Carbon Black Cloud: Endpoints on Big Sur reporting 10.16 instead of 11

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Operating System displays as MAC OS X 10.16.0 instead of MAC OS X 11.x
• Sensor version shows correctly locally both via About This Mac and via terminal

Environment

• Carbon Black Cloud Console: All Versions
• Carbon Black Cloud Sensor: 3.5.1.x (fixed in 3.5.2.x and Higher)
• Apple macOS: 11.0.x and Higher (Big Sur)

Cause

• 3.5.1.x Sensor built on 10.15 SDK, which reports 10.16 in response to SiUtilGetOSXSystemVersion

Resolution

Will be resolved in 3.5.2.x Sensor to correctly show Big Sur as 11.0

Additional Information

• macOS Carbon Black Cloud sensor versions 3.5.1.19 and 3.5.1.23 reported macOS Big Sur as macOS 10.16. Depending upon the mechanism software uses to poll the OS version, this is an expected result. Going forward beginning in macOS sensor version 3.5.2.x we will use a mechanism that correctly reports the OS as macOS 11.x
• Initial versions of Big Sur were marked as 10.16