New-Object Net.WebProxy($proxyUri)
    if ($proxyUri.UserInfo) {
        $parts = $proxyUri.UserInfo -split ":", 2
        $proxy.Credentials = New-Object Net.NetworkCredential(
            [Uri]::UnescapeDataString($parts[0]),
            $(if ($parts.Length -gt 1) { [Uri]::UnescapeDataString($parts[1]) } else { "" })
        )
    } else {
        $proxy.UseDefaultCredentials = $true
    }
    $handler.Proxy = $proxy
} else {
    $handler.DefaultProxyCredentials = [Net.CredentialCache]::DefaultCredentials
}

$client = [System.Net.Http.HttpClient]::new($handler)
$null = $client.DefaultRequestHeaders.UserAgent.ParseAdd("Safety-Endpoint/1 (run)")

# ── Download, verify, execute ────────────────────────────────────────
try {
    # 1. Download (preserves exact bytes for Authenticode)
    Write-Host "Downloading $setupUrl ..."
    $response = $client.GetAsync($setupUrl).GetAwaiter().GetResult()
    $null = $response.EnsureSuccessStatusCode()
    $bytes = $response.Content.ReadAsByteArrayAsync().GetAwaiter().GetResult()
    [System.IO.File]::WriteAllBytes($tmpFile, $bytes)

    # 2. Verify Authenticode signature
    $sig = Get-AuthenticodeSignature -FilePath $tmpFile
    if ($sig.Status -ne "Valid") {
        throw "Signature status: $($sig.Status) - $($sig.StatusMessage)"
    }
    if ($sig.SignerCertificate.Subject -notmatch "O=Safety CLI Cybersecurity Inc") {
        throw "Unexpected signer: $($sig.SignerCertificate.Subject)"
    }
    Write-Host "Signature verified: $($sig.SignerCertificate.Subject)"

    # 3. Execute
    $setupArgs = @{ EnrollmentKey = $EnrollmentKey }
    if ($ExcludeFirewallTools) { $setupArgs.ExcludeFirewallTools = $ExcludeFirewallTools }
    & $tmpFile @setupArgs
}
catch {
    Write-Error "Safety MDM setup failed: $_"
    exit 1
}
finally {
    Remove-Item $tmpFile -Force -ErrorAction SilentlyContinue
    if ($client) { $client.Dispose() }
}

Make sure you replace REPLACE_WITH_YOUR_ENROLLMENT_KEY with your actual enrollment key before uploading the script.

3

Upload the Script to the Script Library

1. In the SentinelOne console, go to the Automation section and open the script library (the Remote Ops tab in newer consoles)

2. Click Upload New Script (or + Create New in newer console versions)

3. Configure the script:

   • Name: Safety Endpoint - Setup (macOS/Linux) or Safety Endpoint - Setup (Windows)

   • Type: select the script type used for scripts that perform an action — do not select the data/artifact collection type (the exact labels vary by console version)

   • OS: select macOS and/or Linux for run.sh, Windows for run.ps1

   • Script file: upload the file you prepared in the previous step (do not zip it)

   • Set the Timeout to at least 1800 seconds (30 minutes) — every run performs a system scan, and the first run also downloads the binary and enrolls the device

   • Leave Input is Required unchecked (the enrollment key is embedded in the script)

4. Save the script

Upload run.sh once (tagged for both macOS and Linux) and run.ps1 separately for Windows. Because the enrollment key is embedded in the script body, anyone who can view the Script Library can read it — if your console supports script input parameters (the Input is Required option), you can instead keep the placeholder in the script and supply the key when creating the task. If you rotate the enrollment key later, remember to update the uploaded script(s).

4

Run the Script on Your Endpoints

1. Go to Sentinels and select the target scope — start with a single test endpoint, then widen to a Site or Group (you can also use saved filters or live queries to target dynamically). If your fleet mixes operating systems, create per-OS Groups and run each script against the matching Group.

