Environment
- EDR: All Versions
- Apple macOS: All Supported Versions
Question
Where are the EDR sensor files installed on macOS?
Answer
6.2.6 and earlier sensors:
| Files | Location |
|---|
| Sensor Service | /Applications/CarbonBlack/CbOsxSensorService |
| Uninstall Scripts | /Applications/CarbonBlack/sensoruninst.sh |
| Network Monitor | /System/Library/Extensions/CbOsxSensorNetmon.kext |
| Process Monitor | /System/Library/Extensions/CbOsxSensorProcmon.kext |
| Settings File | /var/lib/cb/sensorsettings.ini |
6.2.7 sensor:
| Files | Location |
|---|
| Sensor Service | /Applications/CarbonBlack/CbOsxSensorService |
| Uninstall Scripts | /Applications/CarbonBlack/sensoruninst.sh |
| Network Monitor | /System/Library/Extensions/CbOsxSensorNetmon.kext |
| Process Monitor | /System/Library/Extensions/CbOsxSensorProcmon.kext |
| Settings File | /var/root/Library/Preferences/com.carbonblack.sensor-service.plist |
6.3.0 sensor:
| Files | Location |
|---|
| Sensor Service | /Applications/Vmware Carbon Black EDR/Contents/MacOS/CbOsxSensorService |
| Uninstall Scripts | /Applications/Vmware Carbon Black EDR/Contents/Resources/sensoruninst.sh |
| Network Monitor | /System/Library/Extensions/CbOsxSensorNetmon.kext |
| Process Monitor | /System/Library/Extensions/CbOsxSensorProcmon.kext |
| Settings File | /var/root/Library/Preferences/com.carbonblack.sensor-service.plist |
7.0.1 and later sensor:
| Files | Location |
|---|
| Sensor Service | /Applications/Vmware Carbon Black EDR/Contents/MacOS/CbOsxSensorService |
| Uninstall Scripts | /Applications/Vmware Carbon Black EDR/Contents/Resources/sensoruninst.sh |
| On macOS 10.x, Network Montior | /System/Library/Extensions/CbOsxSensorNetmon.kext |
| On macOS 10.x, Process Monitor | /System/Library/Extensions/CbOsxSensorProcmon.kext |
| On macOS 11.x, User-mode Monitor | run systemextensionsctl list. Expected Output should contain com.carbonblack.es-loader.es-extension [actived/enabled] |
| Settings File | /var/root/Library/Preferences/com.carbonblack.sensor-service.plist |
Related Content
