EDR: How to Validate a Complete Sensor Install or Upgrade for macOS
search cancel

EDR: How to Validate a Complete Sensor Install or Upgrade for macOS

book

Article ID: 285245

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to validate a complete install, or upgrade, for a macOS sensor.

Environment

  • EDR Sensors: macOS 7.x and higher
  • macOS: Big Sur (11) and Monterey (12) 

Resolution

  1. Confirm the sensor is running.  Note '/Applications/VMware Carbon Black EDR.app/Contents/MacOS/CbOsxSensorService' is running.
    ps -ax | grep -i cbosx
  2. Confirm the system extension is enabled and running.  Confirm 'com.carbonblack.es-loader.es-extension' is 'activated' and 'enabled' 
    systemextensionctl list
  3. Confirm Full Disk Access.  Note: es-extension should be listed but not necessarily checked if pushed by MDM;  Should be listed and checked if manually installed.
    Check Settings > Security&Privacy > es-extension    
  4. Confirm Network Content access is enabled.  Note a Carbon Black Content Network Filter should be green and 'Running'. (The name is associated to the policy)
    Check Settings > Network 
  5. Check logs for install or upgrade errors.
    cat /var/log/cblog.log
  6. If MDM polices were used (Workspace ONE, JamF), there is the option to provide the exported profile to VMware Carbon Black Support for validation.
  7. Advanced logging messages.
    log show -start “yyyy-mm-dd hh:mm:ss" -debug | grep -i cb (use the date/timestamp of the install)
    log show -start “yyyy-mm-dd hh:mm:ss" -debug | grep -i carbonblack
    

Additional Information

  • Files to check:
/Applications/Vmware Carbon Black EDR/Contents/MacOS/CbOsxSensorServiceSensor service
/Applications/Vmware Carbon Black EDR/Contents/Resources/sensoruninst.shUninstall script
/System/Library/Extensions/CbOsxSensorNetmon.kext (macOS 10.x & earlier)Network monitor
/System/Library/Extensions/CbOsxSensorProcmon.kext (macOS 10.x & earlier)Process monitor
macOS 11.x & newer
Run systemextensionctl list [activated enabled])
User-mode monitor
/var/root/Library/Preferences/
com.carbonblack.sensor-service.plist
Settings file
/Library/Keychains/carbonblack.keychainKeychain
  • Stop & Start the sensor.
sudo launchctl unload /Library/LaunchDaemons/com.carbonblack.daemon.plist
sudo launchctl load /Library/LaunchDaemons/com.carbonblack.daemon.plist
  • Determine the version running:
/Applications/VMware\ Carbon\ Black\ EDR.app/Contents/MacOS/CbOsxSensorService -v