Configure Goldfish with MDM

Set organization policies for Goldfish on managed Macs.

IT administrators can configure Goldfish on managed Macs with a device management (MDM) tool. Goldfish currently supports two managed settings.

Supported settings

Setting	Type	Default	What it does
`CaptureExclusions`	Array of strings	Empty	Apps, websites and windows Goldfish never captures, on top of its built-in list.
`AutoUpdate`	Boolean	`true`	Set to `false` to stop automatic updates. You then deploy new versions yourself.

Each entry in CaptureExclusions is one of:

Entry	Excludes
`intranet.example.com`	The site and all its subdomains.
`app:Slack`	An app, by the name shown in the app picker on Goldfish’s Ignore list page.
`title:Confidential`	Any window whose title contains the text.
`url:/hr/`	Any page whose address contains the text.
`path:payroll`	Any page with that part in its path, like `/payroll`.

Matching ignores upper and lower case. An exclusion stops future capture.

macOS

Option 1: app settings

Add custom settings to a configuration profile with the preference domain com.kaspi.goldfish, and upload this property list:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>CaptureExclusions</key>
    <array>
        <string>intranet.example.com</string>
        <string>title:Confidential</string>
    </array>
    <key>AutoUpdate</key>
    <false/>
</dict>
</plist>

Option 2: complete profile

Deploy a full .mobileconfig with a managed preferences payload. Replace both PayloadUUID values with UUIDs of your own (uuidgen makes one).

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>PayloadType</key>
            <string>com.apple.ManagedClient.preferences</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <key>PayloadIdentifier</key>
            <string>com.kaspi.goldfish.managed.preferences</string>
            <key>PayloadUUID</key>
            <string>00000000-0000-0000-0000-000000000001</string>
            <key>PayloadDisplayName</key>
            <string>Goldfish settings</string>
            <key>PayloadContent</key>
            <dict>
                <key>com.kaspi.goldfish</key>
                <dict>
                    <key>Forced</key>
                    <array>
                        <dict>
                            <key>mcx_preference_settings</key>
                            <dict>
                                <key>CaptureExclusions</key>
                                <array>
                                    <string>intranet.example.com</string>
                                    <string>title:Confidential</string>
                                </array>
                                <key>AutoUpdate</key>
                                <false/>
                            </dict>
                        </dict>
                    </array>
                </dict>
            </dict>
        </dict>
    </array>
    <key>PayloadDisplayName</key>
    <string>Goldfish</string>
    <key>PayloadIdentifier</key>
    <string>com.kaspi.goldfish.managed</string>
    <key>PayloadScope</key>
    <string>System</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>00000000-0000-0000-0000-000000000002</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
</dict>
</plist>

Windows

Managed settings are not available on Windows yet.

Goldfish picks up a new or changed profile within a minute, without a restart. Open Goldfish’s Settings, then the Ignore list page: your exclusions appear under “Set by your organization”. Removing the profile removes them.