Browse your product documentation including release notes and installers
Attention:
Support information for each Carbon Black Cloud Sensor is published on VMware Docs as distinct OERs. This UEX page will no longer be updated. Please see:
Environment
Supported sensor versions: 3.5.1+
Supported OS versions: macOS 10.12 and later
RepCLI is a command line tool that can be used by superusers to locally manage certain sensor functions, such as forcing cloud check-ins and printing diagnostic info.
The RepCLI binary is installed to at:
/Applications/VMware Carbon Black Cloud/repcli.bundle/Contents/MacOS/repcli
/Applications/VMware Carbon Black Cloud/repcli.bundle/Contents/MacOS/
bash-3.2$ sudo ./repcli Supported Commands:
cloud: Check in to the Carbon Black Cloud
counters: Prints kernel extension diagnostic counters
help: Print information on how to use CLI command(s)
status: Print the sensor status
version: Displays current product version
bash-3.2$ sudo ./repcli help cloud
Cloud - Send the specified request to the cloud and apply the result.
Usage: cloud [request_type]
Supported Request Types:
Hello
Metadata Push endpoint metadata to the cloud.
QueryConfig Request the latest sensor configuration from the cloud.
QueryRules (Default) Request the latest rule set from the cloud.
RepConfig Request the latest allow list and ban list from the cloud.
SensorState Push sensor state to the cloud
UninstallCode Request latest uninstall code from the cloud
Zip Request latest zip container configuration from the cloud.
Examples
An example of the "cloud hello" command:
bash-3.2$ sudo ./repcli cloud hello
Successfully checked into backend.
An example of the "capture" command:
sudo ./repcli capture <uninstall_code> ~/Desktop
Log zip successful!
Command |
Action |
bypass |
Enables, disables, and Check bypass mode |
capture |
Generates and zips sensor logs and data |
cloud |
Checks in with the Carbon Black Cloud Note: There is a 60 second cooldown period between invocations of this command |
counters |
Prints kernel extension diagnostic counters |
help |
Prints information on how to use CLI command(s) |
manifest |
Use to Request, Reset, Refresh manifest |
setsensorkext |
Toggles the sensor state from SysExt to Kext |
setsensorkextloadoptions |
Allows setting kext load options |
setsensorsysext |
Toggles the sensor agent from Kext to SysExt |
status |
Prints the sensor status |
version |
Displays the current product version |
startCbServices |
Loads the sensor driver and repmgr daemon |
A timestamped log of RepCLI invocations can be found at /Library/Logs/RepCLI.log. RepCLI invocations are also logged to the system log (Console).
Article |
Changes Needed |
Output is slightly different. Output format is slightly different. |
|
Output format is slightly different. Doesn’t include “total files processed”. |
|
Cb Defense: How to Force Sensor to Check Into Console With RepCLI |
Smaller subset of request types are available. ActiveDirectory authentication not relevant. There will be a one minute “cooldown” period applied to these commands when they are run. |
CB Defense: How to use RepCLI to Confirm Sensor Policy Updates |
Output format is slightly different. |
Cb Defense: How to Toggle Sensor Bypass with the RepCLI Utility |
Mac RepCLI does not support this yet. In the meantime, this can be done with the uninstall binary (-b and -n options). |
CB Defense: How to Update Virus Definition Files With RepCLI |
Not applicable to macOS. |
Not yet supported by Mac. |
|
Not applicable to macOS. This is basically a wrapper for a command in Windows command prompt. Closest equivalent in macOS might be system_profiler, but there are no plans to make a wrapper for this. In theory, this could be run from LiveResponse anyway. |
|
Not supported by the mac sensor at this time. |
|
CB Defense: How to Enable Sensor Debug Logging for Issue Reproduction with RepCLI |
Not supported by the mac sensor. |
Basically the same, except Step 1 should cd instead to /Applications/VMware Carbon Black Cloud/repcli.bundle/Contents/MacOS |
I believe the actual path to repcli is:
/Applications/VMware Carbon Black Cloud/repcli.bundle/Contents/MacOS