logo

Knowledge Base

Access official resources from Carbon Black experts

IMPORTANT ANNOUNCEMENT: On May 6, 2024, Carbon Black User eXchange (UeX) and Case Management will move to a new platform!
The Community will be in read-only mode starting April 19th, 7:00 AM PDT. Check out the blog post!
You will still be able to use the case portal to create and interact with your support cases until the transition, view more information here!

Endpoint Standard: Carbon Black file is detected as XProtect False Positive in MAC Operating System.

Endpoint Standard: Carbon Black file is detected as XProtect False Positive in MAC Operating System.

Environment

  • Endpoint Standard Sensor Version: 3.5.1.13
  • Apple macOS: All Supported Versions

Symptoms

An Alert/Event will be triggered as mentioned below:
  • The file "/Applications/VMware Carbon Black Cloud/CBCloudUI.bundle/Contents/MacOS/CBCloudUI" was scanned and classified as KNOWN_MALWARE. The file has been quarantined.
  • Malware (/Applications/VMware Carbon Black Cloud/CBCloudUI.bundle/Contents/MacOS/CBCloudUI) was detected running. A Deny Action was applied by the Operating System (XProtect)".

Cause

XProtect False positives were reports on sensor executables.

Resolution

Upgrade the Mac sensor to 3.5.1.16 and above to avoid these false positives.

Related Content


Was this article helpful? Yes No
No ratings
Article Information
Author:
CB_Support
Creation Date:
‎02-23-2021
Views:
879
Contributors
logo

Copyright © 2005-2023 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.