EDR: How to Use Removable System Extension Configuration in MDM

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to use Removable System Extentions to remove the sensor

Environment

• EDR Sensor: All Supported Versions
• MacOS: All Supported Versions

Resolution

MDM System Extension Approval Configuration - To construct the correct configuration, specify the Apple Team ID and System Extension bundle ID in the configuration profile

• Deactivation approval configuration
  • Section:  Removable System Extensions
  • Apple Team ID: 7AGZNQ2S2T
  • System Extension Bundle ID: com.carbonblack.es-loader.es-extension