CB Defense: What determines the installed by User for an Unattended Mac Installation?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

When running an Unattended install of the CB Defense Mac Sensor, how is the "Installed By" User field in the PSC Console for the Sensor determined?

Environment

• CB Defense Sensor: 3.x and Higher
• macOS: All Supported Versions

Resolution

The Unattended install process requires the use of a Sudo command to elevate the User's permissions to complete the install. The User logged into the Terminal session that authenticates for this Sudo command is the User that appears in the "Installed By" column in the PSC Console for that Endpoint.

Additional Information

This User may vary when using a deployment utility, depending on how that deployment utility carries out the installation process. It is recommended to consult with the Vendor for additional details on how this is done.