EDR: Momentary Network Disconnect after Mac Sensor Installation or Upgrade
EDR Mac Sensor: 7.2.0-mac and higher
Apple MacOS: 11/Big Sur and later
1. Temporary network disconnection 2. VPN connection may reinitialize
Carbon Black EDR uses Apple's Network Extension content filter for profiling network telemetry on MacOS.
At the time of the sensor install or upgrade, all existing network connections are disconnected when the Network Extension is installed. Apple confirmed the behavior is by design when using Network Extension content filters. The behavior is limited to only sensor install and upgrade scenarios.
No action is necessary. If the disconnection is not temporary, then upgrade to Carbon Black sensor 7.2.3-mac.