Carbon Black Cloud: How to Find macOS Sensors Where Full Disk Access (FDA) Has Not Been Granted

[#1]

Environment

• Carbon Black Cloud Console
• Carbon Black Cloud Sensor: All Supported Versions
• Apple macOS: 10.14.5 and higher

Objective

Search for macOS Sensors in the console that do not have Full Disk Access (FDA) granted 

Resolution

1. Log in to the Carbon Black Cloud Console
2. Navigate to Inventory > Endpoints
3. Use the search bar to enter the following query:

sensorStates:FULL_DISK_ACCESS_NOT_GRANTED

4. The results will populate with Sensors that do not have FDA access enabled
 

Additional Notes

• For the macOS Sensor to operate at full functionality on an endpoint that is running macOS 10.14.5 and higher, the sensor must have Full Disk Access granted. 
• To enable Full Disk Access on a Sensor, use the walk-through linked here: Carbon Black Cloud: How to Enable Full Disk Access for Sensor on macOS 10.14.5 and Higher