Find macOS Sensors Where Full Disk Access (FDA) Has Not Been Granted
book
Article ID: 285061
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
Issue/Introduction
Find macOS Sensors in the console that do not have Full Disk Access (FDA) granted
Environment
Carbon Black Cloud Console
Carbon Black Cloud Sensor: 3.7.4.53 Sensor and older
Apple macOS: 10.14.5 and higher
Resolution
1. Log in to the Carbon Black Cloud Console 2. Navigate to Inventory > Endpoints 3. Use the search bar to enter the following query:
sensorStates:FULL_DISK_ACCESS_NOT_GRANTED
4. The results will populate with Sensors that do not have FDA access enabled
Additional Information
For the macOS Sensor to operate at full functionality on an endpoint that is running macOS 10.14.5 and higher, the sensor must have Full Disk Access granted.