Bitdefender Endpoint Security Tools for Mac

An incompatibility issue with product version 7.4.8.200007 caused errors while playing audio files in Pro Tools 2021.

The security agent could not apply policy settings containing special characters (e.g. ö). This resulted in high CPU, memory, and disk space usage on endpoint.

On macOS Mojave (10.14) and older, the security agent created unwanted files in the root directory during installation.

In some cases, the agent indicated functionality issues, even though full disk access had been enabled for Bitdefender Endpoint Security Tools and BDLDaemon applications.

Added support for auto-approval of Bitdefender system extensions, traffic proxy and full disk access in macOS Monterey.

Added a notification in the product interface informing you when DCI proxy profile has been manually disconnected.

The product interface is now available in Turkish and Vietnamese languages.

Added support for silent installation using Setup Downloader.

Added support for product installation using Setup Downloader in Jamf Pro. The updated procedure is available with the new Bitdefender Endpoint Security Tools kits once they are released on slow ring.

The Device Control module blocked USB Ethernet devices. These devices are now mapped under the Network Adapter category.

The product interface indicated the last update time as "never" despite finishing successfully.

The cursor was active in the Change recovery key window only when the main product window was active as well.

Addressed various localization issues in the product interface.

This update enables migration to the latest version 7.4.8.200007.

Added support for auto-approval of Bitdefender system extensions, traffic proxy and full disk access in macOS Monterey.

Added a notification in the product interface informing you when DCI proxy profile has been manually disconnected.

The product interface is now available in Turkish and Vietnamese languages.

The Device Control module blocked USB Ethernet devices. These devices are now mapped under the Network Adapter category.

The product interface indicated the last update time as "never" despite finishing successfully.

The cursor was active in the Change recovery key window only when the main product window was active as well.

Addressed various localization issues in the product interface.

This update enables migration to the new product version 7.4.8.200006.

Added support for macOS Monterey (version 12).

Added support for the new features delivered with the upcoming release of GravityZone.

Endpoints did not display correct host names when connected to VPN.

The product failed to delete old files after updating signatures, causing disk space consumption.

Added support for sending to the GravityZone Control Center information regarding the user’s login sessions, such as:

Added support for scanning web traffic from Microsoft Edge.

The texts displayed during the product installation have been localized into Simplified Chinese.

The Trust button for SSL certificate has been localized into Simplified Chinese.

This version enables migration to Bitdefender Endpoint Security Tools version 7 for all endpoints, regardless of the update ring.

In a corner-case scenario, the product failed to load the update server settings as defined in the configuration files.

The field indicating the last update time was missing from the product status at the first update after installation.

Deploying the agent by using the macOS Downloader option in the GravityZone console failed in some cases due to an internal file misconfiguration.

This version includes a new event correlation engine, for Endpoint Detection and Response solutions (EDR/XDR). This update is silent, with no disruptions and no actions required from your side.

This update makes the transition towards Bitdefender Endpoint Security Tools version 7 for existing installations. Endpoints on fast ring will migrate to version 7 in one step. Endpoints on slow ring will migrate gradually, closely monitored by Bitdefender. In all cases, the update is silent, with no disruptions and no actions required from your side.

Added support for silent uninstallation of password-protected agents, using command lines. For details, refer to this topic.

Restricted access to certain product files to prevent non-privileged users from bypassing Bitdefender security settings.

Content Control. The product installs the SSL certificate only when the GravityZone security policy applied on the endpoint has the Scan SSL option enabled. In such case, after deployment on macOS Big Sur (11.x), the product requires user’s approval to install the certificate. If the certificate has been installed, but not trusted, the product requires users to trust it.

On macOS Catalina (10.15) and older versions, the product continues to install the SSL certificate without requiring users’ interaction.

EDR Sensor. The product no longer installs a separate security certificate for the Endpoint Detection and Response module.

GUI. When the SSL certificate is not installed or not trusted, and the security policy has Scan SSL enabled, the product displays a critical issue in the interface. Users are no longer prompted every three hours to allow the certificate.

On macOS Big Sur (11.x), the SSL certificate was not approved and the Scan SSL policy option was disabled.

On macOS Catalina (10.15) and older, the Scan SSL policy option was disabled when installing the agent.

Content Control.The product installs the SSL certificate only when the GravityZone security policy applied on the endpoint has the Scan SSL option enabled. In such case, after deployment on macOS Big Sur (11.x), the product requires user’s approval to install the certificate. If the certificate has been installed, but not trusted, the product requires users to trust it.

On macOS Catalina (10.15) and older versions, the product continues to install the SSL certificate without requiring users’ interaction.

