One line, from the company's install page.
Run in Terminal with sudo. It fetches the signed binary, verifies the checksum, installs the service and connects. Run it again any time; it never overwrites the machine's identity.
curl -fsSL https://hub.[yourdomain]/install/inst_…/macos.sh | sudo bash
Outbound 443 to the hub only. No inbound rule, no VPN, no SNMP community.
what the agent watches on macOSLaunchDaemonStarts at boot, restarts on failure, survives updates.Disk and memoryEvery real volume; APFS pseudo-mounts are folded.UsersWho is logged in, so checks can wait for a person.ChecksPing, DNS, URL, port, process, file age, free space, mapped share.NetworkInterfaces, gateway, DNS, external address.What it cannot doNo service or log tools on macOS today; BE AI works from the rest. questions