EDR: Momentary Network Disconnect after Mac Sensor Installation or Upgrade
book
Article ID: 287617
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
1. Temporary network disconnection 2. VPN connection may reinitialize
Environment
EDR Mac Sensor: 7.2.0-mac and higher
Apple MacOS: 11/Big Sur and later
Cause
Carbon Black EDR uses Apple's Network Extension content filter for profiling network telemetry on MacOS.
At the time of the sensor install or upgrade, all existing network connections are disconnected when the Network Extension is installed. Apple confirmed the behavior is by design when using Network Extension content filters. The behavior is limited to only sensor install and upgrade scenarios.
Resolution
No action is necessary. If the disconnection is not temporary, then upgrade to Carbon Black sensor 7.2.3-mac.