EDR sensor. The product no longer installs a separate security certificate for the Endpoint Detection and Response (EDR) module.

GUI. When the SSL certificate is not installed or not trusted, and the security policy has Scan SSL enabled, the product displays a critical issue in the interface. Users are no longer prompted every three hours to allow the certificate.

The product window slowed down when the History section contained many elements.

Clearing events in the History section only worked after a product window refresh, by switching to another section or closing and reopening the window.

The product window showed up on screen after performing an update.

BDLDaemonApp crash caused Quick Scan task to stop on macOS Big Sur.

Application services restarted at the beginning of a debug session.

BDLDaemonApp crash caused Quick Scan task to stop on macOS Big Sur.

The product window showed up on screen after performing an update.

Application services restarted at the beginning of a debug session.

Antimalware

Device Control

Content Control

Full Disk Encryption

This update enables migration to the new version of Bitdefender Endpoint Security Tools with universal binaries, which will provide support for both Intel and Apple M1 processors.

Addressed an issue that affected the functionality of Bitdefender Endpoint Security Tools when upgrading the operating system to macOS Big Sur 11.3.

Added support for Content Control in macOS Big Sur.

Starting with version 11.2 of the operating system, the Content Control module is compatible with other network extensions, such as Cisco AnyConnect VPN. On Big Sur versions before 11.2, Content Control enters the passthrough mode and does not filter any connection.

For details on how Bitdefender Endpoint Security Tools works on macOS Big Sur, refer to this topic.

Using the product in silent mode created performance issues due to high memory usage.

On macOS versions before Big Sur, the Content Control module prevented large files from being uploaded while using services such as Microsoft OneDrive, Box.com, and WeTransfer.com.

The Content Control module enters the passthrough mode and stops filtering any connection when another application with a network extension is installed on the endpoint (for example, Cisco AnyConnect VPN). This happens due to an incompatibility related to the operating system.

For details about configurations required for Content Control to work in macOS Big Sur, refer to this article.

Using the product in silent mode caused performance issues in some cases.

Fixed an issue on macOS versions older than Big Sur (10.15), where the product prevented large files from being uploaded while using services such as Microsoft OneDrive, Box.com, and WeTransfer.com.

Fixed an issue causing internet speed slowdown.

Added support for macOS Big Sur (11.0). All modules and features are compatible with Big Sur, except for Content Control.

In some cases, the Antimalware module failed to generate events for individual detections during on-demand scanning.

Clicking the Bitdefender Endpoint Security Tools Help option failed to redirect the user to the product documentation.

Fixed a crash occurring on some machines during update.

In some cases, the Antimalware module failed to generate events for individual detections during on-demand scanning.

Clicking the Bitdefender Endpoint Security Tools Help option failed to redirect the user to the product documentation.

Added support for generating incidents on GravityZone Business Security Premium licensed endpoints.

Added support for upcoming features available with the next GravityZone release.

Optimized CPU usage for certain operations related to process exclusions with wildcards.

Added support for gathering logs from macOS endpoints starting with the next GravityZone release.

The screen informing users about a blocked website now supports dark mode.

In some cases, the Cancel button did not stop a scan in progress.

In some cases, the EDR module caused high CPU usage while Time Machine was creating backup files.

Modifying assignment rules for inactive policies triggered notifications in the GravityZone Control Center.

Traffic Scan blocked login to www.asana.com.

Traffic Scan blocked authentication using Duo and Okta through Cisco AnyConnect.

The product blocked login through identity card.

The product was sending events to the GravityZone console with the Device Control module disabled.

The product main window used to appear after the product silent installation.

Fixed an issue that caused a product crash on version 4.12.80.200080 on fast ring.

The product caused high disk space usage when failed to delete old dump files after a certain amount of time.

Added support for generating incidents on GravityZone Business Security Premium licensed endpoints.

Added support for upcoming features available with the next GravityZone release.

Optimized CPU usage for certain operations related to process exclusions with wildcards.

Added support for gathering logs from macOS endpoints starting with the next GravityZone release.

The screen informing users about a blocked website now supports dark mode.

In some cases, the EDR module caused high CPU usage while Time Machine was creating backup files.

Modifying assignment rules for inactive policies triggered notifications in the GravityZone Control Center.

Traffic Scan blocked login to www.asana.com.

Traffic Scan blocked authentication using Duo and Okta through Cisco AnyConnect.

The product blocked login through identity card.

The product was sending events to the GravityZone console with the Device Control module disabled.

The product main window used to appear after the product silent installation.

The product caused high disk space usage when failed to delete old dump files after a certain amount of time.

Added support for Korean in the product user interface.

