This article describes how to manually install and approve the Carbon Black Cloud sensor on macOS Big Sur (macOS 11+).

Procedure

  1. Start the Carbon Black Cloud installer. The installer will request access to your Desktop folder. Click OK.
  2. Enter the sensor installation code. If the installation code is entered incorrectly, an error message will state that the installer cannot communicate with the Carbon Black Cloud. Check the installation code and try again.
    Company installation code
  3. When the installer finishes running, a message will notify you that you need to approve the Carbon Black Cloud system extension. Click Open Security Preferences to open the Security & Privacy pane.
  4. On the General tab in the Security & Privacy pane, a notification indicates that the VMware CBCloud system extension was blocked from loading. Enter your administrator password to unlock the pane and then click the Allow button next to the notification.
    Allow VMware CBCloud System Extension screenshot
    Note: The notification will persist until the system extension is approved, even if the endpoint is restarted. Until it is approved, the sensor will be in bypass mode.
  5. After the system extension is approved, another notification will state that the Carbon Black Cloud sensor wants to filter network content. This is required for the sensor to report network events to the Carbon Black Cloud console. Click Allow.
    Note: If you click Don't Allow instead of Allow, network events will not be sent to the backend. You can restart this prompt by running the CBCloud.app in the /Applications/VMware Carbon Black Cloud folder.
  6. To verify that the network extension is approved, go to the Network pane. An entry for VMware CBCloud will appear as a network interface.
    Network pane example