2. Select the endpoints (or use Select All for the whole scope)

3. Click Actions → Response → Run Script

4. Choose the Safety Endpoint - Setup script for the matching OS

5. Confirm the timeout is at least 1800 seconds. For the output destination, keep an output location if you want to retain the script's log for review (recommended at least for the pilot run); for routine recurring runs you can set it to None, since the task status reflects the script's exit code and there are no artifacts to collect.

6. Confirm to start the task

RemoteOps scripts run under the SentinelOne agent's elevated context (root on macOS/Linux, SYSTEM on Windows), which is what the setup script requires. The setup script detects logged-in users (the console user on macOS/Linux; active sessions on Windows) and runs enrollment and scans in their context. If no user is logged in when the script runs, the run reports success and the user-level steps are performed on a later run.

5

Schedule Recurring Runs

RemoteOps Run Script tasks are one-shot — RemoteOps itself has no recurring scheduler. To keep Safety Endpoint installed and up to date across the fleet, including devices that were offline or newly enrolled, re-run the task periodically. We suggest a 1-hour cadence; pick whichever approach fits your environment:

• Singularity Hyperautomation (recommended if licensed) — Hyperautomation workflows support time-based interval triggers in addition to event triggers. Create a workflow with an interval trigger set to your chosen cadence, whose action runs the Safety Endpoint setup script — through a RemoteOps script action if your action catalog provides one, or through a custom integration action that calls the RemoteOps execute API (POST /web/api/v2.1/remote-scripts/execute), targeting your endpoints by filter. This keeps the entire loop inside the SentinelOne console with no external infrastructure. Hyperautomation is licensed separately from RemoteOps — if workflows are not available in your console, use the next approach instead.

• External scheduler + API — works with any RemoteOps license: trigger the run on a schedule from your automation platform (SOAR, cron job, CI runner) using POST /web/api/v2.1/remote-scripts/execute, targeting the Site or Group by filter. Check progress with GET /web/api/v2.1/remote-scripts/status. Pre-built SentinelOne integrations exist for Torq, Tines, Cortex XSOAR, and Axonius, all of which support scheduled execution. Consult the API reference in your console (https://<your-console>/api-doc) for the exact request format, and note that API tokens expire and must be renewed for the schedule to keep running.

• Manual re-runs — re-run the task from the console on a regular cadence and whenever new devices are enrolled

Don't worry about triggering too often: the setup script is idempotent, and on macOS/Linux the wrapper throttles itself to one real run per hour — if your trigger fires more frequently than that, the extra runs exit immediately without doing work. Less frequent cadences also work; they simply mean updates and new devices are picked up more slowly.

6

Optional: React to Detections

SentinelOne STAR (Storyline Active Response) custom rules cannot run scripts directly — their native responses are limited to alert, kill process, quarantine, remediate, and network quarantine. If you want to run the Safety Endpoint script in response to a detection or console event (for example, a new agent registering), use that alert as the trigger for a Hyperautomation workflow whose action runs the script.

7

Verify

Monitor the task in the Automation section under the Tasks tab — tasks move through Pending, In Progress, and Completed. Once a task completes on a device:

1. Check the task status and script output for that endpoint — a successful run ends with the setup script's summary

2. Log in to the Safety Platform and confirm the device appears as enrolled

Quick test: Run the task against a single test endpoint first and review its full script output before targeting the whole fleet.

Monitor Compliance

After deployment, monitor your fleet through the RemoteOps task history:

1. In the SentinelOne console, go to the Automation section

2. Open the Tasks tab

3. Review the status of the Safety Endpoint - Setup task per endpoint

Status	What It Means	Action
Completed	Script ran successfully	None — Safety Endpoint is installed or was already up to date
Failed / error	The script exited with a non-zero code (how failures are surfaced may vary by console version)	Review the script output for that endpoint
Pending / In Progress	The endpoint has not run the task yet (for example, it is offline)	If a task never completes on a device, re-run it once the device is back online — a recurring cadence covers this automatically

Device-level enrollment status is always visible in the Safety Platform, which is the source of truth for which machines are reporting. To find machines that never ran the task, compare the enrolled-device list there against your SentinelOne scope — the difference is your remaining deployment backlog.