In some cases, the product caused system crashes.

Improved performance upon installing applications.

In some cases, the BDLDaemon service consumed large amounts of RAM.

Using the wildcard * (asterisk) for On-Access process exclusions caused sometimes performance issues.

In some cases, the BDLDaemon service consumed large amounts of RAM.

Using the wildcard * (asterisk) for On-Access process exclusions caused sometimes performance issues.

Added support for moving endpoints between companies in GravityZone Control Center.

Improved the product graphical interface in macOS dark mode.

The product prevented files from being copied from one location to another on a Linux file server using AFP.

In some cases, the product crashed after updating to version 4.11.64.200064 on fast ring.

Encryption windows were improperly displayed in macOS High Sierra (10.13).

The Content Control module blocked certain websites on networks with proxy servers, when Traffic Scan was enabled.

Fixed incompatibilities with some apps and services that caused the following issues:

The product caused high CPU usage and system freeze in certain scenarios.

The History section displayed incorrect product and engine versions.

The About section displayed an incorrect link to Bitdefender Enterprise Support.

The product interface displayed an incomplete status message in Polish.

Added support for moving endpoints between companies in GravityZone Control Center.

Improved the product graphical interface in macOS dark mode.

The Content Control module blocked certain websites on networks with proxy servers, when Traffic Scan was enabled.

Fixed incompatibilities with some apps and services that caused the following issues:

The product caused high CPU usage and system freeze in certain scenarios.

The product blocked USB storage devices for Apple mobile accounts, although the GravityZone policy was configured to allow access.

The History section displayed incorrect product and engine versions.

The About section displayed an incorrect link to Bitdefender Enterprise Support.

The product interface displayed an incomplete status message in Polish.

Failed Time Machine backups on NAS servers.

Performance decrease on systems updated to the latest versions of Bitdefender Endpoint Security Tools.

Failed product installations through Windows Relays.

In some cases, the Content Control module has caused internet browsing to slow down after update to version 4.10.56.200056.

Added support for the following capabilities:

The product user interface is now available in Simplified Chinese. Other user interface improvements on the supported languages.

Removed from the product interface the option to exclude Time Machine backup files from scanning. The backup files continue, by default, to be scanned on-access, but not on-demand.

In some cases, an internal issue prevented the product update from version 4.9.51.200051 to 4.10.54.200054.

The Change Password option for encrypted volumes was disabled after updating from version 4.9.51.200051 to 4.10.54.200054.

In some cases, the Content Control module blocked iTunes and iCloud on Safari.

The Content Control module blocked some web radio services, such as capradio.org and tunein.com.

The product failed to detect infected archives (level 4 deep or more), when a second custom scan was started from the graphic interface.

In corner-case scenario, MacBook endpoints became unresponsive for a few seconds after login.

Added support for the following capabilities:

The product user interface is now available in Simplified Chinese. Other user interface improvements on the supported languages.

Removed from the product interface the option to exclude Time Machine backup files from scanning. The backup files continue, by default, to be scanned on-access, but not on-demand.

In some cases, the Content Control module blocked iTunes and iCloud on Safari.

The Content Control module blocked some web radio services, such as capradio.org and tunein.com.

The product failed to detect infected archives (level 4 deep or more), when a second custom scan was started from the graphic interface.

In corner-case scenario, MacBook endpoints became unresponsive for a few seconds after login.

The product now reports in real time detections and actions taken on during On-Demand scans.

The History section now displays status messages related to the Antimalware, EDR, Content Control and Full Disk Encryption modules.

On macOS Mojave (10.14), the product created a large amount of PLIST files after update.

Advanced Threat Control is now available for Mac. This module relies on a behavior anomaly detection technology that provides protection against never-before-seen threats in the on-execution stage.

Advanced Threat Control is available with any new Bitdefender Endpoint Security Tools installation. For existing installations, you must use the Reconfigure Client task from the GravityZone Control Center.

Added support for configuring Antimalware On-Access and On-Demand exclusions, in the GravityZone Control Center, with the following options:

Added support for configuring exclusions for Traffic Scan with the following options:

Added support for the option Shut down computer when scan is finished from the GravityZone Control Center.

Improved update messages in the product interface.

In some cases, the operating system became unresponsive after enabling the EDR module.

In certain situations, the product caused the operating system to become unresponsive for a few seconds during or after login.

The product did not display Update Report notifications after successfully performing a product update.

The Content Control module failed to inject the MITM certificate when creating a new Firefox profile.

The product failed to delete certain leftover files after installation via Relay.

The product update failed when no direct connection to Update Server was available.

The product caused high CPU usage with On-Access and On-Demand scanning.

