Supported sensor versions: 3.5.1+ Supported OS versions: macOS 10.12 and later
RepCLI is a command line tool that can be used by superusers to locally manage certain sensor functions, such as forcing cloud check-ins and printing diagnostic info.
RepCLI is included in macOS sensor versions beginning with 3.5.1
RepCLI can be used to change sensor behavior, view sensor status, and perform sensor operations without connecting to the console.
The list of available RepCLI commands can be viewed by running RepCLI with no options.
Help for a particular command can be obtained by running the Help command and providing the name of that command as an argument.
The RepCLI binary is installed to at:
/Applications/VMware Carbon Black Cloud/repcli.bundle/Contents/MacOS/repcli
Launch a terminal, and navigate to the directory:
/Applications/VMware Carbon Black Cloud/repcli.bundle/Contents/MacOS/
Run the “repcli” binary as root to view a list of available RepCLI commands, as shown below. Note: the list below is subject to change with future sensor versions.
bash-3.2$ sudo ./repcli
Supported Commands: cloud: Check in to the Carbon Black Cloud counters: Prints kernel extension diagnostic counters help: Print information on how to use CLI command(s) status: Print the sensor status version: Displays current product version
Furthermore, help for a particular command can be printed by running the “help” command with the command name as an argument, like so:
bash-3.2$ sudo ./repcli help cloud Cloud - Send the specified request to the cloud and apply the result. Usage: cloud [request_type]
Supported Request Types: Hello Metadata Push endpoint metadata to the cloud. QueryConfig Request the latest sensor configuration from the cloud. QueryRules (Default) Request the latest rule set from the cloud. RepConfig Request the latest allow list and ban list from the cloud. SensorState Push sensor state to the cloud UninstallCode Request latest uninstall code from the cloud Zip Request latest zip container configuration from the cloud.
An example of the "cloud hello" command:
bash-3.2$ sudo ./repcli cloud hello Successfully checked into backend.
An example of the "capture" command:
sudo ./repcli capture <uninstall_code> ~/Desktop Log zip successful!
Enables, disables, and checks bypass status
Generates and zips sensor logs and data
Checks in with the Carbon Black Cloud Note: There is a 60 second cooldown period between invocations of this command
Prints kernel extension diagnostic counters
Prints information on how to use CLI commands
Toggles the sensor state from SysExt to Kext
Allows setting kext load options
Toggles the sensor agent from Kext to SysExt
Prints the sensor status
Displays the current product version
Loads the sensor driver and repmgr daemon
A timestamped log of RepCLI invocations can be found at /Library/Logs/RepCLI.log. RepCLI invocations are also logged to the system log (Console).