How to Enable Full Disk Access for Sensor on macOS 10.14.5 and Higher

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Allow the Sensor full disk access in order to allow Sensor full visibility into User and Application data

Environment

• Carbon Black Cloud Sensor: All Supported Versions
• Apple macOS: 10.14.5 and higher

Resolution

Manually Grant Sensor Full Disk Access
https://docs.vmware.com/en/VMware-Carbon-Black-Cloud/services/cbc-sensor-installation-guide/GUID-E17CF122-9DC4-4789-BDBD-180039DDCF31.html 

Grant the Sensor Full Disk Access by using MDM
https://docs.vmware.com/en/VMware-Carbon-Black-Cloud/services/cbc-sensor-installation-guide/GUID-210EF6DD-D850-4E5E-8C8C-EC3112785F56.html 

Additional Information

• Full Disk Access is not required for the Sensor to function, but it is required for the Sensor to be fully effective
  • What is the impact of not approving Full Disk Access (FDA) MacOS
• Granting Full Disk Access is an additional step beyond kernel extension approval and does not replace that process
• If FDA is not granted to the Sensor, end users may be prompted to grant the Sensor access when it attempts to access protected directories
• If FDA is not granted to the Sensor, the events for those machines will include "access denied" messages when the Sensor attempts to access protected directories