| VMware Carbon Black Cloud 3.8.0.58 | 27 NOV 2023 | Build 3.8.0.58 Check for additions and updates to these release notes. |
What's New
VMware Carbon Black Cloud macOS Sensor 3.8.0.58 release includes features, improvements and bug fixes that are addressed in more detail here.
Note: For more information about the macOS Sensor operating systems, please see the macOS Operating Environment Requirements documentation.
Important notes:
-
This release supports macOS 12 - 14. Please refer to the macOS support link under resources for more details.
-
Sensor 3.7.2 support is terminating at the end of the year. Please plan to test and upgrade your sensor accordingly.
Resources:
Release checksums
| 3.8.0.58 DMG SHA256 Checksum |
1e2777ae5bcfb9c560fbe5c26f3cd7ae0f046d2e8fb3c057bd616fbfd02824ce |
| 3.8.0.58 PKG SHA256 Checksum |
323423bf1232d6ba76a7a6426e16600994c0e57ce8727d0443be19e23c01fd2e |
macOS 11 and KEXT support
-
Removed macOS 11 support & KEXT support
The 3.8.0 version of the macOS sensor does not support macOS 11. As a consequence, the sensor can no longer run with a kernel extension. The system extension is the only supported kernel type.
Reference Links:
Major macOS Forward Compatibility Support
On the day of Apple’s major macOS release, Carbon Black will have at least one sensor compatible and in support. Since sensor versions 3.7.2 and onward, Carbon Black offers macOS forward compatibility handling for new major macOS releases. These sensor versions will be announced as officially in support on 0-day if passing the major macOS Beta and GM qualification process, unless compatibility issues are identified during the process.
-
3.8.0 Supported Operating System, System Extension (Intel, Apple Silicon)
-
Sensor Mass-Deployment and MDM
To ensure full sensor activation at the earliest time during the sensor mass deployment, Carbon Black recommends that you preconfigure endpoints with System Extension and FDA pre-approval though MDM, using the latest MDM recommendations for Carbon Black Cloud in the sensor release DMG docs folder. Verify the MDM policy correctness using test endpoints before mass deployment of sensors.
Removable System Extension MDM
-
Removable SysEXT MDM Configuration
Apple’s macOS 12+ supports the Removable System Extension MDM policy, which is the preferred macOS-supported mechanism for facilitating seamless Carbon Black Cloud sensor upgrades and uninstallations without requiring user intervention. This policy not only streamlines these processes but also improves compatibility with macOS in an MDM-managed environment, specifically enhancing customer workflows.
Carbon Black highly recommend deploying this policy in your environment. To assist you in configuring the Carbon Black Cloud System Extension as removable in your MDM-managed environment, Carbon Black has updated the MDM configuration documentation.
You can find an updated comprehensive guidance for this configuration in the following document: Carbon Black Cloud: How To Add Removable System Ex... - Carbon Black Community.
You can find the removable system extension status under the general information section of repcli status: General Info -> System Extension -> Removable.
Reference Links:
Resolved Issues
Endpoint Standard
-
EA-20545: Improved XProtect Malware Detection
Endpoint Standard and EEDR
-
DSEN-25329: Reduced size of the application data in /Library/Application\ Support/com.vmware.carbonblack.cloud folder
-
DSEN-26760: Improved event processing and pre-execution blocking efficacy in environments with significant IPv6 traffic
-
DSEN-25726: Added further Tamper Protection enhancement for System Extension Deactivation and Uninstall protection
-
DSEN-26193: General SysEXT (se_agent) performance improvements
-
DSEN-24364: Third party library updates
LiveOps
-
DSEN-24364: Updated OSQuery engine to 5.9.1
Known Issues
The following issues are known to affect the software. Each lists the sensor version when the issue was first reported. Issues are removed after they are resolved.
-
Device Quarantine limitation with VPN per-app tunnel
Carbon Black is in contact with Apple Eng. to resolve the universal macOS limitation.
Please refer to this KB article for a workaround.
-
Unsupported workflow for migrating data from Intel to an Apple Silicon machine
Including the sensor as part of migrating data from Intel to an Apple Silicon machine (i.e. Migration Assistant) is not a supported workflow.
The recommended workflow is to uninstall the sensor before migration or exclude the sensor during migration and install it on the target machine.
