Endpoint Standard: Why are There MacOS Blocks Reported by Gatekeeper or Xprotect in the Console?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Why are there blocks appearing in the console as "The file "/XYZ" attempted to run on MacOS. The file has been blocked by GateKeeper or XProtect"?

Environment

• Carbon Black Cloud Web Console: All Versions
• Carbon Black Cloud macOS Sensor: All Supported Versions 
• Apple macOS: All Supported Versions

Resolution

• Endpoint Standard is only reporting an OS operation and the product is not performing any blocks.
• The 3.7.4 MacOS sensor should help reduce the noise caused by these events.

Additional Information

These events are safe to ignore and can use the dismiss all with the If this alert occurs in the future, automatically dismiss it from all devices checked off to avoid these in the console.