Carbon Black Cloud: Can the Sensor be installed in KEXT mode on Apple M1 Silicon?
search cancel

Carbon Black Cloud: Can the Sensor be installed in KEXT mode on Apple M1 Silicon?

book

Article ID: 285068

calendar_today

Updated On:

Products

Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Can the Carbon Black Cloud (CBC) Sensor for macOS be installed in Kernel Extension (KEXT) mode on machines with the M1 chip?

Environment

  • Carbon Black Cloud Sensor: 3.5.1.19 and Higher
    • Audit & Remediation (was CB LiveOps)
    • Endpoint Standard (was CB Defense)
    • Enterprise EDR (was CB ThreatHunter)
  • Apple macOS: Big Sur and Higher

Resolution

Not currently, no.

Additional Information

  • From Release Notes for macOS
    Sensor release 3.5.1.19 introduces experimental support for the Apple Silicon M1 using the non-native, emulation mode.
    Native support for the Apple Silicon architecture will be available in a future release.
  • The 3.5.1.19 Sensor must be run in Emulation and installed in System Extension (SysEXT) mode, and Kernel Extensions (KEXTs) are not supported on M1 in emulation
  • Please see https://community.carbonblack.com/t5/Documentation-Downloads/Carbon-Black-Cloud-macOS-Big-Sur-Functionality-Overview/ta-p/97900#M105 for information on which functionality is supported for KEXT mode and SysEXT mode