{"type":"doc","content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"maxLevel":{"value":"3"},"minLevel":{"value":"3"}},"macroMetadata":{"macroId":{"value":"1b7d90a2-c73c-445f-bd2a-4a951bba3ff8"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"1c685f2a-92ec-4afa-bef4-c1ed0f316054"}},{"type":"heading","attrs":{"level":3},"content":[{"text":"Overview","type":"text"}]},{"type":"rule"},{"type":"paragraph","content":[{"text":"EDR uses the Kernel Extension (KEXT) installation for macOS installs, which requires either a KEXT approval via Mobile Device Management (MDM) or an attended installation by a local admin on the machine. ","type":"text"},{"text":"Big Sur does not allow KEXT installation without MDM pre-approval","type":"text","marks":[{"type":"link","attrs":{"href":"https://support.apple.com/en-us/HT211860"}}]},{"text":", which requires extra steps. ","type":"text"},{"type":"hardBreak"},{"type":"hardBreak"},{"text":"Those extra steps are provided here.","type":"text"}]},{"type":"paragraph","content":[{"text":"It is recommended that users install EDR to Big Sur with CLI and not schedule the task with the Armor Toolbox.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Step 1: MDM KEXT pre-approval on macOS 11","type":"text"}]},{"type":"rule"},{"type":"paragraph","content":[{"text":"The easiest way to distribute the necessary MDM payload to approve the KEXT is to upload the MDM-KEXT-approval.mobileconfig file, found in the mounted DMG of the installer, in the docs folder. ","type":"text"}]},{"type":"paragraph","content":[{"text":"It is also possible to recreate the attached mobileconfig in your MDM tool. You can accomplish this by specifying the ","type":"text"},{"text":"Apple Team ID ","type":"text","marks":[{"type":"strong"}]},{"text":"and ","type":"text"},{"text":"KEXT Bundle ID","type":"text","marks":[{"type":"strong"}]},{"text":" in your Kernel Extension configuration profile:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Apple Team ID: 7AGZNQ2S2T","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"KEXT Bundle ID: com.carbonblack.defense.kext","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Step 2: Local KEXT approval and endpoint reboot (two options)","type":"text"}]},{"type":"rule"},{"type":"paragraph","content":[{"text":"On macOS 11 a local approval of the KEXT (user will be prompted) and a reboot are required to complete approval of the KEXT. This is in addition to the pre-approval in Step 1. There are two ways of doing it, one of which relies on the endpoint user, and the other is accomplished via MDM.","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Option 1: Local approval","type":"text"}]},{"type":"paragraph","content":[{"text":"After the sensor has been installed, the user will be prompted to approve the KEXT. To approve it, they can go to the ","type":"text"},{"text":"Security & Privacy","type":"text","marks":[{"type":"strong"}]},{"text":" preferences pane, unlock the pane with their credentials, and approve the KEXT.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":535,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":1280,"id":"36381a13-1366-4f0c-b149-3539d03d978e","collection":"contentId-3519578364","type":"file","height":598}}]},{"type":"paragraph","content":[{"text":"They will then be prompted to restart. Upon reboot the KEXT will load as expected.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":385,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":1280,"id":"1155749d-e7a1-4228-b624-c4780e5efecd","collection":"contentId-3519578364","type":"file","height":832}}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Option 2: MDM kernel cache rebuild via custom reboot command (if supported)","type":"text"}]},{"type":"paragraph","content":[{"text":"To avoid relying on local user approval, you can use your MDM to issue a customized reboot command to rebuild the Kernel Cache.","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Custom reboot commands are not supported by all MDM providers.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"Please see Apple documentation here: ","type":"text"},{"text":"https://developer.apple.com/documentation/devicemanagement/restartdevicecommand/command","type":"text","marks":[{"type":"link","attrs":{"href":"https://developer.apple.com/documentation/devicemanagement/restartdevicecommand/command"}}]}]},{"type":"paragraph","content":[{"text":"The easiest way to distribute the necessary MDM command to finish approving the KEXT is to upload the MDM-KEXT-reboot-command.xml file, found in the docs folder of the sensor installation DMG. The command is also copied below. The XML file should be uploaded as a Custom Command and sent to endpoints after KEXT install.","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"This will reboot the target machine without warning, and that this distribution method is a temporary workflow until MDM providers update their reboot protocols to support RebuildKernelCache.","type":"text"}]}]},{"type":"codeBlock","content":[{"text":"\nRebuildKernelCache\n\nKextPaths\n/Library/Extensions/CbDefenseSensor.kext\nRequestType\nRestartDevice\n","type":"text"}]},{"type":"paragraph","content":[{"text":"Example:","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":500,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":624,"id":"7f3c9be0-477d-4c26-b933-28bf313723e5","collection":"contentId-3519578364","type":"file","height":393}}]},{"type":"mediaSingle","attrs":{"layout":"align-start","width":500,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":633,"id":"ea4ca47f-0ad3-4195-9671-b17fe1c9ccea","collection":"contentId-3519578364","type":"file","height":335}}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}],"version":1}

Browser not supported