From c3e4a9d814cb7df92e15cda5546d4d8ff7e06332 Mon Sep 17 00:00:00 2001 From: "Milan M. Williams" Date: Wed, 2 Sep 2026 17:50:51 -0700 Subject: [PATCH 1/2] docs(guardian): add Fleet MDM deployment template Add a Fleet tab to the MDM options in the Guardian enterprise deployment page, alongside Jamf and Iru (Kandji). Covers the UI upload flow via Controls > OS settings > Configuration profiles, host targeting, profile status states, and the GitOps YAML equivalent. Co-Authored-By: Claude Opus 5 (1M context) --- .../enterprise-deployment.mdx | 93 +++++++++++++++++++ 1 file changed, 93 insertions(+) diff --git a/docs/semgrep-guardian/enterprise-deployment.mdx b/docs/semgrep-guardian/enterprise-deployment.mdx index 4604ed5aed..59e9e1ab47 100644 --- a/docs/semgrep-guardian/enterprise-deployment.mdx +++ b/docs/semgrep-guardian/enterprise-deployment.mdx @@ -193,6 +193,99 @@ These are community-maintained templates and may be unsupported or incorrect. Yo + + + Deploy a custom OS setting by uploading a configuration profile. + + + + Save the following as `semgrep-guardian.mobileconfig`, then replace the placeholder values: set `PayloadIdentifier` and `PayloadOrganization` to match your organization, and generate a fresh `PayloadUUID` for both the profile and the payload it contains. + + + ```xml semgrep-guardian.mobileconfig + + + + + PayloadDisplayName + Claude Code – Semgrep Guardian Plugin Settings + PayloadDescription + Enforces the Semgrep Guardian plugin enable/disable policy. + PayloadIdentifier + com.yourorg.com + PayloadOrganization + yourorg + PayloadScope + System + PayloadType + Configuration + PayloadUUID + DA9306A3-D913-47D0-95D9-0594D39CFE76 + PayloadVersion + 1 + PayloadContent + + + PayloadDisplayName + Claude Code Marketplace Settings + PayloadIdentifier + B85904F9-D6ED-4D4C-BD27-A49B9CCF0E6F + PayloadType + com.apple.ManagedClient.preferences + PayloadUUID + B85904F9-D6ED-4D4C-BD27-A49B9CCF0E6F + PayloadVersion + 1 + PayloadContent + + com.anthropic.claudecode + + Forced + + + mcx_preference_settings + + + enabledPlugins + + semgrep@claude-plugins-official + + + + + + + + + + + + ``` + + + + In the Fleet UI, go to **Controls > OS settings > Configuration profiles**, select the team you want to target in the team dropdown, then click **Add profile** and upload `semgrep-guardian.mobileconfig`. Fleet signs the profile for you. + + + Set the profile's targets to the hosts or labels that should receive Guardian. Fleet applies the profile to all macOS hosts in the selected team unless you scope it by label. + + + Fleet reports each host as **Verified**, **Verifying**, **Pending**, or **Failed**. Confirm your target hosts reach **Verified** before rolling out more widely. + + + + If you manage Fleet with GitOps instead of the UI, add the profile under the `controls` key in your team YAML: + + ```yaml + controls: + apple_settings: + configuration_profiles: + - path: ../lib/macos/profiles/semgrep-guardian.mobileconfig + ``` + + Use `labels_include_any`, `labels_include_all`, or `labels_exclude_any` alongside `path` to scope the profile by label. If you later replace the uploaded file, the replacement must keep the same `PayloadIdentifier` and `PayloadDisplayName`. For more information, see Fleet's [Configuration profiles](https://fleetdm.com/guides/custom-os-settings) guide. + + Deployment recommendations: From 3fe5c853a6936a6e5f63218f5c9f01eec0094109 Mon Sep 17 00:00:00 2001 From: "Milan M. Williams" Date: Wed, 2 Sep 2026 17:59:47 -0700 Subject: [PATCH 2/2] docs(guardian): use FleetDM as the MDM name Co-Authored-By: Claude Opus 5 (1M context) --- docs/semgrep-guardian/enterprise-deployment.mdx | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/semgrep-guardian/enterprise-deployment.mdx b/docs/semgrep-guardian/enterprise-deployment.mdx index 59e9e1ab47..6acd9bb49e 100644 --- a/docs/semgrep-guardian/enterprise-deployment.mdx +++ b/docs/semgrep-guardian/enterprise-deployment.mdx @@ -193,7 +193,7 @@ These are community-maintained templates and may be unsupported or incorrect. Yo - + Deploy a custom OS setting by uploading a configuration profile. @@ -264,17 +264,17 @@ These are community-maintained templates and may be unsupported or incorrect. Yo - In the Fleet UI, go to **Controls > OS settings > Configuration profiles**, select the team you want to target in the team dropdown, then click **Add profile** and upload `semgrep-guardian.mobileconfig`. Fleet signs the profile for you. + In the FleetDM UI, go to **Controls > OS settings > Configuration profiles**, select the team you want to target in the team dropdown, then click **Add profile** and upload `semgrep-guardian.mobileconfig`. FleetDM signs the profile for you. - Set the profile's targets to the hosts or labels that should receive Guardian. Fleet applies the profile to all macOS hosts in the selected team unless you scope it by label. + Set the profile's targets to the hosts or labels that should receive Guardian. FleetDM applies the profile to all macOS hosts in the selected team unless you scope it by label. - Fleet reports each host as **Verified**, **Verifying**, **Pending**, or **Failed**. Confirm your target hosts reach **Verified** before rolling out more widely. + FleetDM reports each host as **Verified**, **Verifying**, **Pending**, or **Failed**. Confirm your target hosts reach **Verified** before rolling out more widely. - If you manage Fleet with GitOps instead of the UI, add the profile under the `controls` key in your team YAML: + If you manage FleetDM with GitOps instead of the UI, add the profile under the `controls` key in your team YAML: ```yaml controls: @@ -283,7 +283,7 @@ These are community-maintained templates and may be unsupported or incorrect. Yo - path: ../lib/macos/profiles/semgrep-guardian.mobileconfig ``` - Use `labels_include_any`, `labels_include_all`, or `labels_exclude_any` alongside `path` to scope the profile by label. If you later replace the uploaded file, the replacement must keep the same `PayloadIdentifier` and `PayloadDisplayName`. For more information, see Fleet's [Configuration profiles](https://fleetdm.com/guides/custom-os-settings) guide. + Use `labels_include_any`, `labels_include_all`, or `labels_exclude_any` alongside `path` to scope the profile by label. If you later replace the uploaded file, the replacement must keep the same `PayloadIdentifier` and `PayloadDisplayName`. For more information, see FleetDM's [Configuration profiles](https://fleetdm.com/guides/custom-os-settings) guide.