Uninstall Safety Endpoint

If you need to remove Safety Endpoint from devices, upload the uninstall wrapper script to the Script Library and run it as a one-time task. Like the deployment script, it downloads the official uninstall script from Safety over HTTPS (with Authenticode verification on Windows) and executes it.

Stop the recurring runs first. If you set up a recurring re-run (Hyperautomation workflow, scheduled API call), disable it — or remove the target devices from its scope — before uninstalling. Otherwise the next scheduled run will reinstall Safety Endpoint.

The uninstall script removes all Safety Endpoint artifacts from the machine, including configuration, firewall wrappers, package manager settings, and data for all user profiles.

macOS / Linux

uninstall-run.sh

#!/bin/bash
# Safety Endpoint - Uninstall Script (macOS/Linux)
# Upload to the SentinelOne Script Library as an action (non-collection) script.
# Requires: root | Run: one-time or on-demand
#
# Downloads the Safety Endpoint uninstall script and executes it.

set -euo pipefail

UNINSTALL_URL="https://getsafety.com/cli/uninstall.sh"
USER_AGENT="Safety-Endpoint/1 (run)"

echo "[Safety Endpoint Setup] Downloading $UNINSTALL_URL ..."
if command -v curl >/dev/null 2>&1; then
    curl -fsSL -A "$USER_AGENT" "$UNINSTALL_URL" | bash -s
elif command -v wget >/dev/null 2>&1; then
    wget -qO- --user-agent="$USER_AGENT" "$UNINSTALL_URL" | bash -s
else
    echo "[Safety Endpoint Setup] ERROR: curl or wget required" >&2
    exit 1
fi

# Clean up the throttle stamp if it exists
rm -f /var/tmp/.safety-endpoint-last-run

Windows

uninstall-run.ps1

# Safety Endpoint - Uninstall Script (Windows)
# Upload to the SentinelOne Script Library as an action (non-collection) script.
# Requires: SYSTEM | Run: one-time or on-demand
#
# Downloads the Safety Endpoint uninstall script, verifies its Authenticode
# signature is from Safety CLI Cybersecurity Inc, and executes it.

$ErrorActionPreference = "Stop"
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

$uninstallUrl = "https://getsafety.com/cli/uninstall.ps1"
$tmpFile      = Join-Path $env:TEMP "safety-mdm-uninstall-$(Get-Random).ps1"

# ── HttpClient with proxy support (same as install.ps1 / setup.ps1) ─
Add-Type -AssemblyName System.Net.Http -ErrorAction Stop

$handler = [System.Net.Http.HttpClientHandler]::new()

$proxyUrl = @($env:HTTPS_PROXY, $env:ALL_PROXY, $env:HTTP_PROXY) |
    Where-Object { -not [string]::IsNullOrWhiteSpace($_) } | Select-Object -First 1

if ($proxyUrl) {
    $proxyUri = [Uri]$proxyUrl
    $proxy = New-Object Net.WebProxy($proxyUri)
    if ($proxyUri.UserInfo) {
        $parts = $proxyUri.UserInfo -split ":", 2
        $proxy.Credentials = New-Object Net.NetworkCredential(
            [Uri]::UnescapeDataString($parts[0]),
            $(if ($parts.Length -gt 1) { [Uri]::UnescapeDataString($parts[1]) } else { "" })
        )
    } else {
        $proxy.UseDefaultCredentials = $true
    }
    $handler.Proxy = $proxy
} else {
    $handler.DefaultProxyCredentials = [Net.CredentialCache]::DefaultCredentials
}

$client = [System.Net.Http.HttpClient]::new($handler)
$null = $client.DefaultRequestHeaders.UserAgent.ParseAdd("Safety-Endpoint/1 (run)")

# ── Download, verify, execute ────────────────────────────────────────
try {
    # 1. Download (preserves exact bytes for Authenticode)
    Write-Host "Downloading $uninstallUrl ..."
    $response = $client.GetAsync($uninstallUrl).GetAwaiter().GetResult()
    $null = $response.EnsureSuccessStatusCode()
    $bytes = $response.Content.ReadAsByteArrayAsync().GetAwaiter().GetResult()
    [System.IO.File]::WriteAllBytes($tmpFile, $bytes)

