Manually applying full disk access for VMware Carbon Black Cloud macOS sensors – Zscaler MDR Support

Issue

Endpoint that is running a supported version of the VMware Carbon Black Cloud macOS sensor does not appear to be collecting telemetry.

Environment

VMware Carbon Black Cloud

macOS sensor

Resolution

Ensure that full disk access is applied on the affected endpoint.

Navigate to the Security & Privacy pane in System Preferences. Select the Privacy tab and scroll down to Full Disk Access. Click the lock icon to edit.
In the Full Disk Access window, locate com.vmware.carbonblack.cloud.se-agent.extension.systemextension and check the box next to it.
Open a Finder window and navigate to this folder: /Applications/VMware Carbon Black Cloud/
Drag only the following folder items into the Full Disk Access list:
- LiveQuery.bundle
- repmgr.bundle
- uninstall.bundle
- VMware CBCloud
IMPORTANT: There is an Apple-acknowledged bug in the Full Disk Access UI that prevents bundles (I.e. repmgr.bundle) from displaying in the window. It will look like the drag was not successful. This is not the case.

How to verify that Full Disk Access has been successfully enabled

It will take about an hour for the RepCLI utility to report Full Disk Access changes successfully. If you'd prefer not to wait, you can restart the endpoint to verify the change immediately.

Open a Terminal window and run one of the following command (requires admin password):
Option 1:
```
cd /Applications/VMware\ Carbon\ Black\ Cloud/repcli.bundle/Contents/MacOS/
sudo ./repcli status
```
Option 2:
```
sudo /Applications/VMware\ Carbon\ Black\ Cloud/repcli.bundle/Contents/MacOS/repcli status
```
RepCLI will print a report of sensor information, including the Full Disk Access status:

As stated above, it may take some time before the changes take effect. If there are still issues with the endpoint not sending telemetry, please open a Support case for further assistance.