Agent Deployment

# Basic silent install
msiexec /i TATER-Agent.msi /qn APIBASE="https://api.tatersecurity.com/api" APIKEY="your-key" TENANTID="your-tenant" ORGANIZATIONID="your-org"

# With logging for troubleshooting
msiexec /i TATER-Agent.msi /qn APIBASE="https://api.tatersecurity.com/api" APIKEY="your-key" TENANTID="your-tenant" ORGANIZATIONID="your-org" /l*v "%TEMP%\tater-install.log"

# Uninstall silently
msiexec /x TATER-Agent.msi /qn

Get-Service -Name "TATERAgent" -ErrorAction SilentlyContinue

{
  "apiBase": "https://api.tatersecurity.com/api",
  "apiKey": "tater_xxxxxxxxxxxx",
  "tenantId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "organizationId": "org-xxxxxxxxxxxxxxxx",

  // Optional: app-only authentication for cloud scanning
  "appId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "certificateThumbprint": "AABBCC...",
  "organization": "contoso.onmicrosoft.com",

  // Optional: agent behavior
  "products": "All",
  "scanIntervalHours": 24,
  "controlsPath": "C:\\ProgramData\\TATER\\Controls"
}

# Detect-TATERAgent.ps1 — Intune Proactive Remediation Detection (Go agent v2.x)
$TATERDir    = Join-Path $env:ProgramData 'TATER'
$ConfigPath  = Join-Path $TATERDir 'config.json'
$LogDir      = Join-Path $TATERDir 'Logs'
$ScansDir    = Join-Path $TATERDir 'Scans'
$MaxAgeHours = 48
$issues      = @()

# 1 — Windows service installed and running
$svc = Get-Service -Name 'TATERAgent' -ErrorAction SilentlyContinue
if (-not $svc) {
    $issues += "TATERAgent Windows service not installed"
} elseif ($svc.Status -ne 'Running') {
    $issues += "TATERAgent service is $($svc.Status), expected Running"
} elseif ($svc.StartType -eq 'Disabled') {
    $issues += "TATERAgent service start type is Disabled"
}

# 2 — config.json present with required keys
if (-not (Test-Path $ConfigPath)) {
    $issues += "config.json not found at $ConfigPath"
} else {
    try {
        $cfg = Get-Content $ConfigPath -Raw | ConvertFrom-Json
        foreach ($key in @('apiBase', 'tenantId', 'organizationId')) {
            if (-not $cfg.$key) { $issues += "config.json missing required key: $key" }
        }
        if (-not $cfg.apiKey -and -not $cfg.encryptedApiKey) {
            $issues += "config.json missing apiKey or encryptedApiKey"
        }
    } catch {
        $issues += "config.json is not valid JSON: $_"
    }
}

# 3 — Recent log or scan evidence (only if service is otherwise healthy)
if ($svc -and $svc.Status -eq 'Running' -and (Test-Path $ConfigPath)) {
    $lastEvidence = $null
    if (Test-Path $LogDir) {
        $latest = Get-ChildItem -Path $LogDir -Filter 'TATER-Agent_*.log' -ErrorAction SilentlyContinue |
            Sort-Object LastWriteTime -Descending | Select-Object -First 1
        if ($latest) { $lastEvidence = $latest.LastWriteTime }
    }
    if (Test-Path $ScansDir) {
        $latest = Get-ChildItem -Path $ScansDir -Filter '*.json' -ErrorAction SilentlyContinue |
            Sort-Object LastWriteTime -Descending | Select-Object -First 1
        if ($latest -and (-not $lastEvidence -or $latest.LastWriteTime -gt $lastEvidence)) {
            $lastEvidence = $latest.LastWriteTime
        }
    }
    if (-not $lastEvidence) {
        $issues += "No agent log or scan files found — service running but agent has not produced output yet"
    } else {
        $ageHours = ((Get-Date) - $lastEvidence).TotalHours
        if ($ageHours -gt $MaxAgeHours) {
            $issues += "Agent last produced output $([math]::Round($ageHours,1))h ago (threshold: ${MaxAgeHours}h)"
        }
    }
}

if ($issues.Count -gt 0) {
    Write-Output "NON-COMPLIANT: $($issues -join ' | ')"
    exit 1
}
Write-Output "COMPLIANT: TATERAgent service running, config valid, evidence within ${MaxAgeHours}h"
exit 0

