This page is an aggregate of all OER topics onto a single page for more convenient HTML viewing.

macOS Hardware Recommendations

Endpoints should comply with all hardware requirements for the OS you are running. Consider all processes that run on the endpoints when determining hardware configuration. Only industry standard desktop, laptop, or notebook computers and server hardware platforms are supported. Mobile and tablet require additional qualifications. Please contact VMware Carbon Black Support for additional information.

Table 1. Product: Endpoint Standard on macOS
Metric Endpoint Standard Endpoint Standard + Audit & Remediation Endpoint Standard + Enterprise EDR Endpoint Standard + Enterprise EDR + Audit & Remediation
CPU Any supported x86-64 or arm64* Any supported x86-64 or arm64* Any supported x86-64 or arm64* Any supported x86-64 or arm64*
Memory 2 GB 2 GB 2 GB 2 GB
Cores 2 2 2 2
Network required

Minimum: 100 Mbit

Recommended: 1 Gbit

Minimum: 100 Mbit

Recommended: 1 Gbit

Minimum: 100 Mbit

Recommended: 1 Gbit

Minimum: 100 Mbit

Recommended: 1 Gbit
Minimum network during light usage

1k bytes/sec read/writes each

1k bytes/sec read/writes each

 1k bytes/sec read/writes each 1k bytes/sec read/writes each
Free disk space

Minimum: 100 MB

Recommended: 500 MB

Minimum: 100 MB

Recommended: 500 MB

Minimum: 200 MB

Recommended: 1 GB

Minimum: 200 MB

Recommended: 1 GB

*arm64 CPU requires macOS sensor 3.6 or higher.

Table 2. Product: Audit & Remediation on macOS
Metric Audit & Remediation Endpoint Standard + Audit & Remediation Enterprise EDR + Audit & Remediation Endpoint Standard + Enterprise EDR + Audit & Remediation
CPU Any supported x86-64 or arm64*

32-bit is not supported

 Any supported x86-64 or arm64* Any supported x86-64 or arm64* Any supported x86-64 or arm64*
Memory 1 GB 2 GB 2 GB 2 GB
Cores 1 2 2 2
Network required

Minimum: 100 Mbit

Recommended: 1 Gbit

Minimum: 100 Mbit

Recommended: 1 Gbit

Minimum: 100 Mbit

Recommended: 1 Gbit

Minimum: 100 Mbit

Recommended: 1 Gbit
Minimum network during light usage 1k bytes/sec read/writes each

1k bytes/sec read/writes each

 1k bytes/sec read/writes each 1k bytes/sec read/writes each
Free disk space

Minimum: 100 MB

Recommended: 500 MB

Minimum: 100 MB

Recommended: 500 MB

Minimum: 100 MB

Recommended: 500 MB

Minimum: 200 MB

Recommended: 1 GB

*arm64 CPU requires macOS sensor 3.6 or higher.

Table 3. Product: Enterprise EDR on macOS
Metric Enterprise EDR Enterprise EDR + Audit & Remediation Endpoint Standard + Enterprise EDR Endpoint Standard + Enterprise EDR + Audit & Remediation
CPU Any supported x86-64 or arm64* Any supported x86-64 or arm64* Any supported x86-64 or arm64* Any supported x86-64 or arm64*
Memory 2 GB 2 GB 2 GB 2 GB
Cores 2 2 2 2
Network required

Minimum: 100 Mbit

Recommended: 1 Gbit

Minimum: 100 Mbit

Recommended: 1 Gbit

Minimum: 100 Mbit

Recommended: 1 Gbit

Minimum: 100 Mbit

Recommended: 1 Gbit
Minimum network during light usage 1k bytes/sec read/writes each 1k bytes/sec read/writes each 1k bytes/sec read/writes each 1k bytes/sec read/writes each
Free disk space

Minimum: 100 MB

Recommended: 500 MB

Minimum: 100 MB

Recommended: 500 MB

Minimum: 200 MB

Recommended: 1 GB

Minimum: 200 MB

Recommended: 1 GB

*arm64 CPU requires macOS sensor 3.6 or higher.

Table 4. Product: Prevention on macOS
Metric Prevention
CPU Any supported x86-64
Memory 1 GB
Cores 1
Network required

Minimum: 100 Mbit

Recommended: 1 Gbit
Minimum network during light usage 1k bytes/sec read/writes each
Free disk space

Minimum: 100 MB

Recommended: 500 MB

macOS Operating Systems and Respective Sensors

This topic describes Carbon Black Cloud macOS sensors.

