This solution applies to Carbon Black OS X Sensor versions earlier than v5.1.
Carbon Black filemod event from /tmp missing the root '/' character on OS X Sensors.
For example while investigating a filemod event for the file "/tmp/test.txt", a filemod event would appear as (note the missing '/' character in the beginning of the path):
The file system uses a symlink for the /tmp directory to /private/tmp.
None. A fix is planned for v5.1 of the OS X Sensor. Refer to defect OSX-185 in future release notifications.