EDR: MacOS Running Sensordiag from Live Response Session

Products

• Carbon Black EDR (formerly Cb Response)
• Carbon Black Hosted EDR (formerly Cb Response Cloud)

Issue/Introduction

Executing 'execfg sensordiag -type CDE' from Live Response within the directory /Applications/VMware Carbon Black EDR.app/Contents/Helpers results in the error "sh: sensordiag: command not found".

Environment

EDR Sensor: OSX 7.2.1
MacOS: OSX 10.15 - 12.1

Cause

The spaces in the directory name requires escape characters or run the command within the Helpers directory.

Resolution

A)  Run from the default directory but escape the spaces in the directory string

execfg /Applications/VMware\ Carbon\ Black\ EDR.app/Contents/Helpers/sensordiag -type DE

or
B)  Move to the correct directory and run the command locally.

cd /Applications/VMware Carbon Black EDR.app/Contents/Helpers
execfg ./sensordiag -type DE

or 
C) Run from the Content directory.

cd /Applications/VMware Carbon Black EDR.app/Contents/.
execfg Helpers/sensordiag -type CDE