EDR: Where are the Installation Files Located on a macOS Sensor?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Where are the installation and log files stored on an macOS EDR sensor?

Environment

• EDR Sensor: All Supported Versions
• macOS: All Supported Versions

Resolution

Sensor Service Files	/Applications/VMware Carbon Black EDR.app/Contents/MacOS/CbOsxSensorService
Installation/Uninstall Log	/var/log/cblog.log /var/log/cbuninstall.log
Log File Location	/var/lib/cb
Preferences/Settings are stored in the OSX preference file	/var/root/Library/Preferences/com.carbonblack.sensor-service.plist
Uninstallation Script	/Applications/VMWare Carbon Black EDR.app/Contents/Resources/sensoruninst.sh