In specific cases, the product was using 100% CPU when detecting malware.

Advanced Threat Control is now available for Mac. This module relies on a behavior anomaly detection technology that provides protection against never-before-seen threats in the on-execution stage.

Advanced Threat Control is available with any new Bitdefender Endpoint Security Tools installation. For existing installations, you must use the Reconfigure Client task from the GravityZone Control Center.

Added support for configuring Antimalware On-Access and On-Demand exclusions, in the GravityZone Control Center, with the following options:

Added support for configuring exclusions for Traffic Scan with the following options:

Added support for the option Shut down computer when scan is finished from the GravityZone Control Center.

Improved update messages in the product interface.

The product did not display Update Report notifications after successfully performing a product update.

The Content Control module failed to inject the MITM certificate when creating a new Firefox profile.

The product failed to delete certain leftover files after installation via Relay.

The product update failed when no direct connection to Update Server was available.

The product caused high CPU usage with On-Access and On-Demand scanning.

In specific cases, the product was using 100% CPU when detecting malware.

Official support for macOS Catalina (10.15).

Compatibility changes for macOS Catalina (10.15).

Introduced a new Antimalware technology, which uses a macOS kernel extension for on-access scanning. This technology is designed to accommodate new features like process exclusions and future enhancements.

Content Control now scans all HTTP web traffic, regardless of the browser or application performing web access. You can now configure application exclusions for Traffic Scan.

Added support for reporting Content Control detections in EDR incidents.

Added support for process exclusions, where any file accessed by an excluded process is not scanned. Process exclusions are intended to be used by advanced users or following Bitdefender Enterprise Support recommendations.

Added support for $HOME user path variable when configuring exclusions, as well as the scan target of custom scan tasks.

Added support for granular threat type reporting to the GravityZone Control Center (e.g. spyware, adware, application).

Quick Scan tasks ran from the GravityZone Control Center now scan all user folders in addition to critical system locations.

Added support for the Empty Quarantine option from the GravityZone Control Center. Now, the Empty Quarantine button is also available locally, in the Bitdefender Endpoint Security Tools interface.

The Update Virus Database option name from the Actions menu was renamed to Check for Updates.

The Encryption-related windows now display the product name ("Bitdefender Endpoint Security Tools").

The About window now displays the product engines version.

The Bitdefender kernel extension used for on-access scanning is now automatically installed on older Bitdefender Endpoint Security Tools installations where it was not already installed. In such case, on macOS 10.13+ systems, the user will be prompted to approve loading of Bitdefender kernel extensions.

In some cases, the product did not report the Antimalware module installation.

On-demand scanning tasks for local drives and removable drives did not properly work when scheduled from the GravityZone console.

The product reported an incorrect signatures version to the GravityZone console.

The Full Disk Encryption module did not take ownership of drives encrypted with FileVault when using iCloud as option for recovery.

A notification regarding the Full Disk Encryption module was displayed when enabling or disabling the On-access scanning module.

The product interface displayed simultaneous scanning tasks when one was started locally and another one from the GravityZone console.

The product reported incorrect update time in the GravityZone console after disabling the product update.

In particular cases, the EndpointSecurityforMac process was still active after removing the product with the Uninstaller utility.

The main window automatically showed up after the system restart.

The Encryption module user interface is now localized for all supported languages.

In version 4.7.30.200030, released on fast ring only, sending a Restart machine task from the GravityZone console caused the product interface to crash.

Introduced a new Antimalware technology, which uses a macOS kernel extension for on-access scanning. This technology is designed to accommodate new features like process exclusions and future enhancements.

Content Control now scans all HTTP web traffic, regardless of the browser or application performing web access. You can now configure application exclusions for Traffic Scan.

Added support for reporting Content Control detections in EDR incidents.

Added support for process exclusions, where any file accessed by an excluded process is not scanned. Process exclusions are intended to be used by advanced users or following Bitdefender Enterprise Support recommendations.

Added support for $HOME user path variable when configuring exclusions, as well as the scan target of custom scan tasks.

Added support for granular threat type reporting to the GravityZone Control Center (e.g. spyware, adware, application).

Quick Scan tasks run from the GravityZone Control Center now scan all user folders in addition to critical system locations.

Added support for the Empty Quarantine option from the GravityZone Control Center. Now, the Empty Quarantine button is also available locally, in the Bitdefender Endpoint Security Tools interface.

The Update Virus Database option name from the Actions menu was renamed to Check for Updates.

The Encryption-related windows now display the product name (Bitdefender Endpoint Security Tools).

The About window now displays the product engines version.

