All Products: How to find installed Carbon Black KEXTs
search cancel

All Products: How to find installed Carbon Black KEXTs

book

Article ID: 286814

calendar_today

Updated On:

Products

Carbon Black App Control (formerly Cb Protection) Carbon Black Cloud Endpoint Standard (formerly Cb Defense) Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter) Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How can installed Carbon Black kexts be found on a Mac?

Environment

  • CB Defense Sensor: All Supported Versions
  • CB Response Sensor: All Supported Versions
  • CB Protection Agent: All Supported Versions
  • Apple macOS: All Supported Versions

Resolution

To search for which Carbon Black kexts are installed on a Mac, the following commands can be run in Terminal:

CB Defense and CB Response:
kextstat | grep -s com.carbonblack

CB Protection and CB Response (6.2.3 and earlier):
kextstat | grep -s com.bit9

Any kexts returned from these commands have been installed.

Additional Information

  • CB Response Sensor Versions 6.2.3 and earlier may require both commands to see all installed kexts, as com.carbonblack and com.bit9 were used.
  • For specifics on TeamID as well as a full list of kexts for each product, see the macOS 10.13.4 Kext Approval Changes article under Related Content.
  • If any kexts are missing, the product must be reinstalled. Depending on the exact macOS version, a reboot may also be required.