These docs cover Pulse Endpoint (paid). Pulse Lite is the free, local-only build — features such as Splunk integration, MDM deployment, the CLI, upload, and licensing don't apply to it. Compare editions →

CLI Reference

Control Pulse Endpoint from the command line for scripted deployments, troubleshooting sessions, and MDM automation.

MDM DeploymentConfiguration Reference
ArgumentDescription
--startStart monitoring (launches app if not running)
--quitQuit the app immediately
--statusPrint current status and exit
--dashboardOpen the dashboard window
--interval <sec>Set collection interval (1-10 seconds, requires --start, persists to UI)
--duration <min>Set capture duration (0-7200 minutes, requires --start, one-shot, 0 = unlimited)
--watch <name>Watch a process (requires --start, case-insensitive, trailing * matches a family, repeatable, persists until cleared)
--clear-watchClear all CLI-set watched processes (combine with --start to clear then start)
--clear-pinsClear all user-pinned processes (useful for admin/MDM scripts)
--headlessEnable headless mode (persists until --no-headless)
--no-headlessDisable headless mode
--license <key>Activate with a license key
--helpShow help message
Example Usage
# Start monitoring with 8-hour limit
/usr/local/bin/pulse --start --duration 480

# Start with 10-second collection interval for 1 hour
/usr/local/bin/pulse --start --interval 10 --duration 60

# Watch specific processes (case-insensitive; repeatable)
/usr/local/bin/pulse --start --watch "Google Chrome" --watch "zoom.us"

# Watch a process family with a trailing * (prefix match)
/usr/local/bin/pulse --start --watch "com.crowdstrike.falcon*"

# Clear CLI-set watches, then start fresh
/usr/local/bin/pulse --start --clear-watch --watch "zoom.us"

# Stop watching entirely
/usr/local/bin/pulse --clear-watch

# Check current status
/usr/local/bin/pulse --status

# Open the dashboard
/usr/local/bin/pulse --dashboard

# Quit the app
/usr/local/bin/pulse --quit

# Clear all user-pinned processes (admin use)
/usr/local/bin/pulse --clear-pins

# Switch to headless mode (with 8-hour limit)
/usr/local/bin/pulse --headless --start --duration 480

Running from Jamf or MDM Scripts

The pulse CLI wrapper at /usr/local/bin/pulse automatically handles user context elevation when run as root. This means Jamf and MDM scripts can call it directly without manual launchctl asuser handling.

Jamf Policy Script
#!/bin/bash
# Start an 8-hour monitoring session
# The pulse wrapper handles user context automatically
/usr/local/bin/pulse --start --duration 480
Stop Monitoring Script
#!/bin/bash
# Quit the Pulse Endpoint app
/usr/local/bin/pulse --quit

Important Notes for Enterprise Admins

  • User context handled automatically — The /usr/local/bin/pulse wrapper detects when run as root and automatically elevates to the logged-in user context
  • One-shot settings — --duration requires --start and is cleared after monitoring begins. It is not MDM-managed and can always be set via CLI. --interval persists to the UI settings
  • Watch persistence — --watch requires --start but, unlike --duration, persists across restarts until cleared with --clear-watch (combinable with --start in the same invocation — the clear happens first, then the new watch list applies). Matching is case-insensitive; a trailing * matches by prefix (e.g. com.crowdstrike.falcon*). MDM-managed watchedProcesses takes precedence over CLI --watch when set
  • Pinned process management — Users can pin up to 5 processes in the GUI. Admins can remotely clear all pinned processes with --clear-pins. This works whether the app is running or not. Pins use the same case-insensitive/trailing-* matching as --watch and watchedProcesses — note that pins used to prefix-match implicitly and now match exactly, so pin Google Chrome* to include helper processes
  • Headless mode persists — Unlike --duration, --headless remains enabled until explicitly disabled with --no-headless. --headless can be managed via MDM (MDM takes precedence when set). --duration is CLI-only
  • Headless requires a destination — In headless mode, monitoring only auto-starts if local storage or Splunk upload is configured. Without a destination, the app launches but won't collect
  • Duration expiry — When --duration expires, monitoring stops automatically. The app remains running (useful for viewing collected data) but won't collect new metrics until restarted
MDM DeploymentSplunk Integration