Instant Silent Deployment

Use this page to deploy the Cortex sensor with Jamf. Download the profiles and the install policy from the Cortex console, then upload them to Jamf. Cortex never contacts your Jamf instance, and no Jamf credentials are ever entered anywhere outside Jamf.

The complete profile inventory

Four configuration profiles cover the whole deployment. Three you download from the console and upload to Jamf → Computer → Configuration Profiles. The fourth you build in Jamf by hand for now.

#	Profile	What it does on the Mac	Secret?	Without it
1	Enrollment token (`Cortex enrollment token.mobileconfig`)	Delivers the organization's enrollment token, a root-owned file the sensor reads at first launch.	Yes. Anyone holding it can enroll devices.	Devices never enroll. Sessions are captured but attributed to nobody.
2	Root certificate (`root.mobileconfig`)	Installs and trusts your organization's root certificate, so the sensor never asks for a password.	No	Employees get a one-time administrator password prompt per Mac.
3	Browser routing (`proxy.mobileconfig`)	Routes supported AI sites through the sensor.	No	Browsers bypass the sensor. No web capture.
4	Sensor UI lock (manual)	Runs the sensor in locked-down, tray-only mode.	No	Locked-down mode can't be enabled before first launch.

One more item is not a profile. The install policy cortex-jamf-install-policy.xml is a Jamf policy file that installs the Cortex package on every managed Mac. Without it, you install the package by hand or with your own policy.

Connect devices to people

The profiles make a Mac run the sensor. The roster says whose work it captures. It maps each device to the person using it, so the sensor can start capturing under the right name without anyone signing in.

Create the enrollment token

In the Enrollment token panel, create the organization's enrollment credential. Choose how long it stays valid (up to 30 days) and how many devices may use it (up to 100,000). Add a label if you want one. Select Create token. The token profile (#1 above) downloads with that same action, once. The console cannot show it again later, so:

Save the file right away and upload it to Jamf.
Creating a new token revokes the previous one at once. Replace the old profile in Jamf with the new download.
Treat the file like a password. Upload it, then delete the download.
Give the token a short life and a device cap, and replace it after the rollout. Anyone who can read the profile can read the token.

Upload the device list

The Device list panel sits right below it and takes the roster. Select Choose CSV file. The built-in Exporting from Jamf Pro hint shows how to pull the serial numbers out of Jamf. The file is a CSV with exactly two columns, a device reference and an employee email:

plaintext

device_ref,email
HJM4RY4N1H,michael@yourcompany.com
C02XL01MFFX1,dana@yourcompany.com

device_ref is the Mac's serial number, or an Entra device ID. Serials are matched trimmed and upper-cased. Use only letters, digits and . _ : -, up to 128 characters.
email must be an existing, active, non-service member of your organization.
Each upload takes up to 10,000 rows. Every row is checked as it saves. Anything refused comes back with a reason for that row, so you can fix it and upload again.
To find serials, go to Jamf → Computers → Search, for example a Smart Group of your rollout scope. Export the list and pair it with emails from your HR or identity provider export.

How a device gets claimed

A roster row belongs to the first device that enrolls with its serial.

At first launch, the sensor reads the enrollment token and presents its own serial. The roster matches that serial to the employee's account, the device enrolls, and every capture from that Mac is attributed to that person from then on. There is no sign-in screen and no dialog.
First claim wins. After a row is claimed, it answers only to that same Mac. A different device can't claim someone else's mapping.
Uploading a row again with the same email keeps the claim. Mapping it to a different person starts a fresh claim.
Re-imaged a Mac? Its row still points at the previous install. Select Allow re-enroll on the row before you hand the Mac out.
The roster must exist before a device checks in. An unlisted serial is refused. Every refusal answers the same way, so nobody outside can probe which serials are listed.

Where the certificate profiles come from

The Device certificate panel, in the organization's settings, is where profiles 2 and 3 download. It also shows the certificate's SHA-256 fingerprint (with a copy button) and its expiry. It offers a third file too: the root certificate as a plain .cer, for MDMs that take a certificate rather than a profile. Rotate certificate replaces the root. This is deliberate and rarely needed, because every deployed profile pins the current one.

Using each profile with Jamf

1. Enrollment token profile

Upload it, scope it to every managed Mac, and keep it secret. See Create the enrollment token.

2. Root certificate profile

Upload it and leave it installed permanently. Its trust is inert without routing, so it never needs removing. The certificate and its fingerprint travel together in this one file, which is why the same installer package works for every organization.

3. Browser routing profile

Upload it and leave it installed permanently. Only supported AI sites route through the sensor. If the sensor is stopped or missing, browsing (including Jamf's own traffic) connects directly.

4. Sensor UI lock (manual, for locked-down deployments)

Build it in Jamf. Go to Computer → Configuration Profiles → New → Application & Custom Settings → Preferences and set:

Domain: com.chaoslabs.cortex
Key: SensorUIEnabled
Type: boolean, set to false
Scope: System

After enrollment, the Cortex console governs the locked-down setting instead.

Install policy

First upload the package. Go to Jamf → Computer → Packages → New and note the name Jamf gives it. Then upload the policy file, parameterized with that package name, or recreate its settings in the Jamf UI:

Setting	Value	What it means for you
Trigger	Recurring Check-in	Existing Macs get it too. Brand-new Macs get it right after enrollment.
Frequency	Ongoing	Installs once per computer. Later check-ins re-check and never reinstall.
Scope	All Computers	Narrow it to a pilot group for a staged rollout, or enable Self Service.

The policy installs the package and nothing else. There is no script step and no ordering to manage, because the installer waits for the profiles by itself.

The 10-minute checklist

Enrollment token → Create token. Save the one-time profile download. Then go to Device list and upload the CSV.
Device certificate. Download profiles 2 and 3.
Jamf → Packages. Upload the Cortex .pkg and note its name.
Jamf → Configuration Profiles. Upload profiles 1, 2 and 3.
Jamf → Policies. Upload the install policy with that package name.
Watch the device count rise in the Deploy step of the console, and each Mac appear under its employee in Sessions.

On this page