Carbon Black Cloud: Significant decrease in alerts and events from Mac sensor after upgrade to MacOS 12.3
Carbon Black Cloud Mac Sensor: v188.8.131.52
Significant (~90%) decrease in events and alerts from Mac endpoint
Small subset of network and other behavior events my still occur
Sensor appears active
Changes that Apple has made in MacOS 12.3 with regards to their internal protocols.
Mac sensor release 184.108.40.206 resolves this issue.
Sensor 220.127.116.11 will not be available after 4/20/2022. Per CBC Mac Sensor Announcement for macOS 12.3, VMware Carbon Black strongly recommends not upgrading to MacOS 12.3 until sensor version 18.104.22.168 is installed.
Carbon Black is planning additional sensor enhancements to better handle these types of macOS changes in the future