CB Response: How to Downgrade from macOS 6.2.7+ to Prior Versions

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to downgrade macOS sensors 6.2.7 and above to versions 6.2.6 and below

Environment

• Carbon Black Response Sensors: 6.2.7 and Above
• macOS: All Supported Versions

Resolution

Console

1. Log into the console and navigate to the sensors page
2. Select the edit button on the sensor group to downgrade
3. Navigate to the Upgrades Policy tab and select the version to downgrade to
4. Save the group and allow the sensors to check-in and get the downgrade call

Individual/Local Downgrade

1. Request the download tool from support
2. Download the tool and place directly on the endpoint. This can be executed from anywhere
3. Run the following command to verify conditions:

   $sudo ./sensor-downgrade -c

4. Run the following command to prepare for downgrade:

   $sudo ./sensor-downgrade -d

5. Run the following command to initiate the sensor installer

   $open <sensor-package>

Additional Information

• Downgrading the sensor is not normally recommended. Downgrading should only be done if absolutely necessary
• Local downgrade will require authentication via a popup on the individual machine
• This tool cannot be run via SSH. Attempts to run it will fail via SSH