CB Response: How to disable the Mac sensor via the CLI

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• How to disable the Mac CB Response sensor from the CLI

Environment

• CB Response: All  supported versions
• CB Response Sensor: All supported versions

Resolution

Manual Sensor Daemon Start and Stop:

1. To stop/restart the CB Response Daemon service, open a Terminal (CLI) windows and type:

• To Stop: sudo launchctl unload /Library/LaunchDaemons/com.carbonblack.daemon.plist
• To Start: sudo launchctl load /Library/LaunchDaemons/com.carbonblack.daemon.plist

Additional Information

• If CB Protection is installed on the endpoint, ensure Tamper Protection is disabled first.