EDR: Where are the sensor files installed on macOS?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Where are the EDR sensor files installed on macOS?

Environment

• EDR: All Versions
• Apple macOS: All Supported Versions

Resolution

6.2.6 and earlier sensors:

Files	Location
Sensor Service	/Applications/CarbonBlack/CbOsxSensorService
Uninstall Scripts	/Applications/CarbonBlack/sensoruninst.sh
Network Monitor	/System/Library/Extensions/CbOsxSensorNetmon.kext
Process Monitor	/System/Library/Extensions/CbOsxSensorProcmon.kext
Settings File	/var/lib/cb/sensorsettings.ini

6.2.7 sensor:

Files	Location
Sensor Service	/Applications/CarbonBlack/CbOsxSensorService
Uninstall Scripts	/Applications/CarbonBlack/sensoruninst.sh
Network Monitor	/System/Library/Extensions/CbOsxSensorNetmon.kext
Process Monitor	/System/Library/Extensions/CbOsxSensorProcmon.kext
Settings File	/var/root/Library/Preferences/com.carbonblack.sensor-service.plist

 

6.3.0 sensor:

Files	Location
Sensor Service	/Applications/Vmware Carbon Black EDR/Contents/MacOS/CbOsxSensorService
Uninstall Scripts	/Applications/Vmware Carbon Black EDR/Contents/Resources/sensoruninst.sh
Network Monitor	/System/Library/Extensions/CbOsxSensorNetmon.kext
Process Monitor	/System/Library/Extensions/CbOsxSensorProcmon.kext
Settings File	/var/root/Library/Preferences/com.carbonblack.sensor-service.plist

 

7.0.1 and later sensor:

Files	Location
Sensor Service	/Applications/Vmware Carbon Black EDR/Contents/MacOS/CbOsxSensorService
Uninstall Scripts	/Applications/Vmware Carbon Black EDR/Contents/Resources/sensoruninst.sh
On macOS 10.x, Network Montior	/System/Library/Extensions/CbOsxSensorNetmon.kext
On macOS 10.x, Process Monitor	/System/Library/Extensions/CbOsxSensorProcmon.kext
On macOS 11.x, User-mode Monitor	run systemextensionsctl list.  Expected Output should contain com.carbonblack.es-loader.es-extension [actived/enabled]
Settings File	/var/root/Library/Preferences/com.carbonblack.sensor-service.plist