If you are deploying the macOS sensor in Kernel Extension mode (macOS 10.14 - macOS 11), include an Approved Kernel Extension payload. You can optionally include both System Extension and Kernel Extension payloads to provide flexibility.

Procedure

  1. Select Allow Users to approve system extensions.
  2. Optionally select Allow standard users to approve legacy Kernel Extensions (macOS 11 or later): This selection is dependent on your environment.
  3. Define the following settings in Allowed Team IDs and Kernel Extensions:
    • Approved Team ID Display Name: VMware Carbon Black
    • Approved Team ID: 7AGZNQ2S2T
    • Approved Kernel Extension Display Name: Carbon Black Cloud Sensor
    • Approved Kernel Extension Kernel Extension Bundle ID: 
      com.carbonblack.defense.kext

      For example:

      Approved Kernel Extensions for Carbon Black Cloud Sensor Example

      Note: This payload pre-approves the Kernel Extension. The user must still enable the Kernel Extension in the Security & Privacy section of System Preferences on the endpoint after you have installed the sensor. The user must then reboot the endpoint.