VMware Carbon Black Cloud 3.8.0.58 | 27 NOV 2023 | Build 3.8.0.58

Check for additions and updates to these release notes.

What's New

VMware Carbon Black Cloud macOS Sensor 3.8.0.58 release includes features, improvements and bug fixes that are addressed in more detail here.

Note: For more information about the macOS Sensor operating systems, please see the macOS Operating Environment Requirements documentation.

Important notes:

  • This release supports macOS 12 - 14. Please refer to the macOS support link under resources for more details.

  • Sensor 3.7.2 support is terminating at the end of the year. Please plan to test and upgrade your sensor accordingly.

Resources:

Release checksums

3.8.0.58 DMG SHA256 Checksum

1e2777ae5bcfb9c560fbe5c26f3cd7ae0f046d2e8fb3c057bd616fbfd02824ce

3.8.0.58 PKG SHA256 Checksum

323423bf1232d6ba76a7a6426e16600994c0e57ce8727d0443be19e23c01fd2e

macOS 11 and KEXT support

Major macOS Forward Compatibility Support

On the day of Apple’s major macOS release, Carbon Black will have at least one sensor compatible and in support. Since sensor versions 3.7.2 and onward, Carbon Black offers macOS forward compatibility handling for new major macOS releases. These sensor versions will be announced as officially in support on 0-day if passing the major macOS Beta and GM qualification process, unless compatibility issues are identified during the process.

  • 3.8.0 Supported Operating System, System Extension (Intel, Apple Silicon)

  • Sensor Mass-Deployment and MDM

    To ensure full sensor activation at the earliest time during the sensor mass deployment, Carbon Black recommends that you preconfigure endpoints with System Extension and FDA pre-approval though MDM, using the latest MDM recommendations for Carbon Black Cloud in the sensor release DMG docs folder. Verify the MDM policy correctness using test endpoints before mass deployment of sensors.

Removable System Extension MDM

  • Removable SysEXT MDM Configuration

    Apple’s macOS 12+ supports the Removable System Extension MDM policy, which is the preferred macOS-supported mechanism for facilitating seamless Carbon Black Cloud sensor upgrades and uninstallations without requiring user intervention. This policy not only streamlines these processes but also improves compatibility with macOS in an MDM-managed environment, specifically enhancing customer workflows.

    Carbon Black highly recommend deploying this policy in your environment. To assist you in configuring the Carbon Black Cloud System Extension as removable in your MDM-managed environment, Carbon Black has updated the MDM configuration documentation.

    You can find an updated comprehensive guidance for this configuration in the following document: Carbon Black Cloud: How To Add Removable System Ex... - Carbon Black Community.

    You can find the removable system extension status under the general information section of repcli status: General Info -> System Extension -> Removable.

    Reference Links:

Resolved Issues

Endpoint Standard

  • EA-20545: Improved XProtect Malware Detection

Endpoint Standard and EEDR

  • DSEN-25329: Reduced size of the application data in /Library/Application\ Support/com.vmware.carbonblack.cloud folder

  • DSEN-26760: Improved event processing and pre-execution blocking efficacy in environments with significant IPv6 traffic

  • DSEN-25726: Added further Tamper Protection enhancement for System Extension Deactivation and Uninstall protection

  • DSEN-26193: General SysEXT (se_agent) performance improvements

  • DSEN-24364: Third party library updates

LiveOps

  • DSEN-24364: Updated OSQuery engine to 5.9.1

Known Issues

The following issues are known to affect the software. Each lists the sensor version when the issue was first reported. Issues are removed after they are resolved.

  • Device Quarantine limitation with VPN per-app tunnel

    Carbon Black is in contact with Apple Eng. to resolve the universal macOS limitation.

    Please refer to this KB article for a workaround.

  • Unsupported workflow for migrating data from Intel to an Apple Silicon machine

    Including the sensor as part of migrating data from Intel to an Apple Silicon machine (i.e. Migration Assistant) is not a supported workflow.

    The recommended workflow is to uninstall the sensor before migration or exclude the sensor during migration and install it on the target machine.

check-circle-line exclamation-circle-line close-line
Scroll to top icon