Carbon Black Cloud: Is Apple M1 silicon supported?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Is M1 silicon supported for the Carbon Black Cloud (CBC) Sensor?

Environment

• Carbon Black Cloud Sensor: 3.6.1.10
• Apple macOS: All Supported Version
• Apple M1 Silicon hardware (ARM-based architecture, system on a chip)

Resolution

Yes, as of Sensor version 3.6.1.10

Additional Information

• For previous versions of the sensor (pre-3.6.0.1.10), this is not supported natively, and the CBC Sensor can only be installed in System Extension (SE) Mode in Emulation.
• From Release Notes for macOS

  Sensor release 3.5.1.19 introduces experimental support for the Apple Silicon M1 using the non-native, emulation mode.
  Native support for the Apple Silicon architecture will be available in a future release.

• The 3.5.1.23 Sensor must be run in Emulation and installed in System Extension (SysEXT) mode
• Kernel Extensions (KEXTs) are not supported on M1 in emulation
• Please see https://community.carbonblack.com/t5/Documentation-Downloads/Carbon-Black-Cloud-macOS-Big-Sur-Functionality-Overview/ta-p/97900#M105 for information on which functionality is supported for KEXT mode and SysEXT mode