Carbon Black (response) Extension Attribute?

Thank you @scoffey

Do you happen to use a EA for Carbon Black Defense? Any issues with using both Carbon Black Defense and Carbon Black response on a Mac?

#!/bin/bash

commandList[0]="/Applications/VMware Carbon Black EDR.app/Contents/MacOS/CbOsxSensorService"
commandList[1]="/Applications/CarbonBlack/CbOsxSensorService"

arraySize=${#commandList[@]}
result="Not Installed"

validValueFound=false
index=0

while [ $index -lt $arraySize ] && [ "$validValueFound" = false ]
do
    currentCommand=${commandList[$index]}

    if [ -e "$currentCommand" ]
    then
        result=$("$currentCommand" -v | awk 'NR==1{print $0}')
        validValueFound=true
    else
        echo "currentCommand '$currentCommand' not found"
    fi
    index=$((index+1))
done

echo "<result>$result</result>"
exit 0

#!/bin/bash

if [ -e /Applications/CarbonBlack ] ; then
    RESULT=$(defaults read /Applications/CarbonBlack/CbDigitalSignatureHelper.xpc/Contents/Info.plist CFBundleShortVersionString)
    echo "<result>$RESULT</result>"
else
    echo "<result>Not Installed</result>"
fi

does this need to be modified at all as different versions of the CB response agent come into production?

Excuse my ignorance, I've not worked with ext. attributes before - is this the appropriate way to implement this?

fwiw, I used the script above to create an ext. attribute (as shown in screenshot); activated the new Extension Attribute (dubbed "carbon black status") and on a couple of test endpoints executed "sudo jamf recon" to force a checkin.

Upon doing so, the JAMF record of both test systems showed "carbon black status: not installed" even though on both endpoints in question the CB app was present and active (v3.4.2.23 on one, and 3.6.2.110 on another).

Appreciate any advise re: why this may not be reporting the correct status of the CB app

Attached screenshot of CB Cloud version from one of the test endpoints