Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Carbon Black Cloud: Unable to Disable Bypass on MacOS

Carbon Black Cloud: Unable to Disable Bypass on MacOS

Environment

  • Carbon Black Cloud (formerly PSC) Web Console: All Versions
  • Carbon Black Cloud Sensor: All Versions
  • Apple MacOS: All Versions

Symptoms

Why can't bypass be disabled on MacOS?

Cause

This can happen if sensors are installed or upgraded on a MacOS that isn't supported for that sensor version or if sensors do support the OS but the sensor was unable to install or initialize the driver (i.e. kext was not approved)

Resolution

To verify if the version of MacOS isn't supported for the installed sensor version enter the following search in the Endpoints page. These sensors may need to be upgraded to a version which supports this version of MacOS:
sensorStates:UNSUPPORTED_OS

If the sensor version does support the MacOS version enter the following search in the Endpoints Page to verify if the sensor was unable to initilize the driver. These devices may need to have kext approved:
sensorStates:DRIVER_INIT_ERROR

 

Related Content


Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎09-09-2020
Views:
2178
Contributors