EDR: MacOS Running Sensordiag from Live Response Session
search cancel

EDR: MacOS Running Sensordiag from Live Response Session

book

Article ID: 287637

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response) Carbon Black Hosted EDR (formerly Cb Response Cloud)

Issue/Introduction

Executing 'execfg sensordiag -type CDE' from Live Response within the directory /Applications/VMware Carbon Black EDR.app/Contents/Helpers results in the error "sh: sensordiag: command not found".

Environment

EDR Sensor: OSX 7.2.1
MacOS: OSX 10.15 - 12.1

Cause

The spaces in the directory name requires escape characters or run the command within the Helpers directory.

Resolution

A)  Run from the default directory but escape the spaces in the directory string
execfg /Applications/VMware\ Carbon\ Black\ EDR.app/Contents/Helpers/sensordiag -type DE
or
B)  Move to the correct directory and run the command locally.
cd /Applications/VMware Carbon Black EDR.app/Contents/Helpers
execfg ./sensordiag -type DE
or 
C) Run from the Content directory.
cd /Applications/VMware Carbon Black EDR.app/Contents/.
execfg Helpers/sensordiag -type CDE