EDR: MAC Sensor Not Collecting Events on MacOS 11.4 (Big Sur)

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Events for macOS Sensors stop collecting after upgrading system to 11.4 (Big Sur)
• Following message reported in '/var/log/cblog.log' file:

request failed: The operation couldn’t be completed. (OSSystemExtensionErrorDomain error 10.)
com.carbonblack.es-loader.es-extension failed to launch

 

 

 

Environment

• EDR Apple macOS Sensor
• Apple macOS: 11.4 (Big Sur)

Cause

Endpoint does not have proper entitlement to allow 'com.carbonblack.es-loader.es-extension' extension to be loaded. 

Resolution

Per following document, add 'com.carbonblack.es-loader.es-extension' extension to the Allow list in JAMF:

https://community.carbonblack.com/t5/Endpoint-Detection-and-Response/Carbon-Black-EDR-Granting-macOS-Sensor-Access-on-macOS-11/ta-p/96914