Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Carbon Black Cloud: Significant decrease in alerts and events from Mac sensor after upgrade to MacOS 12.3

Carbon Black Cloud: Significant decrease in alerts and events from Mac sensor after upgrade to MacOS 12.3

Environment

  • Carbon Black Cloud Mac Sensor: v3.6.1.10
  • macOS v12.3

Symptoms

  • Significant (~90%) decrease in events and alerts from Mac endpoint
    • Small subset of network and other behavior events my still occur
  • Sensor appears active

Cause

Changes that Apple has made in MacOS 12.3 with regards to their internal protocols.

Resolution

Mac sensor release 3.6.2.110 resolves this issue.

Additional Notes

  • Sensor 3.6.1.10 will not be available after 4/20/2022. Per CBC Mac Sensor Announcement for macOS 12.3, VMware Carbon Black strongly recommends not upgrading to  MacOS 12.3 until sensor version 3.6.2.110 is installed. 
  • Carbon Black is planning additional sensor enhancements to better handle these types of macOS changes in the future

Related Content


Was this article helpful? Yes No
100% helpful (1/1)
Article Information
Author:
Creation Date:
‎03-15-2022
Views:
389
Contributors