Carbon Black Cloud: Alerts and Events showing future date/time (macOS)

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Some Alerts and Events in Console show future date and/or time
• Dates and/or times on previous and subsequent Alerts/Events are normal

Environment

• Carbon Black Cloud Console: All Versions
• Carbon Black Cloud Sensor: All Versions
• Apple macOS: All Supported Versions

Cause

Configuration changed locally to set system date & time manually

Resolution

Work with end-user to set date & time back to automatically update (using time.apple.com)

Additional Information

• The Carbon Black Cloud Sensor reports the system date and time as it is set local to the machine and does not make any changes to those settings or the dates and times reported by the system
• Changes to system date & time can be checked using any of the following

  % grep --color='always' -ani -C 2 'settimeofday' /private/var/log/system.log
  
  OR
  
  % zgrep --color=always -aRni -C 2 'settimeofday' /private/var/log/
  
  OR
  
  % log show --info --predicate 'process == "timed" and eventMessage contains "settimeofday"'