Skip to main content
Question

Carbon Black Response - config profile

  • July 19, 2020
  • 2 replies
  • 6 views
D
Forum|alt.badge.img+6

Hi, has anyone had any success creating a config profile to bypass the kext warning for Carbon Black Response? I opened a tix with them and got some info, did some steps on my own, but looks like we are still missing some info?

https://community.carbonblack.com/t5/Knowledge-Base/EDR-What-are-the-Team-ID-s-for-the-Cb-Response-sensor-kernel/ta-p/62187

The Team ID seems easy enough, but I wasn't sure if I need to do something under the privacy preference control to approve the app access? Basically just trying to get CBR deployed without the warning on user end...thx!

    2 replies

    G
    Forum|alt.badge.img+10
    • gabester
    • Valued Contributor
    • August 13, 2020

    @dyyuan I think you might get this to work by having both approved kernel extensions and system extensions. Note: if you're specifying the kernel extension bundle IDs or the allowed system extensions there is a new com.carbonblack.cbsystem.#5-digit-hexcode# - you can review blocked extensions from System Profiler to get an idea of what you might be missing under Apple menu > About this Mac > Overview > System Report > Software > Disabled Software.

    M
    Forum|alt.badge.img+2

    I just tried the steps below and it has worked for me.

    https://community.carbonblack.com/t5/Knowledge-Base/CB-Defense-How-to-approve-KEXT-on-JAMF/ta-p/52271

    Terms & ConditionsCookie settingsAccessibility statement