Agent Deployment

# Basic silent install
msiexec /i TATER-Agent.msi /qn APIBASE="https://api.tatersecurity.com/api" APIKEY="your-key" TENANTID="your-tenant" ORGANIZATIONID="your-org"

# With logging for troubleshooting
msiexec /i TATER-Agent.msi /qn APIBASE="https://api.tatersecurity.com/api" APIKEY="your-key" TENANTID="your-tenant" ORGANIZATIONID="your-org" /l*v "%TEMP%\tater-install.log"

# Uninstall silently
msiexec /x TATER-Agent.msi /qn

Get-Service -Name "TATERAgent" -ErrorAction SilentlyContinue

{
  "apiBase": "https://api.tatersecurity.com/api",
  "apiKey": "tater_xxxxxxxxxxxx",
  "tenantId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "organizationId": "org-xxxxxxxxxxxxxxxx",

  // Optional: app-only authentication for cloud scanning
  "appId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "certificateThumbprint": "AABBCC...",
  "organization": "contoso.onmicrosoft.com",

  // Optional: agent behavior
  "products": "All",
  "scanIntervalHours": 24,
  "controlsPath": "C:\\ProgramData\\TATER\\Controls"
}

iwr https://www.tatersecurity.com/Agent/TATER-Agent.intunewin -UseBasicParsing -OutFile TATER-Agent.intunewin

# From the TATER repo root
cd Installer
.\Build-IntuneWin.ps1
# Output: Installer\bin\IntuneWin\TATER-Agent.intunewin

msiexec /i TATER-Agent.msi /qn APIBASE="https://api.tatersecurity.com/api" APIKEY="<your-api-key>" TENANTID="<your-tenant-id>" ORGANIZATIONID="<your-org-id>"

msiexec /x TATER-Agent.msi /qn

Remove-Item $env:TEMP\Verify.ps1 -Force -ErrorAction SilentlyContinue
iwr https://www.tatersecurity.com/Agent/Verify-TATERAgent.ps1 -UseBasicParsing -OutFile $env:TEMP\Verify.ps1
powershell.exe -ExecutionPolicy Bypass -File $env:TEMP\Verify.ps1

# Detect-TATERAgent.ps1 - Intune Proactive Remediation Detection (Go agent v2.x)
$TATERDir    = Join-Path $env:ProgramData 'TATER'
$ConfigPath  = Join-Path $TATERDir 'config.json'
$LogDir      = Join-Path $TATERDir 'Logs'
$ScansDir    = Join-Path $TATERDir 'Scans'
$MaxAgeHours = 48
$issues      = @()

# 1 - Windows service installed and running
$svc = Get-Service -Name 'TATERAgent' -ErrorAction SilentlyContinue
if (-not $svc) {
    $issues += "TATERAgent Windows service not installed"
} elseif ($svc.Status -ne 'Running') {
    $issues += "TATERAgent service is $($svc.Status), expected Running"
} elseif ($svc.StartType -eq 'Disabled') {
    $issues += "TATERAgent service start type is Disabled"
}

# 2 - config.json present with required keys
if (-not (Test-Path $ConfigPath)) {
    $issues += "config.json not found at $ConfigPath"
} else {
    try {
        $cfg = Get-Content $ConfigPath -Raw | ConvertFrom-Json
        foreach ($key in @('apiBase', 'tenantId', 'organizationId')) {
            if (-not $cfg.$key) { $issues += "config.json missing required key: $key" }
        }
        if (-not $cfg.apiKey -and -not $cfg.encryptedApiKey) {
            $issues += "config.json missing apiKey or encryptedApiKey"
        }
    } catch {
        $issues += "config.json is not valid JSON: $_"
    }
}

