Carbon Black Cloud: Why is Support requesting Full Disk Access on MacOS 10.14.5 and Above

[#1]

Environment

• Carbon Black Cloud Sensor: 3.5.1 and Higher
• Apple MacOS: 10.14.5 and Above

Question

Why is Support requesting Full Disk Access on MacOS 10.14.5 and Above

Answer

• As part of user data security enhancements in MacOS 10.14.5 and above, access to protected user and application data must be approved in order for support to collect all the necessary log data. See Full Disk Access Requirement for the macOS Sensor for more information
• If unable to allow access to full disk access, logs can be collected locally using the instructions in Carbon Black Cloud: How To Collect Sensor Logs Locally (Mac)

Additional Notes

• repcli status command will print Full Disk Access Configurations. See Endpoint Standard: How to Verify Sensor Status With RepCLI

Related Content

CB Defense: Is Granting the Sensor Full Disk Access a Requirement for macOS 10.14.5?
Carbon Black Cloud: How To Collect Sensor Logs Locally (Mac)
Uploading Diagnostic Logs to Carbon Black Support
Carbon Black Cloud: How to Get Started With RepCLI