Environment
- Carbon Black Cloud Mac Sensor: v3.6.1.10
- macOS v12.3
Symptoms
- Significant (~90%) decrease in events and alerts from Mac endpoint
- Small subset of network and other behavior events my still occur
- Sensor appears active
Cause
Changes that Apple has made in MacOS 12.3 with regards to their internal protocols.
Resolution
Mac sensor release 3.6.2.110 resolves this issue.
Additional Notes
- Sensor 3.6.1.10 will not be available after 4/20/2022. Per CBC Mac Sensor Announcement for macOS 12.3, VMware Carbon Black strongly recommends not upgrading to MacOS 12.3 until sensor version 3.6.2.110 is installed.
- Carbon Black is planning additional sensor enhancements to better handle these types of macOS changes in the future
Related Content
