grep 'Installed' /private/var/log/install.log

Dec 22 10:55:47 MacBook-Pro OSInstaller[605]: Installed "SU_TITLE" ()
Dec 22 10:55:47 MacBook-Pro OSInstaller[605]: Installed "SU_TITLE" ()
2020-12-22 03:01:13-08 macbook-pro installd[465]: Installed "VMware Workspace ONE Intelligent Hub" ()
2020-12-22 12:02:09+01 macbook-pro installd[465]: ./postinstall: Agent Successfully Installed
2020-12-22 12:02:09+01 macbook-pro installd[465]: Installed "McAfee Agent" ()
2020-12-22 12:02:11+01 macbook-pro installd[465]: Installed "Zscaler-osx-2.1.2.38-installer (1)-2.1.2" ()
2020-12-22 12:02:27+01 MacBook-Pro installd[465]: ./postinstall: McAfee Data Exchange Layer Successfully Installed
2020-12-22 12:02:27+01 MacBook-Pro installd[465]: Installed "MFEdx-ma-6.0.0-241.x86_64" ()
2020-12-22 12:03:17+01 MacBook-Pro installd[465]: Installed "OneDrive" (20.169.0823)
2020-12-22 12:48:11+01 MacBook-Pro installd[663]: Installed "FireEye Agent" (33.22.6)
2020-12-22 12:48:24+01 MacBook-Pro system_installd[933]: Installed "MRTConfigData" (1.72)
2020-12-22 12:48:24+01 MacBook-Pro system_installd[933]: Installed "XProtectPlistConfigData" (2137)
2020-12-22 12:54:18+01 MacBook-Pro installd[663]: Installed "McAfee Endpoint Security for Mac" ()
2020-12-22 13:25:10+01 MacBook-Pro installd[769]: Installed "Pulse Secure" (9.1.9.4983)

Bash has its limitations and therefore we should migrate to a language where we can have more flexibilities (e.g. test suite)

Unload failed: 5: Input/output error

Thu Jan 28 08:27:08 CET 2021 --- You've got the McAfee Agent
Thu Jan 28 08:27:08 CET 2021 --- Unloading the McAfee Deamon(s)
Thu Jan 28 08:27:10 CET 2021 --- Unloading the McAfee Program(s)
Unload failed: 5: Input/output error
Thu Jan 28 08:27:10 CET 2021 --- Can't locate the Zscaler Agent

if [ ! -f /tmp/foo.txt ]; then
    echo "File not found!"
fi

https://stackoverflow.com/questions/638975/how-do-i-tell-if-a-regular-file-does-not-exist-in-bash

The process to kill is defined in the plist and potential could be checked and then killed.

Use itermocil to start iterm windows to watch processes during development

Check processes:

ps aux | grep xagt

$ launchctl list | grep -E 'mcafee|airwatch|xagt'

1
sudo su - root
while :; do clear; launchctl list | grep mcafee; sleep 2; done

2
while :; do clear; launchctl list | grep mcafee; sleep 2; done

3
sudo su - root
while :; do clear; launchctl list | grep airwatch; sleep 2; done

4
while :; do clear; launchctl list | grep airwatch; sleep 2; done

5
sudo su - root
while :; do clear; launchctl list | grep xagt; sleep 2; done

6
while :; do clear; launchctl list | grep xagt; sleep 2; done

Zscaler-osx-2.1.2.38-installer.app

https://opensource.com/article/18/5/you-dont-know-bash-intro-bash-arrays

Find a way to enable and disable in an automatic way

#!/bin/bash
while :;
do
clear
echo "Saoron goes to sleep"
printf '1\n' | ./stop-sauron.sh
echo "Saouron will rise in 55 minutes"
sleep 3300
printf '2\n' | ./stop-sauron.sh
echo "Saoron is awake"
sleep 300
done

https://apple.stackexchange.com/questions/29056/launchctl-difference-between-load-and-start-unload-and-stop

Add state eraser for the VPN tooling (erase cookies, erase log files)

https://linoxide.com/security/install-uninstall-mcafee-epo-agent-linux/

Itermocil is not supported anymore by MacOS 12.4, but is very handy for development.
Let's see if we can fix Itermocil of replace

First, thank you! I love this script.

but my Mac has one more little Orc...

(base) ➜/tmp # ps aux | grep Cylance
root               161   3.1  0.4  6807900 276252   ??  Ss   Mon01PM  15:16.18 /Library/Application Support/Cylance/Desktop/CylanceSvc.app/Contents/MacOS/CylanceSvc