# 3 - Recent log or scan evidence (only if service is otherwise healthy)
if ($svc -and $svc.Status -eq 'Running' -and (Test-Path $ConfigPath)) {
    $lastEvidence = $null
    if (Test-Path $LogDir) {
        $latest = Get-ChildItem -Path $LogDir -Filter 'TATER-Agent_*.log' -ErrorAction SilentlyContinue |
            Sort-Object LastWriteTime -Descending | Select-Object -First 1
        if ($latest) { $lastEvidence = $latest.LastWriteTime }
    }
    if (Test-Path $ScansDir) {
        $latest = Get-ChildItem -Path $ScansDir -Filter '*.json' -ErrorAction SilentlyContinue |
            Sort-Object LastWriteTime -Descending | Select-Object -First 1
        if ($latest -and (-not $lastEvidence -or $latest.LastWriteTime -gt $lastEvidence)) {
            $lastEvidence = $latest.LastWriteTime
        }
    }
    if (-not $lastEvidence) {
        $issues += "No agent log or scan files found - service running but agent has not produced output yet"
    } else {
        $ageHours = ((Get-Date) - $lastEvidence).TotalHours
        if ($ageHours -gt $MaxAgeHours) {
            $issues += "Agent last produced output $([math]::Round($ageHours,1))h ago (threshold: ${MaxAgeHours}h)"
        }
    }
}

# 4 - Last-upload sentinel (ADO #535) - catches silent upload failures
# Agent v2.4.0+ writes C:\ProgramData\TATER\last-upload.json after every
# successful POST. If the file exists, treat its timestamp as authoritative
# (it confirms server-side acceptance, not just local activity).
$SentinelPath = Join-Path $TATERDir 'last-upload.json'
if (Test-Path $SentinelPath) {
    try {
        $sentinel  = Get-Content $SentinelPath -Raw | ConvertFrom-Json
        $lastUpload = [DateTime]::Parse($sentinel.timestamp)
        $uploadAge  = ((Get-Date).ToUniversalTime() - $lastUpload).TotalHours
        if ($uploadAge -gt $MaxAgeHours) {
            $issues += "Last successful upload was $([math]::Round($uploadAge,1))h ago (threshold: ${MaxAgeHours}h). Agent is scanning locally but cannot reach the TATER API."
        }
    } catch {
        $issues += "last-upload.json is malformed: $_"
    }
} elseif ($svc -and $svc.Status -eq 'Running') {
    # Sentinel absent on a running v2.4.0+ agent means uploads have never
    # succeeded since install. Pre-2.4.0 agents won't write the file, so we
    # only flag this for agents that we've explicitly confirmed are 2.4.0+.
    $exePath = Join-Path $env:ProgramFiles 'TATER\tater-agent.exe'
    if (Test-Path $exePath) {
        $verInfo = (Get-Item $exePath).VersionInfo
        if ($verInfo.ProductVersion -and $verInfo.ProductVersion -ge '2.4.0') {
            $issues += "Agent v$($verInfo.ProductVersion) has never produced a successful upload (no last-upload.json sentinel). Likely API auth failure - see Manage > Activity Log for via=agent entries."
        }
    }
}

if ($issues.Count -gt 0) {
    Write-Output "NON-COMPLIANT: $($issues -join ' | ')"
    exit 1
}
Write-Output "COMPLIANT: TATERAgent service running, config valid, evidence within ${MaxAgeHours}h"
exit 0

# Remediate-TATERAgent.ps1 - Intune Proactive Remediation (Go agent v2.x)
# Edit these values before deploying
$Config = @{
    apiBase               = "https://api.tatersecurity.com/api"
    apiKey                = "your-api-key"
    tenantId              = "your-azure-tenant-id"
    organizationId        = "your-org-id"
    products              = "All"
    appId                 = "your-cloud-scan-app-id"             # optional, for cloud scans
    certificateThumbprint = "your-cloud-scan-cert-thumbprint"    # optional, for cloud scans
    organization          = "your-tenant.onmicrosoft.com"        # optional, for cloud scans
    tenantEnvironment     = "commercial"  # commercial | usGovGcc | usGovGccHigh | usGovDoD
}

$TATERDir   = Join-Path $env:ProgramData 'TATER'
$ConfigPath = Join-Path $TATERDir 'config.json'
$LogDir     = Join-Path $TATERDir 'Logs'
$MSI_URL    = "https://www.tatersecurity.com/Agent/TATER-Agent.msi"
$TempDir    = "C:\Windows\Temp\TATERInstall"
$MSIPath    = Join-Path $TempDir 'TATER-Agent.msi'

function Write-Log { param([string]$m) Write-Output "[$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')] $m" }

try {
    # 1. Install MSI if service is missing
    $svc = Get-Service -Name 'TATERAgent' -ErrorAction SilentlyContinue
    if (-not $svc) {
        Write-Log "TATERAgent service not installed - downloading and installing MSI..."
        if (-not (Test-Path $TempDir)) { New-Item -ItemType Directory -Path $TempDir -Force | Out-Null }
        [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
        Invoke-WebRequest -Uri $MSI_URL -OutFile $MSIPath -UseBasicParsing -ErrorAction Stop

