Carbon Black Cloud: Significant decrease in alerts and events from Mac sensor after upgrade to MacOS 12.3
Carbon Black Cloud Mac Sensor: v22.214.171.124
Significant (~90%) decrease in events and alerts from Mac endpoint
Small subset of network and other behavior events my still occur
Sensor appears active
Changes that Apple has made in MacOS 12.3 with regards to their internal protocols.
Mac sensor release 126.96.36.199 resolves this issue.
Sensor 188.8.131.52 will not be available after 4/20/2022. Per CBC Mac Sensor Announcement for macOS 12.3, VMware Carbon Black strongly recommends not upgrading to MacOS 12.3 until sensor version 184.108.40.206 is installed.
Carbon Black is planning additional sensor enhancements to better handle these types of macOS changes in the future