Carbon Black Cloud: What are the Reboot Requirements for Installing Sensor on macOS?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

What are the reboot requirements when installing a Sensor on a Mac running Catalina (10.15)? 

Environment

• Carbon Black Console: All versions
• Carbon Black Cloud Sensor: 3.3.3.35 and higher
• Apple macOS: 10.15.x and higher

Resolution

New Sensor Installs

• A reboot is required whenever installing a new Sensor to the Catalina operating system.  

Existing Sensors

• Upgrading the Sensor from 3.1.x.x or higher to 3.3.3.x or higher should not require a reboot
• If upgrading the Sensor from 3.0.x.x to 3.3.3.x or higher, a reboot will be required in addition to approving a new KEXT

NOTE: Upgrading the OS to Catalina prior to upgrading the Sensor to 3.3.3.35 will result in the Sensor entering Bypass; best practice is to upgrade the Sensor to 3.3.35 prior to upgrading the OS to Catalina

Additional Information

• Best practice prior to updating an operating system is to first upgrade the Sensor to a version compatible with the target OS version
• If the OS is upgraded to Catalina with a 3.3.2.58 or lower Sensor and the Sensor enters bypass, the Sensor can be upgraded to 3.3.3.35 to bring the Sensor out of Bypass
• New KEXT installations will not load on Catalina until the system is rebooted due to the new Apple requirement 50340461
• Other macOS versions may also require a reboot for kext approval please refer to OS requirements