        # Pass required MSI properties - the MSI's GenerateConfig custom action will
        # fail the install if APIBASE / APIKEY / TENANTID / ORGANIZATIONID are missing.
        # We still rewrite config.json from $Config in step 3 below, but the MSI itself
        # must succeed first or the service is never installed. Start-Process accepts
        # an array of arguments and quotes each one automatically - no need for
        # PowerShell backtick-escape soup.
        $logPath = Join-Path $TempDir 'tater-install.log'
        $msiArgs = @(
            '/i', $MSIPath,
            '/qn',
            '/l*v', $logPath,
            "APIBASE=$($Config.apiBase)",
            "APIKEY=$($Config.apiKey)",
            "TENANTID=$($Config.tenantId)",
            "ORGANIZATIONID=$($Config.organizationId)"
        )
        $proc = Start-Process -FilePath 'msiexec.exe' -ArgumentList $msiArgs -Wait -PassThru
        if ($proc.ExitCode -ne 0 -and $proc.ExitCode -ne 3010) {
            throw "MSI install failed with exit code $($proc.ExitCode) - see $TempDir\tater-install.log"
        }
        Write-Log "MSI installed (exit code: $($proc.ExitCode))"
    } else {
        Write-Log "TATERAgent service already installed (status: $($svc.Status))"
    }

    # 2. Ensure data dir exists
    foreach ($dir in @($TATERDir, $LogDir)) {
        if (-not (Test-Path $dir)) { New-Item -ItemType Directory -Path $dir -Force | Out-Null }
    }

    # 3. Write config.json (no BOM - Go agent strips BOMs but writing clean is safer)
    Write-Log "Writing config.json..."
    $json = $Config | ConvertTo-Json -Depth 3
    [System.IO.File]::WriteAllText($ConfigPath, $json, [System.Text.UTF8Encoding]::new($false))
    Write-Log "config.json written"

    # 4. Auto-start + (re)start the service so it picks up the new config
    Set-Service -Name 'TATERAgent' -StartupType Automatic -ErrorAction Stop
    $svc = Get-Service -Name 'TATERAgent'
    if ($svc.Status -eq 'Running') {
        Write-Log "Restarting TATERAgent..."
        Restart-Service -Name 'TATERAgent' -Force -ErrorAction Stop
    } else {
        Write-Log "Starting TATERAgent..."
        Start-Service -Name 'TATERAgent' -ErrorAction Stop
    }

    # 5. Do NOT spawn a one-shot scan here (ADO #557)
    #    Earlier versions ran `Start-Process tater-agent.exe -scan` to seed
    #    fresh evidence. The Proactive Remediation script runs in the calling
    #    user's context (often a local admin like JesseMilesAdmin), while the
    #    Windows service starts in SYSTEM context. The two processes then ran
    #    in PARALLEL - two tater-agent.exe instances, different identities,
    #    competing for the same %ProgramData%\TATER files. Confirmed on
    #    X1-01-2025-08 and X1-09-2025-08 in May 2026 (CB tenant).
    #    The freshly-started service performs an initial scan within its
    #    first poll interval (default 60s), which the detection script
    #    picks up on the next Intune sync (default 8h). If you need faster
    #    feedback for testing, RDP into the device and run:
    #        sc.exe stop TATERAgent
    #        sc.exe start TATERAgent
    #    or remotely via TATER Manage → Devices → Run command.

    Write-Log "SUCCESS: TATERAgent remediated"
    exit 0
} catch {
    Write-Log "ERROR: $($_.Exception.Message)"
    exit 1
} finally {
    Remove-Item -Path $MSIPath -Force -ErrorAction SilentlyContinue
}

# Group Policy software installation
# Place the MSI on a network share accessible by target machines
# Create a GPO with Software Installation pointing to:
\\fileserver\share\TATER-Agent.msi

# For SCCM, create a package with the following program command line:
msiexec /i TATER-Agent.msi /qn APIBASE="https://api.tatersecurity.com/api" APIKEY="your-key" TENANTID="your-tenant" ORGANIZATIONID="your-org"

#!/bin/bash
# tater_agent_install.sh - TATER Agent idempotent installer for Intune Platform Scripts
# Deploy via: Devices > Scripts > macOS > Add

