What gets
installed
for DLP Agents on macOS endpoints

When the DLP Agent is installed or upgraded on a macOS endpoint, a number of components are installed. Do not disable or modify any of these components or the DLP Agent may not function correctly.
Mac agent components
Component
Description
Endpoint Agent daemon (EDPA)
The installation process places the EDPA files here:
/Library/Manufacturer/Endpoint Agent
.
The
com.symantec.manufacturer.agent.plist
file contains configuration settings for the Endpoint Agent daemon. This file is located at
/Library/LaunchDaemons/
.
Encrypted database
Each DLP Agent maintains an encrypted database at the endpoint. The database stores incident metadata in the database, contents on the host file system, and the original file that triggered the incident, if needed. The DLP Agent analyzes the content locally.
Log files
The DLP Agent logs information on completed and failed processes.
Database (
rrc.ead
)
This database maintains and contains non-matching entries for rules results caching (RRC). About rules results caching (RRC)