Carbon Black Cloud: How to check Kernel Type on macOS
search cancel

Carbon Black Cloud: How to check Kernel Type on macOS

book

Article ID: 290228

calendar_today

Updated On:

Products

Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Provide steps to verify install mode Kernel Extension (KEXT) or System Extension (SE) after installation

Environment

  • Carbon Black Cloud Sensor: 3.5.1.x and Higher
  • Apple macOS: 11.0 (Big Sur) and Higher

Resolution

  1. Launch terminal as sudoer or root
  2. Interrogate Sensor for Kernel Type
    sudo ./Applications/VMware\ Carbon\ Black\ Cloud/repcli.bundle/Contents/MacOS/repcli status | grep 'Kernel Type'
  • Output for System Extension (SE) install
    Kernel Type: System Extension
  • Output for Kernel Extension (KEXT) install
    Kernel Type: Kernel Extension​​​​​​​

 

Additional Information

  • Provide the output of this check when opening a Support case
  • 3.4.x.x Sensors or 3.5.x.x Sensors installed on 10.15 (Catalina) or earlier will always install in KEXT mode, as the required System Extensions for the Sensor were not included prior to 11.0 (Big Sur)