Environment
- EDR Mac Sensor: 7.2.0-mac and higher
- Apple MacOS: 11/Big Sur and later
Symptoms
1. Temporary network disconnection
2. VPN connection may reinitialize
Cause
Carbon Black EDR uses Apple's Network Extension content filter for profiling network telemetry on MacOS.
At the time of the sensor install or upgrade, all existing network connections are disconnected when the Network Extension is installed. Apple confirmed the behavior is by design when using Network Extension content filters. The behavior is limited to only sensor install and upgrade scenarios.
Resolution
No action is necessary.
If the disconnection is not temporary, then upgrade to Carbon Black sensor 7.2.3-mac.
Related Content
