Environment
- EDR Sensor: 6.2.6 and Higher
- Apple macOS: 10.14.5 and higher
Objective
Allow the Sensor full disk access for Live Response capabilities
Resolution
Full Disk Access can be granted to the Sensor on individual machines
Manually Allow Full Disk Access on Individual Machines
- On the affected machine, open System Preferences
- Select Security & Privacy
- Select Privacy tab
- Select Full Disk Access
- Click the Lock symbol in lower left to authenticate with Administrator credentials
- Click the Plus (+) symbol to add an application
- Navigate to the appropriate application for your sensor and OS and click Open
6.2.6, 10.14-10.15: /Applications/CbOsxSensorService
6.2.7-7.X, 10.14-10.15: /Applications/VMware Carbon Black EDR.app/Contents/MacOS/CbOsxSensorService
7.X, 11.X: es-extension ( already be in default list, no navigation necessary, simply check the box)
- A restart is required for Full Disk Access to take affect
- Confirm setting after restart by confirming that the appropriate application appears in the list of applications with Full Disk Access
Related Content