Endpoint Standard: How to Identify a Supported Device for Device Control (MacOS)

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

How to identify if a USB device is supported for device control for MacOS endpoints

Environment

• Carbon Black Cloud Console: November '20 Release (0.60) and Higher
• Endpoint Standard MacOS Sensor: 3.5.3.82 and Higher
• MacOS: All Supported Versions

Resolution

• On MacOS, the RepCLI utility does not support the device all command, so unlike Windows, this is not an option for MacOS endpoints
• If the USB Mass Storage Device is reported in Carbon Black Cloud and is visible under the Inventory page, then it is supported for device control

Additional Information

• The Device Control supports only USB devices with the device type being a "Mountable Volume" and the interface type as a USB
• When device connects for the first time to an endpoint, it takes up to five minutes to synch the inventory in Carbon Black Cloud
• More examples of which devices would be supported can be found in the Inventory > USB Devices section of the User Guide