How to evaluate if Carbon Black is installed on Macs

Information

As Carbon Black is missing from the list of installed applications on Macs, you need to create a special baseline to evaluate the presence of its files.

Please do the following:

1. Go SCCM Console → Overview → Compliance Settings → Configuration Items and click Create Configuration Item:

2. Give it some name and specify the type of configuration item as Mac OS X (custom), click Next:

3. Select all and click Next:

4. Click New:

5. Give it some name, set Setting type to Script and Data type to String, click Add script:

6. In this example we will check if file /Applications/CarbonBlack/CbOsxSensorService is present on the Mac to detect if Carbon Black is installed. You may adjust this script accordingly to your needs:

#! /bin/bash

if [ -f /Applications/CarbonBlack/CbOsxSensorService ]
then
echo "OK"
              exit 0
fi

7. Click OK and proceed with creating a new Compliance rule. Set the rule type to Value and specify that it must be equal to OK:

8. Finish creating the Configuration Item:

9. Go SCCM Console → Overview → Compliance Settings → Configuration Baselines and click Create Configuration Baseline:

10. Give it some name and add the Configuration Item we created earlier:

11. Click OK and deploy the newly created Configuration Baseline to collection containing Macs you'd like to check for compliance:

12. Wait for the Mac to receive the policies, run the compliance script and report the results to SCCM. It may take up to several hours depending on your SCCM Client Settings.

13. Check the status of the deployment:

14. If no data is present yet you may need to Run Summarization. wait a bit more and Refresh:

15. Once the compliance data is collected you'll be able to see what Macs have Carbon Black installed and what don't:

The other option is to use reports List of assets by compliance state for a configuration baseline or List of assets by compliance state for a configuration item in a configuration baseline that can be found ins SCCM Console → Monitoring → Reporting → Reports → Compliance and settings management: