Carbon Black Cloud: How to Check for ManifestDownloadFailure Alarms (macOS)

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Provide steps for checking on ManifestDownloadFailure alarms/errors from a local machine from the content delivery network (https://content.carbonblack.io) which provides additional configuration for 3.5.3.x and higher Sensors

Environment

• Carbon Black Cloud Console: All Versions
  • Endpoint Standard
  • Enterprise EDR
  • Audit & Remediation
  • Workload
• Carbon Black Cloud Sensor: 3.5.3.x and Higher
• Apple macOS: All Supported Versions

Resolution

1. Launch terminal emulator
2. Check for alarm in SensorAlarms.log

   sudo grep -Ein --color "ManifestDownloadFailure" /Library/Application\ Support/com.vmware.carbonblack.cloud/Logs/SensorAlarms.log

3. Output will show the dates and times of relevant alarms

   <line#>:MM/DD/YY hh:mm:ss [INFO] ... ManifestDownloadFailure, AddDownloadError: Error[Content download failed]

Additional Information

• Once changes have been made to allow access to content.carbonblack.io, the above error will stop occurring in the logs