The Carbon Black EDR sensor performs reads and writes to the sensor's installation root directories. With AV products continually scanning the directory contents, the following exclusions can help ensure proper coexistence and eliminate potential interoperability problems that can cause performance issues.

The following exclusions apply to all supported versions of Windows, macOS, and Linux.

Note:
  • Review vendor documentation for exclusions implementation steps.
  • Some vendors require a trailing asterisk (*) when entering exclusions. Sub-folders should be included in the exclusion. Refer to the vendor's documentation.
  • Windows Defender is enabled by default on Windows machines and requires these exclusions.
  • If you are utilizing a custom Sensor Process Name, add the customized process name to the AV application exclusions list.
  • For McAfee EPO you might also need to exclude c:\windows\carbonblack\cb.exe from its Prevent creation of new executable files in the Windows folder option.
Table 1. Recommended folders and processes to exclude from third-party anti-virus scans
Operating System Sensor Version Path and Process
Windows 7.1.0 and later
  • %WINDIR%\CarbonBlack\*
  • %WINDIR%\CarbonBlack\cb.exe
  • C:\Program Files\CarbonBlack\CbEDRAMSI.dll
  • C:\Program Files (x86)\CarbonBlack\CbEDRAMSI.dll
Windows 7.0.1 and earlier
  • %WINDIR%\CarbonBlack\*
  • %WINDIR%\CarbonBlack\cb.exe
macOS/OS X
  • 6.3.0 and later
  • BigSur/11.x
  • /Applications/VMware Carbon Black EDR.app/Contents/XPCServices/CbDigitalSignatureHelper.xpc/Contents/MacOS/CbDigitalSignatureHelper
  • /Applications/VMware Carbon Black EDR.app/Contents/MacOS/CbOsxSensorService
  • /var/lib/cb/*
  • /Library/SystemExtensions/<GUID>/com.carbonblack.es-loader.es-extension.systemextension/Contents/MacOS/com.carbonblack.es-loader.es-extension
macOS/OS X
  • 6.3.0 and later
  • Pre-BigSur/10.x
  • /var/lib/cb/*
  • /Applications/VMware Carbon Black EDR.app/Contents/MacOS/CbOsxSensorService
  • /Applications/VMware Carbon Black EDR.app/Contents/XPCServices/CbDigitalSignatureHelper.xpc
  • /System/Library/Extensions/CbOsxSensorNetmon.kext
  • /System/Library/Extensions/CbOsxSensorProcmon.kext
macOS/OS X 6.2.7 and earlier
  • /var/lib/cb/*
  • /Applications/CarbonBlack/CbOsxSensorService
  • /Applications/CarbonBlack/CbDigitalSignatureHelper
  • /System/Library/Extensions/CbOsxSensorNetmon.kext
  • /System/Library/Extensions/CbOsxSensorProcmon.kext
Linux 6.2.1 and later
  • /var/opt/carbonblack/response/*
  • /etc/init.d/cbdaemon
  • /usr/sbin/cbdaemon
  • /opt/carbonblack/response/*
  • /etc/sysconfig/modules/cbresponse.modules
Linux 6.2.0 and earlier
  • /var/lib/cb/*
  • /etc/init.d/cbdaemon
  • /etc/rc*/*cbdaemon
  • /usr/sbin/cbdaemon
  • /etc/sysconfig/modules/cbresponse.modules