Mac Sensor Continues To Terminate Files Based on Old Reputation

Products

• Carbon Black Cloud Enterprise EDR
• Carbon Black Cloud Endpoint Standard

Issue/Introduction

The Carbon Black Cloud macOS Sensor continues to deny or terminate files previously classified as SUSPECT_MALWARE or KNOWN_MALWARE, even after the files have had their reputation updated.

Environment

• Carbon Black Cloud Console: All versions
• CBC Mac Sensor: 3.8.x and lower
• macOS: All supported versions

Cause

This occurs due to an issue where active reputation overrides or bypass rules prevent the sensor from flushing its live kernel enforcement cache. This is being investigated in CRE-24039

Resolution

Workaround:

1. Navigate to Enforce > Reputation in the CBC Console.
2. Locate the SHA256 hash for the affected file and Remove it from the Approved List.
3. Remove any specific Path-based Bypass rules
4. Wait ~5 miinutes
5. Execute the process again. The sensor will fetch the updated TRUSTED_WHITE reputation and successfully flush the kernel cache.

Additional Information

A permanent fix is being investigated in CRE-24039