# Remediate-TATERAgent.ps1 — Intune Proactive Remediation (Go agent v2.x)
# Edit these values before deploying
$Config = @{
    apiBase               = "https://api.tatersecurity.com/api"
    apiKey                = "your-api-key"
    tenantId              = "your-azure-tenant-id"
    organizationId        = "your-org-id"
    products              = "All"
    appId                 = "your-cloud-scan-app-id"             # optional, for cloud scans
    certificateThumbprint = "your-cloud-scan-cert-thumbprint"    # optional, for cloud scans
    organization          = "your-tenant.onmicrosoft.com"        # optional, for cloud scans
    tenantEnvironment     = "commercial"  # commercial | usGovGcc | usGovGccHigh | usGovDoD
}

$TATERDir   = Join-Path $env:ProgramData 'TATER'
$ConfigPath = Join-Path $TATERDir 'config.json'
$LogDir     = Join-Path $TATERDir 'Logs'
$MSI_URL    = "https://www.tatersecurity.com/Agent/TATER-Agent.msi"
$TempDir    = "C:\Windows\Temp\TATERInstall"
$MSIPath    = Join-Path $TempDir 'TATER-Agent.msi'

function Write-Log { param([string]$m) Write-Output "[$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')] $m" }

try {
    # 1. Install MSI if service is missing
    $svc = Get-Service -Name 'TATERAgent' -ErrorAction SilentlyContinue
    if (-not $svc) {
        Write-Log "TATERAgent service not installed — downloading and installing MSI..."
        if (-not (Test-Path $TempDir)) { New-Item -ItemType Directory -Path $TempDir -Force | Out-Null }
        [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
        Invoke-WebRequest -Uri $MSI_URL -OutFile $MSIPath -UseBasicParsing -ErrorAction Stop

        # Pass required MSI properties — the MSI's GenerateConfig custom action will
        # fail the install if APIBASE / APIKEY / TENANTID / ORGANIZATIONID are missing.
        # We still rewrite config.json from $Config in step 3 below, but the MSI itself
        # must succeed first or the service is never installed. Start-Process accepts
        # an array of arguments and quotes each one automatically — no need for
        # PowerShell backtick-escape soup.
        $logPath = Join-Path $TempDir 'tater-install.log'
        $msiArgs = @(
            '/i', $MSIPath,
            '/qn',
            '/l*v', $logPath,
            "APIBASE=$($Config.apiBase)",
            "APIKEY=$($Config.apiKey)",
            "TENANTID=$($Config.tenantId)",
            "ORGANIZATIONID=$($Config.organizationId)"
        )
        $proc = Start-Process -FilePath 'msiexec.exe' -ArgumentList $msiArgs -Wait -PassThru
        if ($proc.ExitCode -ne 0 -and $proc.ExitCode -ne 3010) {
            throw "MSI install failed with exit code $($proc.ExitCode) — see $TempDir\tater-install.log"
        }
        Write-Log "MSI installed (exit code: $($proc.ExitCode))"
    } else {
        Write-Log "TATERAgent service already installed (status: $($svc.Status))"
    }

    # 2. Ensure data dir exists
    foreach ($dir in @($TATERDir, $LogDir)) {
        if (-not (Test-Path $dir)) { New-Item -ItemType Directory -Path $dir -Force | Out-Null }
    }

    # 3. Write config.json (no BOM — Go agent strips BOMs but writing clean is safer)
    Write-Log "Writing config.json..."
    $json = $Config | ConvertTo-Json -Depth 3
    [System.IO.File]::WriteAllText($ConfigPath, $json, [System.Text.UTF8Encoding]::new($false))
    Write-Log "config.json written"

