macOS Mojave 10.14.0 - Carbon Black Defense

[ThijsX]

Hi there.

Just sharing is caring this.

Updated my machine for testing purposes to 10.14.0 and like also in the BETA's our Carbon Black Defense sensor is not working on 10.14.0 and gets in Bypass mode.

My first suggestion was that it was an KEXT not correctly loaded or something in that way.
With some help, discovered that it is just the CB Defense sensor that is not 10.14.0 compatible.

Check below for version information and compatibility, after i installed the beta it directly got out of Bypass mode.

Supported sensor and agents
Beta Sensor

Cheers

[alexjdale]

Yep, also we are jumping over an earlier 3.x version and have to add the new sensor's kext to our whitelist since it changed. I imagine this will affect others as well.

[pchen_plaid]

I was going crazy myself over this, thanks!

[sammatthews]

Got this from one of our engineers sensor for 10.14 is currently in testing. Rollout is expected 3/10/2018

[boberito]

March 10th? Or October 3rd?

[jconte]

I am hoping Oct 3.

[ThijsX]

Suprise!

Went to download sensor kits, not there yet :(

[rderewianko]

With the pending 3.2 release they also update the kext you have to whitelist.
com.carbonblack.defense.kext - 7AGZNQ2S2T

[ThijsX]

Excuse me for the late reply, new sensor had been released and seems to work fine,

Keep in mind that there are some extra parameters in the unattended install that in some cases need to be changed

somethingwithKEXT

[alexjdale]

Yes, the unattended installer script probably should be used with the --skip-kext-approval-check argument. It was receiving a false positive from their kext whitelist check (which their script blames Apple for, appropriately) and refusing to install, even though we had the proper kext whitelist MDM profile in place and working.

I appreciate how the menu icon will turn blue when the sensor is operating and grey when it's put into bypass mode.

[swapple]

Has their KEXT changed again?? I have 7AGZNQ2S2T and JA7945SK43 in my profile and am getting the System Extension Block message.