How to Validate an EDR MacOS Sensor Install or Upgrade
search cancel

How to Validate an EDR MacOS Sensor Install or Upgrade

book

Article ID: 285245

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to validate a complete install, or upgrade, for a macOS sensor.

Environment

  • EDR Sensors: macOS 7.x and higher
  • macOS: Big Sur (11) and Monterey (12) 

Resolution

  1. Confirm the sensor is running.  Note '/Applications/VMware Carbon Black EDR.app/Contents/MacOS/CbOsxSensorService' is running. 
    ps -ax | grep -i cbosx
  2. Confirm the system extension is enabled and running.  Confirm 'com.carbonblack.es-loader.es-extension' is 'activated' and 'enabled'  
    systemextensionctl list
  3. Confirm Full Disk Access.  Note: es-extension should be listed but not necessarily checked if pushed by MDM;  Should be listed and checked if manually installed. 
    Check Settings > Security&Privacy > es-extension    
  4. Confirm Network Content access is enabled.  Note a Carbon Black Content Network Filter should be green and 'Running'. (The name is associated to the policy) 
    Check Settings > Network
  5. Check logs for install or upgrade errors. 
    cat /var/log/cblog.log
  6. If MDM polices were used (Workspace ONE, JamF), there is the option to provide the exported profile to VMware Carbon Black Support for validation.
  7. Advanced logging messages. 
    log show -start “yyyy-mm-dd hh:mm:ss" -debug | grep -i cb (use the date/timestamp of the install)
log show -start “yyyy-mm-dd hh:mm:ss" -debug | grep -i carbonblack

Additional Information

  • Files to check:
/Applications/Vmware Carbon Black EDR/Contents/MacOS/CbOsxSensorService Sensor service
/Applications/Vmware Carbon Black EDR/Contents/Resources/sensoruninst.sh Uninstall script
/System/Library/Extensions/CbOsxSensorNetmon.kext (macOS 10.x & earlier) Network monitor
/System/Library/Extensions/CbOsxSensorProcmon.kext (macOS 10.x & earlier) Process monitor
macOS 11.x & newer
Run systemextensionctl list [activated enabled])		 User-mode monitor
/var/root/Library/Preferences/
com.carbonblack.sensor-service.plist		 Settings file
/Library/Keychains/carbonblack.keychain Keychain
  • Stop & Start the sensor.
sudo launchctl unload /Library/LaunchDaemons/com.carbonblack.daemon.plist
sudo launchctl load /Library/LaunchDaemons/com.carbonblack.daemon.plist
  • Determine the version running:
/Applications/VMware\ Carbon\ Black\ EDR.app/Contents/MacOS/CbOsxSensorService -v



 Additional Links: 

Powered by Wolken Software