    # 4. Auto-start + (re)start the service so it picks up the new config
    Set-Service -Name 'TATERAgent' -StartupType Automatic -ErrorAction Stop
    $svc = Get-Service -Name 'TATERAgent'
    if ($svc.Status -eq 'Running') {
        Write-Log "Restarting TATERAgent..."
        Restart-Service -Name 'TATERAgent' -Force -ErrorAction Stop
    } else {
        Write-Log "Starting TATERAgent..."
        Start-Service -Name 'TATERAgent' -ErrorAction Stop
    }

    # 5. Trigger an immediate one-shot scan so detection finds fresh evidence
    $exePath = (Get-WmiObject -Class Win32_Service -Filter "Name='TATERAgent'").PathName
    if ($exePath) {
        $exe = ($exePath -replace '"', '').Trim() -split ' ' | Select-Object -First 1
        if (Test-Path $exe) {
            Write-Log "Triggering one-shot scan via '$exe -scan'..."
            Start-Process -FilePath $exe -ArgumentList '-scan' -WindowStyle Hidden -ErrorAction SilentlyContinue
        }
    }

    Write-Log "SUCCESS: TATERAgent remediated"
    exit 0
} catch {
    Write-Log "ERROR: $($_.Exception.Message)"
    exit 1
} finally {
    Remove-Item -Path $MSIPath -Force -ErrorAction SilentlyContinue
}

# Group Policy software installation
# Place the MSI on a network share accessible by target machines
# Create a GPO with Software Installation pointing to:
\\fileserver\share\TATER-Agent.msi

# For SCCM, create a package with the following program command line:
msiexec /i TATER-Agent.msi /qn APIBASE="https://api.tatersecurity.com/api" APIKEY="your-key" TENANTID="your-tenant" ORGANIZATIONID="your-org"

#!/bin/bash
# tater_agent_install.sh — TATER Agent idempotent installer for Intune Platform Scripts
# Deploy via: Devices > Scripts > macOS > Add

# ── Configure these four values ────────────────────────────────────────────
API_BASE="https://api.tatersecurity.com/api"
API_KEY="your-api-key"
TENANT_ID="your-azure-tenant-id"
ORG_ID="your-org-id"
# ───────────────────────────────────────────────────────────────────────────

set -euo pipefail

ARCH=$(uname -m)
if [[ "$ARCH" == "arm64" ]]; then
    BINARY_URL="https://www.tatersecurity.com/Agent/tater-agent-darwin-arm64"
else
    BINARY_URL="https://www.tatersecurity.com/Agent/tater-agent-darwin-amd64"
fi

INSTALL_DIR="/usr/local/bin"
DATA_DIR="/Library/Application Support/TATER"
PLIST_PATH="/Library/LaunchDaemons/com.tatersecurity.agent.plist"
BINARY_PATH="$INSTALL_DIR/tater-agent"

# Download binary if not already installed or if outdated
if [[ ! -f "$BINARY_PATH" ]]; then
    curl -fsSL "$BINARY_URL" -o "$BINARY_PATH"
    chmod 755 "$BINARY_PATH"
    chown root:wheel "$BINARY_PATH"
    # CRITICAL: strip the com.apple.quarantine xattr that curl applies to downloads.
    # Without this, macOS Gatekeeper silently blocks the unsigned binary from running
    # — launchctl load reports success but the process never actually starts.
    xattr -d com.apple.quarantine "$BINARY_PATH" 2>/dev/null || true
    xattr -c "$BINARY_PATH" 2>/dev/null || true
fi

# Create data directory
mkdir -p "$DATA_DIR/Logs"

# Write config (idempotent)
cat > "$DATA_DIR/config.json" <<EOF
{
  "apiBase": "$API_BASE",
  "apiKey": "$API_KEY",
  "tenantId": "$TENANT_ID",
  "organizationId": "$ORG_ID",
  "scanIntervalHours": 24
}
EOF

