EDR: Generate Apple MacOS Sensor report in 6.2.x and later

[#1]

Environment

• EDR Server: 6.0 and Higher
• EDR Sensor: 6.2.0 and Higher
• macOS: All Supported Versions

Objective

Generate a cbdiag report for an Apple MacOS endpoint running EDR Sensor version 6.2.0 and later.

Resolution

• 6.x OSX Sensor:

1. Open the Terminal app
2. Run:

sudo /Applications/CarbonBlack/sensordiag -type CDE

3. Optionally, gather logs from a specified date and later:

sudo /Applications/CarbonBlack/sensordiag -type CDE -startdate 2018-06-29

• 7.0.1+ OSX Sensor:

1. Open the Terminal app
2. Run:

sudo /Applications/VMware\ Carbon\ Black\ EDR.app/Contents/Helpers/sensordiag -type CDE

3. Optionally, gather logs from a specified date and later:

sudo /Applications/VMware\ Carbon\ Black\ EDR.app/Contents/Helpers/sensordiag -type CDE -startdate 2018-06-29

Additional Notes

• Optional -startdate parameter format is YYYY-MM-DD.
• The resulting file will be generated in the current working directory.
• Sensor reports under 25 MB can be attached directly to a Carbon Black Technical Support case. 
• Files larger than 25 MB should be uploaded to CB Vault.

Related Content

• CB Response: How to generate Apple MacOS sensor report 6.1.3 and earlier
• EDR: How to Collect Windows Sensor Diagnostics Logs (6.2.1 and below)
• EDR: How to gather Linux sensor diagnostics
• EDR: How to generate sensor logs
• EDR: How To Generate Server Diagnostic Logs for On-Prem