Carbon Black Cloud: How to Find Sensors Installed on macOS 10.15 That Require a Reboot?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Determine if there are any machines that require a reboot after first installing the 3.3.3.x or higher Sensor onto the Catalina OS 

Environment

• Carbon Black Cloud Console: All versions
• Carbon Black Cloud Sensor: 3.3.3.35 and higher
• Apple MacOS: 10.15.x and higher

Resolution

1. Navigate to the Inventory > Endpoints page in the CBC Console
2. Enter the following search term

sensorStates:DRIVER_INIT_REBOOT_REQUIRED

3. Any systems that still require a reboot will now show on the Endpoints page and can be actioned accordingly

Additional Information

• Only machines running Catalina with a compatible Sensor that have not been rebooted after initial install should match the "sensorStates:DRIVER_INIT_REBOOT_REQUIRED" search
• Machines running Catalina with an incompatible Sensor version will enter a Bypass state but will not match the above search criteria