CB Response: macOS Crashing After Apple Security Updates Installed

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Installed latest High Sierra updates
• Endpoints crashing

Environment

• CB Response Server: All Supported Versions
• CB Response Sensor: 6.1.3.71222 and higher
• Apple macOS: 10.13.6

Cause

This issue is caused by the /usr/libexec/xpcproxy hash being banned in the environement

Resolution

Remove the /usr/libexec/xpcproxy hash from the ban list in the CB Response console