Note: For users of Carbon Black Cloud on AWS GovCloud (US), see macOS Operating Systems and Sensors for AWS GovCloud (US) for system information specific to your environment.

Please see the Carbon Black Cloud Sensor Support Policy and the macOS Sensor Support Life Cycle Status page for information regarding Standard or Extended support for specific versions of the macOS Sensor.

All macOS sensors are 64 bit.

Note:
  • "-" indicates through and inclusive of; for example, 12.0.0 - 12.7.1 indicates 12.0.0 through and inclusive of 12.7.1.
  • In the following tables, "X" indicates that that sensor works with that product.
  • "ready" indicates Carbon Black 0-day-support strategy. Sensor version 3.7.2.77 is the first time Carbon Black released a sensor claiming support prior to an Apple’s macOS GM. For further information see, the macOS sensor 3.7.2.81 Release Notes.
Important: Some sensor versions listed here may no longer be supported. Please consult the macOS Sensor Support Life Cycle Status page for information on sensor life cycle support status.
Table 5. Supported macOS Operating Systems and Respective Sensors
Sensor Version Supported macOS Operating Systems Supported Processor Architecture Prevention Endpoint Standard Audit and Remediation Enterprise EDR Vulnerability Assessment
3.8.1.102

15.0 (see note 1)

14.0-14.6

13.0-13.6.8

12.0-12.7.6

 Intel (x86), Apple Silicon X X X X X
3.8.0.58

15.0 (see note 1)

14.0-14.6

13.0-13.6.8

12.0-12.7.6

 Intel (x86), Apple Silicon X X X X X
3.7.4.53

14.0-14.6

13.0-13.6.8

12.0-12.7.6

 Intel (x86), Apple Silicon X X X X X
3.7.3.159

14.0-14.5

13.0-13.6.7

12.0-12.7.5

 Intel (x86), Apple Silicon X X X X X
3.7.2.81

14.0-14.1.2

13.0-13.6.1

12.0.0-12.7.1

 Intel (x86), Apple Silicon X X X X X
3.7.1.17

13.0-13.6.0

12.0.0-12.7.0

11.0.0-11.7.10

 Intel (x86), Apple Silicon X X X X X
Attention: Note 1 regarding macOS 15

There is a known issue in macOS15 that can result in some network activity being classified incorrectly. As a result, this can impact the efficacy of Endpoint Standard and Enterprise EDR. The problem is expected to be fixed in macOS15.1. We recommend customers upgrade to macOS15.1 as soon as possible. For additional information, see: https://developer.apple.com/documentation/macos-release-notes/macos-15-release-notes
Important: The operating systems listed in the following table are no longer considered supported because there are no supported sensors validated to work with them.
Table 6. Unsupported macOS Operating Systems and Respective Sensors
Sensor Version Supported Operating Systems Supported Processor Architecture Prevention Endpoint Standard Audit and Remediation Enterprise EDR

3.7.2.77

Deprecated

 macOS 11.0 - 13.0 Intel (x86), Apple Silicon X X X X

3.7.1.12

Deprecated

 macOS 10.15-12.6 Intel (x86), Apple Silicon X X X X
3.6.2.110 macOS 10.15-12.6 Intel (x86), Apple Silicon X X X X
3.6.1.10 macOS 10.15-12.2

Note: Does not support 12.3, please do not upgrade.

 Intel (x86), Apple Silicon X X X X
3.5.3.82 macOS 10.14-11.6.2 Intel (x86) X X X X
3.5.2.78 macOS 10.12-11.6.2 Intel (x86) X X X X
3.5.1.31* macOS 10.12-11.2.3 Intel (x86) X X X X
3.5.1.23** macOS 10.12-11.2.3 Intel (x86) X X X X
3.5.1.19 macOS 10.12-11.0.1, 11.1 Intel (x86) X X X X
3.4.4.51 macOS 10.11-10.15.7 Intel (x86) X X X X
3.4.3.44 macOS 10.10-10.15.7 Intel (x86) X X X X
3.4.2.23 macOS 10.10-10.15.7 Intel (x86) X X X X
3.4.1.7 macOS 10.10-10.15.7 Intel (x86) X X X X
3.3.4.6 macOS 10.10-10.15.7 Intel (x86) X X X
3.3.3.35

macOS 10.10-10.15.0,

10.15.2-10.15.7

 Intel (x86) X X X
3.3.2.58 macOS 10.10-10.14.6 Intel (x86) X X X
3.3.1.12 macOS 10.10-10.14.6 Intel (x86) X X X
3.2.2.6 macOS 10.10-10.14.6 Intel (x86) X X
3.2.1.10 macOS 10.10-10.14.6 Intel (x86) X X
3.1.1.64 macOS 10.10-10.14.6 Intel (x86) X X
3.0.1.20 macOS 10.10-10.14.6 Intel (x86) X X
1.x macOS 10.6-10.12.6 Intel (x86) X X
Note:
  • *Sensor version 3.5.1.31 replaces 3.5.1.23 but is functionally identical. It resolves some performance issues reported with the sensor on macOS Big Sur.
  • **Sensor version 3.5.1.23 replaces 3.5.1.19 but is functionally identical. It resolves an OS version compatibility issue impacting macOS 11.2 and later.

