Documentation & Downloads

 View Only

[Carbon Black Cloud] Using RepCLI on macOS

By srissland posted Dec 14, 2020 08:11 PM



Support information for each Carbon Black Cloud Sensor is published on VMware Docs as distinct OERs. This UEX page will no longer be updated. Please see:


Supported sensor versions: 3.5.1+
Supported OS versions: macOS 10.12 and later


RepCLI is a command line tool that can be used by superusers to locally manage certain sensor functions, such as forcing cloud check-ins and printing diagnostic info.

  • RepCLI is included in macOS sensor versions beginning with 3.5.1
  • RepCLI can be used to change sensor behavior, view sensor status, and perform sensor operations without connecting to the console.
  • The list of available RepCLI commands can be viewed by running RepCLI with no options.
  • Help for a particular command can be obtained by running the Help command and providing the name of that command as an argument.


The RepCLI binary is installed to at:

/Applications/VMware Carbon Black Cloud/repcli.bundle/Contents/MacOS/repcli


  1. Launch a terminal, and navigate to the directory:
    /Applications/VMware Carbon Black Cloud/repcli.bundle/Contents/MacOS/
  2. Run the “repcli” binary as root to view a list of available RepCLI commands, as shown below. Note: the list below is subject to change with future sensor versions.
    bash-3.2$ sudo ./repcli
    Supported Commands:
    cloud: Check in to the Carbon Black Cloud
    counters: Prints kernel extension diagnostic counters
    help: Print information on how to use CLI command(s)
    status: Print the sensor status
    version: Displays current product version
  3. Furthermore, help for a particular command can be printed by running the “help” command with the command name as an argument, like so:
    bash-3.2$ sudo ./repcli help cloud
    Cloud - Send the specified request to the cloud and apply the result.
    Usage: cloud [request_type]

    Supported Request Types:
    Metadata Push endpoint metadata to the cloud.
    QueryConfig Request the latest sensor configuration from the cloud.
    QueryRules (Default) Request the latest rule set from the cloud.
    RepConfig Request the latest allow list and ban list from the cloud.
    SensorState Push sensor state to the cloud
    UninstallCode Request latest uninstall code from the cloud
    Zip Request latest zip container configuration from the cloud.



An example of the "cloud hello" command:

bash-3.2$ sudo ./repcli cloud hello
Successfully checked into backend.

An example of the "capture" command:

sudo ./repcli capture <uninstall_code> ~/Desktop
Log zip successful!

Supported Commands




Enables, disables, and Check bypass mode


Generates and zips sensor logs and data


Checks in with the Carbon Black Cloud Note: There is a 60 second cooldown period between invocations of this command


Prints kernel extension diagnostic counters


Prints information on how to use CLI command(s)


Use to Request, Reset, Refresh manifest


Toggles the sensor state from SysExt to Kext


Allows setting kext load options


Toggles the sensor agent from Kext to SysExt


Prints the sensor status


Displays the current product version


Loads the sensor driver and repmgr daemon


Audit Logs

A timestamped log of RepCLI invocations can be found at /Library/Logs/RepCLI.log. RepCLI invocations are also logged to the system log (Console).

Related Articles


Changes Needed

Cb Defense: How to Verify Sensor Status With RepCLI 

Output is slightly different. Output format is slightly different.

CB Defense: How to Check Background Scan Status With RepCLI 

Output format is slightly different. Doesn’t include “total files processed”.

Cb Defense: How to Force Sensor to Check Into Console With RepCLI

Smaller subset of request types are available. ActiveDirectory authentication not relevant.

There will be a one minute “cooldown” period applied to these commands when they are run.

CB Defense: How to use RepCLI to Confirm Sensor Policy Updates

Output format is slightly different.

Cb Defense: How to Toggle Sensor Bypass with the RepCLI Utility

Mac RepCLI does not support this yet. In the meantime, this can be done with the uninstall binary (-b and -n options).

CB Defense: How to Update Virus Definition Files With RepCLI

Not applicable to macOS.

Cb Defense: How to Run an On Demand Scan With RepCLI

Not yet supported by Mac.

CB Defense: How to Gather System Info With RepCLI

Not applicable to macOS. This is basically a wrapper for a command in Windows command prompt.

Closest equivalent in macOS might be system_profiler, but there are no plans to make a wrapper for this. In theory, this could be run from LiveResponse anyway.

CB Defense: How to Stop Sensor Services With RepCLI

Not supported by the mac sensor at this time.

CB Defense: How to Enable Sensor Debug Logging for Issue Reproduction with RepCLI

Not supported by the mac sensor.

CB Defense: How to Access RepCLI with Live Response

Basically the same, except Step 1 should cd instead to /Applications/VMware Carbon Black Cloud/repcli.bundle/Contents/MacOS

1 comment