IMPORTANT ANNOUNCEMENT: On May 6, 2024, Carbon Black User eXchange (UeX) and Case Management will move to a new platform!
The Community will be in read-only mode starting April 19th, 7:00 AM PDT. Check out the blog post!
You will still be able to use the case portal to create and interact with your support cases until the transition, view more information here!

Cb Defense: Mac Sensor Remains in Bypass After OS Upgrade

Cb Defense: Mac Sensor Remains in Bypass After OS Upgrade

Version

Cb Defense Mac sensor - All Versions

Issue

Cb Defense Mac Sensor goes into bypass mode after OS upgrade; Protection can't be enabled after Cb Defense Mac Sensor is installed on the latest version of macOS.

Symptoms

  • The Enrollment Page shows Sensor Bypass (Admin Action) and sensor protection cannot be enabled when using the Take Action -> Disable Bypass option.
  • The device is on the latest version of macOS or sensor protection was enabled on the device until macOS was upgraded.
  • Installing the most recent sensor version available does not resolve the issue.


Cause

Cb Defense Mac Sensor performs an OS version check on installation, and if the OS version is not listed in the supported OS list for that sensor version (see Cb Protection Agent, Cb Response Sensor, & Cb Defense Sensor - Supported Operating Systems), sensor installation will complete successfully, but it will immediately go into a Bypass state until a sensor version which supports that macOS version becomes available. A request for has been added to Idea Central.  You can up-vote that idea to add increased weight and visibility to the request.

Solution

Once the new sensor version is available you can either 1.) Push that updated sensor out via Cb Defense Dashboard (see Cb Defense: How to Update Sensors from Dashboard) or 2.) Download the sensor and deploy it via Casper, JAMF, or similar.

Even though the sensor is in Bypass, as long as the device is online you will still be able to push the update with the version of the sensor that supports the OS in question at a later date when it becomes available. 

Important Notes

While the sensor is in bypass the impacted system is not being protected. Specifically, no information is being collected or sent to Cb Defense Cloud and no policy rules are enforced on the device.

Related Content

Labels (1)
Was this article helpful? Yes No
0% helpful (0/1)
Article Information
Author:
Creation Date:
‎09-27-2017
Views:
3678
Contributors