EDR: How to retrieve Sensor Group preferences/settings on an OSX sensor
search cancel

EDR: How to retrieve Sensor Group preferences/settings on an OSX sensor

book

Article ID: 284955

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • As of sensor version 6.2.7 and later, the sensor settings are no longer stored on the disk at /var/lib/cb/sensorsettings.ini. Upon installation, the sensor will copy the settings from the .ini file into the new preference store object and remove the .ini file.
  • OSX Sensor 6.2.7+ settings are stored in the OSX preference store and may need to be referenced during troubleshooting.

Environment

  • EDR OSX Sensor: All Supported Versions

Resolution

  • OSX Sensors 6.2.7 and later:
    • The OSX EDR preference store file is located in this file: 
/var/root/Library/Preferences/com.carbonblack.sensor-service.plist
  • To access and/or export the OSX EDR preferences:
sudo plutil -p /var/root/Library/Preferences/com.carbonblack.sensor-service.plist
  • OSX Sensors 6.2.6 and earlier:
    • Reference the settings located in the /var/lib/cb/sensorsettings.ini file.