EDR: MAC Sensor Not Collecting Events on MacOS 11.4 (Big Sur)

[#1]

Environment

• EDR Apple macOS Sensor
• Apple macOS: 11.4 (Big Sur)

Symptoms

• Events for macOS Sensors stop collecting after upgrading system to 11.4 (Big Sur)
• Following message reported in '/var/log/cblog.log' file:

request failed: The operation couldn’t be completed. (OSSystemExtensionErrorDomain error 10.)
com.carbonblack.es-loader.es-extension failed to launch

Cause

Endpoint does not have proper entitlement to allow 'com.carbonblack.es-loader.es-extension' extension to be loaded. 

Resolution

Per following document, add 'com.carbonblack.es-loader.es-extension' extension to the Allow list in JAMF:

https://community.carbonblack.com/t5/Endpoint-Detection-and-Response/Carbon-Black-EDR-Granting-macOS... 

Related Content

https://community.carbonblack.com/t5/Endpoint-Detection-and-Response/Carbon-Black-EDR-Granting-macOS...