Carbon Black Cloud: Why is Support requesting Full Disk Access on MacOS 10.14.5 and Above

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Why is Support requesting Full Disk Access on MacOS 10.14.5 and Above

Environment

• Carbon Black Cloud Sensor: 3.5.1 and Higher
• Apple MacOS: 10.14.5 and Above

Resolution

• As part of user data security enhancements in MacOS 10.14.5 and above, access to protected user and application data must be approved in order for support to collect all the necessary log data. See Full Disk Access Requirement for the macOS Sensor for more information
• If unable to allow access to full disk access, logs can be collected locally using the instructions in https://community.carbonblack.com/t5/Knowledge-Base/Carbon-Black-Cloud-How-To-Collect-Sensor-Logs-Locally-Mac/ta-p/35229

Additional Information

• repcli status command will print Full Disk Access Configurations. See https://community.carbonblack.com/t5/Knowledge-Base/Cb-Defense-How-to-Verify-Sensor-Status-With-RepCLI/ta-p/62524