How to Enable Full Disk Access for Sensor on macOS 10.14.5 and Higher

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Allow the Sensor full disk access in order to allow Sensor full visibility into User and Application data

Environment

• Carbon Black Cloud Sensor: All Supported Versions
• Apple macOS: 10.14.5 and higher

Resolution

Manually Grant Sensor Full Disk Access
Grant the Sensor Full Disk Access by using MDM

Additional Information

• Full Disk Access is not required for the Sensor to function, but it is required for the Sensor to be fully effective
  • What is the impact of not approving Full Disk Access (FDA) MacOS
• Granting Full Disk Access is an additional step beyond kernel extension approval and does not replace that process
• If FDA is not granted to the Sensor, end users may be prompted to grant the Sensor access when it attempts to access protected directories
• If FDA is not granted to the Sensor, the events for those machines will include "access denied" messages when the Sensor attempts to access protected directories