    # 2. Verify Authenticode signature
    $sig = Get-AuthenticodeSignature -FilePath $tmpFile
    if ($sig.Status -ne "Valid") {
        throw "Signature status: $($sig.Status) - $($sig.StatusMessage)"
    }
    if ($sig.SignerCertificate.Subject -notmatch "O=Safety CLI Cybersecurity Inc") {
        throw "Unexpected signer: $($sig.SignerCertificate.Subject)"
    }
    Write-Host "Signature verified: $($sig.SignerCertificate.Subject)"

    # 3. Execute
    & $tmpFile
}
catch {
    Write-Error "Safety MDM uninstall failed: $_"
    exit 1
}
finally {
    Remove-Item $tmpFile -Force -ErrorAction SilentlyContinue
    if ($client) { $client.Dispose() }
}

Run it as a Run Script task against the target endpoints. The script runs once per device with elevated privileges and will clean up:

• Safety Endpoint binaries and system PATH entries

• Per-user configuration, firewall wrappers, and shell profiles

• Package manager configurations (pip, uv, npm)

• Scheduled tasks created by Safety Endpoint (Windows)

Troubleshooting

RemoteOps options are missing from the console

If you don't see the Script Library or the Run Script action:

• RemoteOps is a licensed add-on — confirm it is included in your SentinelOne subscription

• RemoteOps is enabled per Site — check that the Remote Script Orchestration option is enabled in the Site's configuration

• Check that your console role has RemoteOps permissions (the ability to view/manage the Script Library and run scripts is controlled by RBAC)

• Contact your SentinelOne administrator or account representative to enable it

Script fails with network or proxy errors

The script downloads the setup script over HTTPS from getsafety.com. If the download fails:

• Ensure the endpoint has outbound HTTPS access to getsafety.com

• If your network uses a proxy, set the HTTPS_PROXY environment variable at the system level — both the shell and PowerShell scripts respect standard proxy environment variables

• Verify no network appliance is blocking or intercepting HTTPS traffic to getsafety.com

Signature verification fails on Windows

The Windows script verifies that the downloaded setup script is signed by Safety CLI Cybersecurity Inc using Authenticode. If verification fails:

• Check that TLS 1.2 is enabled on the device

• Verify no network appliance is intercepting or modifying HTTPS traffic (SSL inspection breaks Authenticode signatures)

The task times out before finishing

The first run on a device downloads the Safety Endpoint binary, enrolls the device, and performs an initial system scan, which can take several minutes. If tasks report a timeout:

• Increase the task timeout when creating the Run Script task (30 minutes is a safe value)

• Runs after the first are typically faster because the binary download and enrollment are skipped, but every run still performs a system scan — keep the timeout generous rather than tightening it after the first success

Script shows "skipping" every time (macOS/Linux)

The message Last run was Xs ago (< 3600s). Skipping. means the throttle is working as expected — the script only performs work once per hour. To force a re-run (e.g., for testing), delete the timestamp file on the device and run the task again:

sudo rm -f /var/tmp/.safety-endpoint-last-run

Task shows Failed but Safety Endpoint is installed

A failed status means the script exited with a non-zero code. This can happen if:

• The setup script detected a problem during its health check

• A newer version failed to install

• A temporary network issue occurred during the run

Check the script output for the endpoint. Re-run the task to retry (on macOS/Linux, subject to the 1-hour throttle).

New devices don't get Safety Endpoint automatically

RemoteOps tasks target the endpoints that existed when the task was created — they are not a continuously enforced policy. To cover new devices:

• Re-trigger the Run Script task against the Site or Group on a recurring cadence (via a Hyperautomation workflow or the API — see the Schedule Recurring Runs step) so newly enrolled endpoints are picked up on the next cycle

• Or trigger the script for new endpoints via the SentinelOne API as part of your provisioning workflow