Validate an EDR MacOS Sensor Install or Upgrade

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to validate a complete install, or upgrade, for a macOS sensor.

Environment

• EDR Sensors: macOS 7.x and higher
• macOS: Big Sur (11) and Monterey (12) 

Resolution

1. Confirm the sensor is running. '/Applications/VMware Carbon Black EDR.app/Contents/MacOS/CbOsxSensorService' is running.

   ps -ax | grep -i cbosx

2. Confirm the system extension is enabled and running.  Confirm 'com.carbonblack.es-loader.es-extension' is 'activated' and 'enabled' 

   systemextensionctl list

3. Confirm Full Disk Access.  es-extension should be listed but not necessarily checked if pushed by MDM;  Should be listed and checked if manually installed.

   Check Settings > Security&Privacy > es-extension    

4. Confirm Network Content access is enabled.  A Carbon Black Content Network Filter should be green and 'Running'. (The name is associated to the policy)

   Check Settings > Network 

5. Check logs for install or upgrade errors.

   cat /var/log/cblog.log

6. If MDM polices were used (Workspace ONE, JamF), there is the option to provide the exported profile to support for validation.
7. Advanced logging messages.

   log show -start “yyyy-mm-dd hh:mm:ss" -debug | grep -i cb (use the date/timestamp of the install)
   log show -start “yyyy-mm-dd hh:mm:ss" -debug | grep -i carbonblack
   

Additional Information

• Files to check:

/Applications/Vmware Carbon Black EDR/Contents/MacOS/CbOsxSensorService	Sensor service
/Applications/Vmware Carbon Black EDR/Contents/Resources/sensoruninst.sh	Uninstall script
/System/Library/Extensions/CbOsxSensorNetmon.kext (macOS 10.x & earlier)	Network monitor
/System/Library/Extensions/CbOsxSensorProcmon.kext (macOS 10.x & earlier)	Process monitor
macOS 11.x & newer Run systemextensionctl list [activated enabled])	User-mode monitor
/var/root/Library/Preferences/ com.carbonblack.sensor-service.plist	Settings file
/Library/Keychains/carbonblack.keychain	Keychain

• Stop & Start the sensor.

sudo launchctl unload /Library/LaunchDaemons/com.carbonblack.daemon.plist
sudo launchctl load /Library/LaunchDaemons/com.carbonblack.daemon.plist

• Determine the version running:

/Applications/VMware\ Carbon\ Black\ EDR.app/Contents/MacOS/CbOsxSensorService -v

 Additional Links: 

• Confirm MacOS has Full Disk Access
• Verify MacOS sensor installation
• Validating MDM Policies for a complete install