Carbon Black Cloud: How to check Kernel Type on macOS

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Provide steps to verify install mode Kernel Extension (KEXT) or System Extension (SE) after installation

Environment

• Carbon Black Cloud Sensor: 3.5.1.x and Higher
• Apple macOS: 11.0 (Big Sur) and Higher

Resolution

1. Launch terminal as sudoer or root
2. Interrogate Sensor for Kernel Type

   sudo ./Applications/VMware\ Carbon\ Black\ Cloud/repcli.bundle/Contents/MacOS/repcli status | grep 'Kernel Type'

• Output for System Extension (SE) install

  Kernel Type: System Extension

• Output for Kernel Extension (KEXT) install

  Kernel Type: Kernel Extension​​​​​​​

 

Additional Information

• Provide the output of this check when opening a Support case
• 3.4.x.x Sensors or 3.5.x.x Sensors installed on 10.15 (Catalina) or earlier will always install in KEXT mode, as the required System Extensions for the Sensor were not included prior to 11.0 (Big Sur)