neagent

executablemacOS465.3 KBx86_64, arm64

Network management daemon — configures VPN, DNS, and network routing policies

Manages system-wide network configuration including VPN connections, DNS proxy services, and content filtering policies. Accesses network reachability and device connectivity state through private system frameworks. Interacts with the Keychain to store and retrieve credentials for VPN and network authentication. Exposes an XPC service for system preferences and other applications to query and modify network settings. Communicates with 8 network endpoints, likely for policy updates or authentication services.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 465.3 KB
UUID: EE2AF2A8-A1B7-3933-9425-46357038D6D4
Analyzed: 2026-04-09T09:57:05Z
CDHash: ff266fff80e76417eebc9bcec58aab81af0e770348543d3465b4d465fb6ff823

Capabilities

NetworkVPN, content filter, DNS proxy APIs

/System/Library/Frameworks/NetworkExtension.framework/Versions/A/NetworkExtension

NetworkNetwork configuration and reachability

/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration

IpcException: access additional Mach services

com.apple.security.exception.mach-lookup.global-name

com.apple.ciphermld

SecurityKeychain, certificates, code signing

/System/Library/Frameworks/Security.framework/Versions/A/Security

Frameworks10

CipherML(weak)AppSSO(weak)CoreServices NetworkExtension Security SystemConfiguration Foundation libobjc.A.dylib libSystem.B.dylib CoreFoundation

Entitlements7

com.apple.private.AppSSO.FetchNetworkCredentialstrue

com.apple.private.ciphermld.allowtrue

com.apple.private.ciphermld.dynamicUseCase.allowtrue

com.apple.private.coreservices.canmaplsdatabasetrue

com.apple.private.neagenttrue

com.apple.private.skywalk.observe-statstrue

com.apple.security.exception.mach-lookup.global-name

com.apple.ciphermld

Interesting Strings

Bundle IDs(27)

!com.apple.private.ciphermld.allow 'com.apple.private.skywalk.observe-stats /com.apple.private.coreservices.canmaplsdatabase /private/var/db/urlPrefilter/com.apple.networkextension.url-prefilter-data./private/var/db/urlPrefilter/com.apple.networkextension.url-prefilter-data.temp.

File Paths(10)

/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation /System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation /System/Library/Frameworks/NetworkExtension.framework/Versions/A/NetworkExtension /System/Library/Frameworks/Security.framework/Versions/A/Security

URLs & Endpoints(5)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><string>com.apple.compilers.llvm.clang.1_0</string>https://www.apple.com/appleca/0

Network Surface

Networking Frameworks

CoreFoundation Foundation

Endpoints(8)

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

Hostnamewww.apple.com

Hostnamemacosx26.1.internal

Urlhttp://www.apple.com/appleca/root.crl0

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

API Usage

Methods

-[NEAgentURLFilterExtension getURLFilterClientConnectionWithCompletionHandler:completionHandler:]-[NEAgentURLFilterExtension resetURLFilterCache]

DNA Capability Vector

Location

0

Keychain

0

Network

2

Storage

0

Hardware

0

IPC

1

Analytics

0

Security

1

System

0

Behavioral Profile

URL Endpoints

5

Telemetry Strings

0

File Paths

10

Bundle IDs

27

IOKit Constants

0

Library Functions

0

Structural HashesSHA-256

Codeb6ca38c8d8bfa73be9722b44edd7f733feabe3dcd1cdebe4db06452abd33becf

Imports2ed36582150bc9d51802cd9afc0126b98ea3d77aa3a42202afc8fc5515a2c634

Frameworks60ca7a20830f5b715f7836cb5852ffe63759e6602a1546fb7f99d05902029e65

Classes9e1b5e4518a12cffb36a1930a47787a2d507815cb36ed8aa0227815d6a410ab2

Entitlementscf0f582f8b75aaa663bb1e65b4d2b15cde6678a21f88c840ae10f24aba7c38a1

Symbols1d864287676090fbf888daf5b3fbf303c03bb65a869210e1cb0f80226b5732b7

Static Libraries0 / 361 functions identified

Functions(361)

0x100000fa8-[NEBloomFilter .cxx_destruct]

0x100000ff8-[NEBloomFilter setBitVectorBuffer:]

0x100001004-[NEBloomFilter bitVectorBuffer]

0x10000100c-[NEBloomFilter setTag:]

0x100001018-[NEBloomFilter tag]

0x100001020-[NEBloomFilter setMurmurSeed:]

0x100001028-[NEBloomFilter murmurSeed]

0x100001030-[NEBloomFilter setNumberOfHashes:]

0x100001038-[NEBloomFilter numberOfHashes]

0x100001040-[NEBloomFilter setNumberOfBits:]

0x100001048-[NEBloomFilter numberOfBits]

0x100001050-[NEBloomFilter setFalsePositiveTolerance:]

0x100001058-[NEBloomFilter falsePositiveTolerance]

0x100001060-[NEBloomFilter setNumberOfItems:]

0x100001068-[NEBloomFilter numberOfItems]

0x100001070-[NEBloomFilter getFilterTag]

0x1000010b8-[NEBloomFilter contains:]

0x10000115c-[NEBloomFilter insert:]

0x100001200-[NEBloomFilter initWithNumberOfItems:falsePositiveTolerance:]

0x1000013bc-[NEBloomFilter initFromFile:]

Imports169 symbols from 8 dylibs

libSystem.B.dylib81 libobjc.A.dylib32 CoreFoundation20 NetworkExtension16 Foundation9

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable

nesessionmanager

gamecontrolleragentd

peakpowermanagerd

thermalmonitord