All Products: How to find installed Carbon Black KEXTs

Products

• Carbon Black App Control (formerly Cb Protection)
• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How can installed Carbon Black kexts be found on a Mac?

Environment

• CB Defense Sensor: All Supported Versions
• CB Response Sensor: All Supported Versions
• CB Protection Agent: All Supported Versions
• Apple macOS: All Supported Versions

Resolution

To search for which Carbon Black kexts are installed on a Mac, the following commands can be run in Terminal:

CB Defense and CB Response:

kextstat | grep -s com.carbonblack

CB Protection and CB Response (6.2.3 and earlier):

kextstat | grep -s com.bit9

Any kexts returned from these commands have been installed.

Additional Information

• CB Response Sensor Versions 6.2.3 and earlier may require both commands to see all installed kexts, as com.carbonblack and com.bit9 were used.
• For specifics on TeamID as well as a full list of kexts for each product, see the macOS 10.13.4 Kext Approval Changes article under Related Content.
• If any kexts are missing, the product must be reinstalled. Depending on the exact macOS version, a reboot may also be required.