# ── Configure these four values ────────────────────────────────────────────
API_BASE="https://api.tatersecurity.com/api"
API_KEY="your-api-key"
TENANT_ID="your-azure-tenant-id"
ORG_ID="your-org-id"
# ───────────────────────────────────────────────────────────────────────────

set -euo pipefail

ARCH=$(uname -m)
if [[ "$ARCH" == "arm64" ]]; then
    BINARY_URL="https://www.tatersecurity.com/Agent/tater-agent-darwin-arm64"
else
    BINARY_URL="https://www.tatersecurity.com/Agent/tater-agent-darwin-amd64"
fi

INSTALL_DIR="/usr/local/bin"
DATA_DIR="/Library/Application Support/TATER"
PLIST_PATH="/Library/LaunchDaemons/com.tatersecurity.agent.plist"
BINARY_PATH="$INSTALL_DIR/tater-agent"

# Download binary if not already installed or if outdated
if [[ ! -f "$BINARY_PATH" ]]; then
    curl -fsSL "$BINARY_URL" -o "$BINARY_PATH"
    chmod 755 "$BINARY_PATH"
    chown root:wheel "$BINARY_PATH"
    # CRITICAL: strip the com.apple.quarantine xattr that curl applies to downloads.
    # Without this, macOS Gatekeeper silently blocks the unsigned binary from running
    # - launchctl load reports success but the process never actually starts.
    xattr -d com.apple.quarantine "$BINARY_PATH" 2>/dev/null || true
    xattr -c "$BINARY_PATH" 2>/dev/null || true
fi

# Create data directory
mkdir -p "$DATA_DIR/Logs"
mkdir -p "$DATA_DIR/Controls/macOS"

# ADO #566 - Provision macOS control scripts. The agent's runner_darwin.go
# discovers .sh scripts under {controlsPath}/macOS/ at scan time. Without
# these files the agent runs an empty scan and the API returns 400. We
# fetch them from the marketing SWA on every install - idempotent and
# tolerates re-runs (curl overwrites).
CTRL_BASE="https://www.tatersecurity.com/Controls/macOS"
for n in 001_FileVault 002_Firewall 003_GatekeeperSIP 004_AutoUpdates 005_ScreenLock \
         006_RemoteLogin 007_Sharing 008_PasswordPolicy 009_TimeMachine 010_GuestAccount \
         011_AirDrop 012_XProtect 013_NTP 014_Bluetooth 015_SecureBoot \
         016_SoftwareUpdates 017_RemoteManagement 018_LoginWindow 019_Audit 020_NetworkSecurity \
         021_SafariSafeDownloads 022_TerminalSecureEntry 023_ScreenSaverPassword 024_FirewallStealthMode 025_FirewallLogging \
         026_RemoteAppleEvents 027_InternetSharing 028_MediaSharing 029_PrinterSharing 030_NFSExports \
         031_WakeForNetwork 032_PowerNapDisabled 033_FindMyMac 034_iCloudDriveDocSync 035_DiagnosticsSubmission \
         036_SiriEnabled 037_LocationServices 038_AnalyticsSharing 039_PasswordHints 040_FastUserSwitching \
         041_AutomaticLoginOff 042_ConsoleLoginPrompt 043_SSHKeyPermissions 044_SudoTimeout 045_SudoSeparateTty \
         046_LibraryValidation 047_BootROMVersion 048_KernelExtensions 049_SystemIntegrityProtection 050_APFSEncryptedVolumes \
         051_TimeMachineEncrypted 052_CertificateTrustSettings 053_HomeFolderPermissions 054_UmaskSetting 055_GuestAccessSMB; do
  out="$DATA_DIR/Controls/macOS/MAC_${n}.sh"
  curl -fsSL "$CTRL_BASE/MAC_${n}.sh" -o "$out" || { echo "Failed to fetch MAC_${n}"; }
  chmod 755 "$out" 2>/dev/null || true
done
chown -R root:wheel "$DATA_DIR/Controls" 2>/dev/null || true
CTL_COUNT=$(ls -1 "$DATA_DIR/Controls/macOS" 2>/dev/null | grep -c '\.sh$' || echo 0)
echo "Provisioned $CTL_COUNT macOS control scripts"