On-Demand scanning tasks for local drives and removable drives did not properly work when scheduled from the GravityZone Control Center.

The product reported an incorrect signatures version to the GravityZone console.

The Full Disk Encryption module did not take ownership of drives encrypted with FileVault when using iCloud as option for recovery.

A notification regarding the Full Disk Encryption module was displayed when enabling or disabling the On-Access scanning module.

The product interface displayed simultaneous scanning tasks when one was started locally and another one from the GravityZone Control Center.

The product reported incorrect update time in the GravityZone Control Center after disabling the product update.

In particular cases, the EndpointSecurityforMac process was still active after removing the product with the Uninstaller application.

The main window automatically showed up after the system restart.

The Full Disk Encryption module user interface is now localized for all supported languages.

Automatic migration of existing installations (version 4.6.20.200020 or older) to the latest version of Bitdefender Endpoint Security Tools. This migration makes possible accommodation of new features and enhancements introduced on slow ring starting with version 4.7.32.200032.

Automatically update existing installations to latest Bitdefender Endpoint Security Tools version upon upgrading the operating system to macOS Catalina (10.15).

Bitdefender Endpoint Security Tools now uses FileVault to encrypt boot drives and diskutil to encrypt non-boot drives, respectively. Depending on the drive type, the security agent automatically leverages the appropriate application, with minimal input from users.

Support for FileVault and diskutil was first introduced with version 4.6.9.200009 on fast ring, but this version comes with additional changes for Macs with T2 chips to accommodate the latest macOS updates.

Updates from version 4.6.9.200009 or later

The update only changes how boot drive decryption on Macs with T2 chips is performed.

New installations and updates from version 4.5.95.179560 or older

For Macs encrypted with FileVault, the users have to enter their credentials to start the system and unlock the boot drive at the same time. Once logged on, the system will prompt the users to unlock any encrypted non-boot drives by entering the disk password.

The product user interface now displays the EDR Sensor status.

In a particular situation, different Mac systems were displayed in the GravityZone console under the same Mac endpoint.

Traffic Scan caused file corruption when using FTP in passive mode.

Traffic Scan caused slow login to Active Directory for endpoints running High Sierra (10.13) and Mojave (10.14).

On systems with T2 chips, the password and recovery key set for full disk encryption would not unlock the boot drive. Users could unlock the boot drive only by using their system credentials. With the new encryption functionality, the user password is required to encrypt, unlock and decrypt a boot drive and, additionally, a recovery key is generated and backed up in GravityZone.

The Finder displayed an additional EFI partition on macOS Mojave (10.14) endpoints with Device Control installed, when connecting an external drive with APFS format.

Malware events were not sent to GravityZone console once a scheduled scan was finished.

The product failed to report the endpoint host name for EDR events.

Other minor improvements and bug fixes.

In some cases, the endpoint would freeze for couple of minutes during user login.

Endpoints configured to communicate via Relay were still displayed as managed in the GravityZone console after uninstall.

Malware events were not sent to GravityZone console once a scheduled scan was finished.

Endpoints deployed via Relay could not communicate with the GravityZone Control Center.

The product failed to report the endpoint host name for EDR events.

Other minor improvements and bug fixes.

The Finder displayed an additional EFI partition on macOS Mojave (10.14) endpoints with Device Control installed, when connecting an external drive with APFS format.

The product crashed once the system recovered from Sleep mode.

Starting with this version, Bitdefender Endpoint Security Tools supports full disk encryption with FileVault for boot drives and with diskutil for non-boot drives, respectively. Depending on the drive type, the security agent automatically leverages the appropriate application, with minimal input from users.

This update affects new and existing installations as follows:

For Macs encrypted with FileVault, the users have to enter their credentials to start the system and unlock the boot drive at the same time. Once logged on, the system will prompt the users to unlock any encrypted non-boot drives by entering the disk password.

The product user interface now displays the EDR Sensor status.

In a particular situation, different Mac systems were displayed in the GravityZone console under the same Mac endpoint.

Traffic Scan caused file corruption when using FTP in passive mode.

Traffic Scan caused slow login to Active Directory for endpoints running High Sierra (10.13) and Mojave (10.14).

On systems with T2 chips, the password and recovery key set for full disk encryption would not unlock the boot drive. Users could unlock the boot drive only by using their system credentials. With the new encryption functionality, the user password is required to encrypt, unlock and decrypt a boot drive and, additionally, a recovery key is generated and backed up in GravityZone.

Anti-tampering module may cause crashes to the Time Machine tmutil tool, on macOS El Capitan (10.11).

The Decryption Process window does not reappear if clicking the "X" button instead of Dismiss. The window reappears after a system restart.