Backup Fails to Restore Sensor (Time Machine)

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Time Machine backup fails to restore Carbon Black Sensor on Mac machines

Environment

• Carbon Black Cloud Sensor: All Versions
  • Audit & Remediation (was CB Live Ops)
  • Endpoint Standard (was CB Defense)
  • Enterprise EDR (was CB ThreatHunter)
• Apple macOS: All Supported Versions

Cause

The sensor is intentionally excluded from backups.

Resolution

• This is by design that the sensor is intentionally excluded from backups.
• Restoration would result in the sensor being in a non-deterministic state potentially leading to backend confusion and/or duplicative logical devices reporting events.

Additional Information

Reference: CSBackupSetItemExcluded.