# Register launchd daemon
cat > "$PLIST_PATH" <<PLIST
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key><string>com.tatersecurity.agent</string>
    <key>ProgramArguments</key>
    <array><string>$BINARY_PATH</string></array>
    <key>WorkingDirectory</key><string>$DATA_DIR</string>
    <key>RunAtLoad</key><true/>
    <key>KeepAlive</key><true/>
    <key>StandardOutPath</key><string>$DATA_DIR/Logs/tater-agent.stdout.log</string>
    <key>StandardErrorPath</key><string>$DATA_DIR/Logs/tater-agent.stderr.log</string>
</dict>
</plist>
PLIST

chmod 644 "$PLIST_PATH"
chown root:wheel "$PLIST_PATH"

# Load/reload the daemon
launchctl unload "$PLIST_PATH" 2>/dev/null || true
launchctl load "$PLIST_PATH"

echo "TATER Agent installed and started successfully."
exit 0

# Download and install (Apple Silicon)
sudo TATER_API_BASE="https://api.tatersecurity.com/api" \
     TATER_API_KEY="your-api-key" \
     TATER_TENANT_ID="your-tenant-id" \
     TATER_ORG_ID="your-org-id" \
     bash install.sh

# Check service status
launchctl list com.tatersecurity.agent

# View logs
tail -f "/Library/Application Support/TATER/Logs/tater-agent.stdout.log"

# Restart service
sudo launchctl unload /Library/LaunchDaemons/com.tatersecurity.agent.plist
sudo launchctl load /Library/LaunchDaemons/com.tatersecurity.agent.plist

# Uninstall
sudo bash uninstall.sh

# Download and install (auto-detects amd64/arm64)
sudo TATER_API_BASE="https://api.tatersecurity.com/api" \
     TATER_API_KEY="your-api-key" \
     TATER_TENANT_ID="your-tenant-id" \
     TATER_ORG_ID="your-org-id" \
     bash install.sh

# Check service status
sudo systemctl status TATERAgent

# View logs
sudo journalctl -u TATERAgent -f

# Restart service
sudo systemctl restart TATERAgent

# Uninstall
sudo tater-agent -uninstall
sudo rm /usr/local/bin/tater-agent

# 1. Service is installed and running
Get-Service -Name 'TATERAgent'
# Expected: Status = Running, StartType = Automatic

# 2. Config file is present and valid JSON
Get-Content "$env:ProgramData\TATER\config.json" | ConvertFrom-Json |
    Format-List apiBase, tenantId, organizationId
# Expected: all three fields populated; no parse errors

# 3. Agent has produced output recently (logs or scans)
Get-ChildItem "$env:ProgramData\TATER\Logs", "$env:ProgramData\TATER\Scans" `
    -Recurse -ErrorAction SilentlyContinue |
    Sort-Object LastWriteTime -Descending | Select-Object -First 5 FullName, LastWriteTime
# Expected: at least one file modified within the last hour after install

# 4. Trigger a one-shot scan if no recent output
& "$env:ProgramFiles\TATER\tater-agent.exe" -scan

# 1. LaunchDaemon is loaded and process is running
sudo launchctl print system/com.tatersecurity.agent | head -20
# Expected: state = running

# 2. Config file is present
cat "/Library/Application Support/TATER/config.json"
# Expected: apiBase, tenantId, organizationId all populated

# 3. No quarantine xattr blocking the binary (see macOS section above)
xattr /usr/local/bin/tater-agent
# Expected: no output (or no com.apple.quarantine line)

# 4. Recent log output
sudo tail -50 "/Library/Application Support/TATER/Logs/tater-agent.stdout.log"
# Expected: scan loop heartbeat or scan-completion lines

# 1. systemd service status
sudo systemctl status tater-agent
# Expected: active (running), enabled

# 2. Config file
cat /var/lib/tater/config.json
# Expected: apiBase, tenantId, organizationId populated

# 3. Recent journal output
sudo journalctl -u tater-agent -n 50 --no-pager
# Expected: scan-loop heartbeat or successful upload lines

# Run from the TATER installation directory
.\Fix-Integrity.ps1