EDR: Momentary Network Disconnect after Mac Sensor Installation or Upgrade
search cancel

EDR: Momentary Network Disconnect after Mac Sensor Installation or Upgrade

book

Article ID: 287617

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

1. Temporary network disconnection
2. VPN connection may reinitialize

 

Environment

  • EDR Mac Sensor: 7.2.0-mac and higher
  • Apple MacOS: 11/Big Sur and later

Cause

Carbon Black EDR uses Apple's Network Extension content filter for profiling network telemetry on MacOS. 

At the time of the sensor install or upgrade, all existing network connections are disconnected when the Network Extension is installed.  Apple confirmed the behavior is by design when using Network Extension content filters.  The behavior is limited to only sensor install and upgrade scenarios.

Resolution

No action is necessary. 
If the disconnection is not temporary, then upgrade to Carbon Black sensor 7.2.3-mac.