macOS Operating Systems and Sensors for AWS GovCloud (US)

The following is a list of Carbon Black Cloud macOS sensors and their respective operating systems. This list is specific to Carbon Black Cloud on AWS GovCloud (US).

Please see the Carbon Black Cloud Sensor Support Policy and the macOS Sensor Support Life Cycle Status page for information regarding Standard or Extended support for specific versions of the macOS Sensor.

All macOS sensors are 64 bit.

Note:
  • "-" indicates through and inclusive of; for example, 12.0.0 - 12.7.1 indicates 12.0.0 through and inclusive of 12.7.1.
  • In the following tables, "X" indicates that that sensor works with that product.
Important: Some sensor versions listed here may no longer be supported. Please consult the macOS Sensor Support Life Cycle Status page for information on sensor life cycle support status.
Table 7. Supported macOS Operating Systems and Respective Sensors for AWS GovCloud (US)
Sensor Version Supported macOS Operating Systems Supported Processor Architecture Prevention Endpoint Standard Audit and Remediation Enterprise EDR
3.8.1.102

14.0-14.6

13.0-13.6.8

12.0-12.7.6

 Intel (x86), Apple Silicon X X X X
3.8.0.58

14.0-14.5

13.0-13.6.7

12.0-12.7.5

 Intel (x86), Apple Silicon X X X X
3.7.4.53

14.0-14.5

13.0-13.6.7

12.0-12.7.5

 Intel (x86), Apple Silicon X X X X
3.7.3.159

14.0-14.5

13.0-13.6.7

12.0-12.7.5

 Intel (x86), Apple Silicon X X X X
3.7.2.81

14.0-14.1.2

13.0-13.6.1

12.0.0-12.7.1

 Intel (x86), Apple Silicon X X X X
3.7.1.17

13.0-13.6.0

12.0.0-12.7.0

11.0.0-11.7.10

 Intel (x86), Apple Silicon X X X X
Table 8. Unsupported macOS Operating Systems and Respective Sensors for AWS GovCloud (US)
Sensor Version Supported Operating Systems Supported Processor Architecture Prevention Endpoint Standard Audit and Remediation Enterprise EDR

3.7.2.77

Deprecated

 macOS 10.15 - 12.6 Intel (x86), Apple Silicon X X X X

3.7.1.12

Deprecated

 macOS 10.15 - 12.6 Intel (x86), Apple Silicon X X X X
3.6.2.110 macOS 10.15 - 12.6 Intel (x86), Apple Silicon X X X X

macOS User Space Functionality

Beginning in macOS 11, the Carbon Black Cloud macOS sensor (v3.5.1) operates by default in user-space using System Extensions (user-space) instead of Kernel Extensions (KEXTs) that are used in previous versions of the agent.

Therefore, there are some functional differences when using the sensor in System Extension mode on macOS 11 and later.

Using the sensor in KEXT mode achieves the same functionality on macOS 11 as it does on older operating systems.

Unless otherwise specified, documentation related to macOS functionality on the Carbon Black Cloud pertains to macOS 10.15 and earlier or to functionality delivered via the KEXT on macOS 11.

The following matrix outlines macOS functionality on the Carbon Black Cloud. The functionality detailed in the macOS 11+ column pertains to the sensor’s functionality in user space (System Extension) in the initial macOS 11-compatible sensor release (v3.5.1+). For functionality provided via the kernel extension, refer to the macOS 10.12 - 11+ column.

