Install the Valkan endpoint sensor
Install the macOS sensor, grant it Full Disk Access, and pair the device with your workspace.
The Valkan Sensor shows which AI tools run on employee Macs, from DNS queries, TCP connections and TLS SNI attributed to the process that made them. It does not proxy or decrypt traffic and does not collect prompts, payloads, documents or tokens.
Do these steps on each Mac you want covered. You need a local administrator account on the Mac and a Valkan account in the workspace the device should report to. The sensor is macOS only today, on Apple Silicon or Intel.
1. Download the installer
In Valkan, open Endpoint → Install sensor (or Integrations → Sources → Device sensors → Install). Choose Apple Silicon (M1 and later) or Intel. Use Verify checksums to compare the download with the published SHA-256 manifest.
If the panel says the installer isn't published yet, the release is still publishing; check back rather than using a build from elsewhere.
2. Run the installer
Open the downloaded DMG and double-click the .pkg inside. The installer asks for an administrator password.
The installer is not yet Apple-notarized, so macOS may refuse to open it with a message that it cannot verify the package is free of malware. To continue:
- open System Settings → Privacy & Security, scroll to Security, click Open Anyway, and run the installer again; or
- install from Terminal, which skips that check:
sudo installer -pkg "/Volumes/Valkan Sensor <version>/ValkanSensor-<version>.pkg" -target /
Confirm that Valkan Sensor is in Applications when it finishes.
3. Grant Full Disk Access
Open System Settings → Privacy & Security → Full Disk Access, turn on Valkan Sensor, then quit and relaunch it. Without this, events can arrive without the process that made them. Granting access to Terminal does not grant it to the sensor.
Upgrading from a Tara Sensor install? Grant Full Disk Access again: the grant does not carry over to the renamed app. MDM privacy profiles must name com.valkan.sensor.
4. Start monitoring
Click the ▽ icon in the macOS menu bar and choose Start Monitoring. Capture runs locally from this point; the device does not report to Valkan until it is paired.
5. Pair the device with your workspace
- In the menu bar app, open Settings and check that Valkan URL is the address you use to sign in to Valkan.
- Choose Connect to Fleet…. The sensor shows a pairing code such as
VALKAN-XXXX-XXXXand opens Valkan's approval page. - Sign in to the right workspace and enter the code. Optionally enter the owner's work email to link the device to that person in your identity providers; an administrator can set it later.
Any signed-in user can approve a code; it does not need an administrator. A code expires: if it does, choose Connect to Fleet… again for a new one.
6. Check that it reports
The device appears on Endpoint → Fleet within a few seconds and shows warming up until its first summary arrives, about a minute later. Fleet is visible to administrators.
| Symptom | Check |
|---|---|
| Installer finished but no app | That Valkan Sensor is in Applications; run the installer again |
| Events have no process name | Full Disk Access for Valkan Sensor, then quit and relaunch |
| Pairing fails at once | Settings → Valkan URL and that this Mac can reach it |
| Paired but no data | Start Monitoring is on; capture and pairing are separate steps |
Stop Monitoring stops capture on the Mac. Disconnecting the device stops delivery to Valkan. They are separate controls.
For what the Endpoint page shows once data arrives, see Endpoint activity.