EDR: Momentary Network Disconnect after Mac Sensor Installation or Upgrade
Article ID: 287617
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
1. Temporary network disconnection
2. VPN connection may reinitialize
2. VPN connection may reinitialize
Environment
- EDR Mac Sensor: 7.2.0-mac and higher
- Apple MacOS: 11/Big Sur and later
Cause
Carbon Black EDR uses Apple's Network Extension content filter for profiling network telemetry on MacOS.
At the time of the sensor install or upgrade, all existing network connections are disconnected when the Network Extension is installed. Apple confirmed the behavior is by design when using Network Extension content filters. The behavior is limited to only sensor install and upgrade scenarios.
At the time of the sensor install or upgrade, all existing network connections are disconnected when the Network Extension is installed. Apple confirmed the behavior is by design when using Network Extension content filters. The behavior is limited to only sensor install and upgrade scenarios.
Resolution
No action is necessary.
If the disconnection is not temporary, then upgrade to Carbon Black sensor 7.2.3-mac.
If the disconnection is not temporary, then upgrade to Carbon Black sensor 7.2.3-mac.
Feedback
Yes
No
Powered by