Table 9. macOS User Space Functionality in Endpoint Standard
Functionality macOS10.12 - 11 (KEXT) macOS 11+(user-space)
Behavioral EDR (analytics detection) X X
Behavior-based prevention (non-reputation policy rules) X X
Targeted Prevention (Terminate Process) X X
Targeted Prevention (Deny Process) X X
Reputation-based prevention (CB Analytics) X X
Banned-list based prevention (Deny List) X X
Approved-list allowances (hash) All X
Approved-list allowances (cert, IT tool) X X
Automatic Malware Removal X X
Script Detection X X
On-demand File Collection X X
On-demand File Deletion X X
On-demand - Endpoint Network Isolation (Quarantine) X X
Interactive Remote Shell Capability for Remediation (Live Response) X X
Behavior-based Ransomware Detection/Prevention (non-reputation) X X
Keylogger (CGEventTap) Detection X X
XProtect Block Event Collection In Progress X
Table 10. macOS User Space Functionality in Audit and Remediation and Integrations
Functionality macOS10.12 - 11 (KEXT) macOS 11+(user-space)
Audit & Remediation (enterprise-class Osquery) X X
Open APIs to Query All Endpoint Data X X
Open APIs to Invoke All Remediation Functions X X
Table 11. macOS User Space Functionality in Enterprise EDR
Functionality macOS10.12 - 11 (KEXT) macOS 11+(user-space)
Continuous Endpoint Telemetry Data Collection: X X
  • Process Start/Stop/Parent/Source binary, etc.
 X X
  • In/Outbound Network Connections
 X X
  • File Modifications (RWCD)
 X X
  • Cross Process Memory Injection/Scraping
 X X
  • Module Loads
 X X
  • Script Loads
 X X
30 Day Data Retention (longer if associated with an alert) X X
Regex and Wildcard Search/Alert Query Language Support X X
Custom/Customer-created Alert Criteria X X
Support for Industry-standard Threat Feeds (STIX/TAXII) X X
Table 12. macOS User Space Functionality in Operations
Functionality macOS10.12 - 11 (KEXT) macOS 11+(user-space)
Sensor Uninstall Prevention (require unique code) X In Progress
Sensor Tamper Prevention X X
Industry Standard Installer (.msi/.dmg/tar) X X
Console Driven Sensor Upgrade X X
Policy Controlled Sensor Upgrade X X
Sensor Health Monitoring/Alerting X X

macOS Sensor Support for osquery in Audit and Remediation

The following table shows which Carbon Black Cloud sensor versions support which versions of osquery for Audit and Remediation - Live Query.

macOS Sensor Version osquery Version
3.8.1 5.12.2
3.8.0 5.9.1
3.7.4 5.8.2
3.7.3 5.7.0
3.7.2 5.3.0
3.7.1 5.2.3
3.6.2 4.9.0
3.6.1 4.9.0
3.5.3 4.8.0
3.5.1 4.5.0
3.4.4 4.4.0
3.4.3 4.1.2
3.3.3 - 3.4.2 3.3.2
3.3.2 3.2.6
3.3.1 3.2.6

macOS Sensor Support Life Cycle Status

Use the following tables to determine the product life cycle stage of your VMware Carbon Black Cloud macOS Sensor.

The VMware Carbon Black Cloud Product Release Life Cycle policy is located at Carbon Black Cloud Sensor Support Policy.

Table 13. macOS Sensors in Status: Standard Support
Release Enter Standard Enter Extended Enter End of Support
3.8.1 September 2024
3.8.0 November 2023 March 2025 September 2025
Table 14. macOS Sensors in Status: Extended Support
Release Enter Standard Enter Extended Enter End of Support
3.7.4 June 2023 May 2024 November 2024
Table 15. macOS Sensors in Status: End of Support
Release Enter Standard Enter Extended Enter End of Support
3.7.3 June 2023 February 2024 August 2024
3.7.2 December 2022 June 2023 December 2023
3.7.1 December 2022 June 2023 December 2023
3.6.x October 2021 March 2022 October 2022
3.5.x December 2020 June 2021 December 2021
3.4.4 November 2020 May 2021 November 2021
3.4.3 June 2020 December 2020 June 2021
3.4.2 February 2020 August 2020 February 2021
3.4.1 December 2019 February 2020 December 2020
3.3.4 November 2019 December 2019 December 2020
3.3.3 September 2019 November 2019 September 2020
3.3.2 July 2019 September 2019 July 2020
3.3.1 March 2019 July 2019 March 2020
3.2.2 November 2018 March 2019 March 2020
3.2.1 October 2018 March 2018 March 2020
3.1 June 2018 October 2018 October 2019
3.0.2 March 2018 June 2018 July 2019
3.0.1 November 2017 March 2018 July 2019
1.2.4 August 2017 November 2017 March 2018
1.2.3 May 2017 August 2017 November 2017
1.2.2 February 2017 May 2017 November 2017
1.2.1 December 2016 February 2017 November 2017
1.0.6 August 2016 December 2016 November 2017