# Write config (idempotent)
cat > "$DATA_DIR/config.json" <<EOF
{
  "apiBase": "$API_BASE",
  "apiKey": "$API_KEY",
  "tenantId": "$TENANT_ID",
  "organizationId": "$ORG_ID",
  "controlsPath": "$DATA_DIR/Controls",
  "scanIntervalHours": 24
}
EOF

# Register launchd daemon
cat > "$PLIST_PATH" <<PLIST
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key><string>com.tatersecurity.agent</string>
    <key>ProgramArguments</key>
    <array><string>$BINARY_PATH</string></array>
    <key>WorkingDirectory</key><string>$DATA_DIR</string>
    <key>RunAtLoad</key><true/>
    <key>KeepAlive</key><true/>
    <key>StandardOutPath</key><string>$DATA_DIR/Logs/tater-agent.stdout.log</string>
    <key>StandardErrorPath</key><string>$DATA_DIR/Logs/tater-agent.stderr.log</string>
</dict>
</plist>
PLIST

chmod 644 "$PLIST_PATH"
chown root:wheel "$PLIST_PATH"

# Load/reload the daemon
launchctl unload "$PLIST_PATH" 2>/dev/null || true
launchctl load "$PLIST_PATH"

echo "TATER Agent installed and started successfully."
exit 0

# Download and install (Apple Silicon)
sudo TATER_API_BASE="https://api.tatersecurity.com/api" \
     TATER_API_KEY="your-api-key" \
     TATER_TENANT_ID="your-tenant-id" \
     TATER_ORG_ID="your-org-id" \
     bash install.sh

# Check service status
launchctl list com.tatersecurity.agent

# View logs
tail -f "/Library/Application Support/TATER/Logs/tater-agent.stdout.log"

# Restart service
sudo launchctl unload /Library/LaunchDaemons/com.tatersecurity.agent.plist
sudo launchctl load /Library/LaunchDaemons/com.tatersecurity.agent.plist

# Uninstall
sudo bash uninstall.sh

# Download and install (auto-detects amd64/arm64)
sudo TATER_API_BASE="https://api.tatersecurity.com/api" \
     TATER_API_KEY="your-api-key" \
     TATER_TENANT_ID="your-tenant-id" \
     TATER_ORG_ID="your-org-id" \
     bash install.sh

# Check service status
sudo systemctl status TATERAgent

# View logs
sudo journalctl -u TATERAgent -f

# Restart service
sudo systemctl restart TATERAgent

# Uninstall
sudo tater-agent -uninstall
sudo rm /usr/local/bin/tater-agent

# 1. Service is installed and running
Get-Service -Name 'TATERAgent'
# Expected: Status = Running, StartType = Automatic

# 2. Config file is present and valid JSON
Get-Content "$env:ProgramData\TATER\config.json" | ConvertFrom-Json |
    Format-List apiBase, tenantId, organizationId
# Expected: all three fields populated; no parse errors

# 3. Agent has produced output recently (logs or scans)
Get-ChildItem "$env:ProgramData\TATER\Logs", "$env:ProgramData\TATER\Scans" `
    -Recurse -ErrorAction SilentlyContinue |
    Sort-Object LastWriteTime -Descending | Select-Object -First 5 FullName, LastWriteTime
# Expected: at least one file modified within the last hour after install

# 4. Trigger a one-shot scan if no recent output
& "$env:ProgramFiles\TATER\tater-agent.exe" -scan

# 1. LaunchDaemon is loaded and process is running
sudo launchctl print system/com.tatersecurity.agent | head -20
# Expected: state = running

# 2. Config file is present
cat "/Library/Application Support/TATER/config.json"
# Expected: apiBase, tenantId, organizationId all populated

# 3. No quarantine xattr blocking the binary (see macOS section above)
xattr /usr/local/bin/tater-agent
# Expected: no output (or no com.apple.quarantine line)

# 4. Recent log output
sudo tail -50 "/Library/Application Support/TATER/Logs/tater-agent.stdout.log"
# Expected: scan loop heartbeat or scan-completion lines

# 1. systemd service status
sudo systemctl status tater-agent
# Expected: active (running), enabled

# 2. Config file
cat /var/lib/tater/config.json
# Expected: apiBase, tenantId, organizationId populated

# 3. Recent journal output
sudo journalctl -u tater-agent -n 50 --no-pager
# Expected: scan-loop heartbeat or successful upload lines

# Run from the TATER installation directory
.\Fix-Integrity.ps1