- Using dashboards
- Managing alerts across Cylance Endpoint Security services
- Managing users, devices, and groups
- Manage CylancePROTECT Desktop and CylanceOPTICS devices
- Manage zones
- Manage devices with the CylancePROTECT Mobile app
- Manage CylancePROTECT Mobile app and CylanceGATEWAY users
- View CylanceAVERT user details
- Manage user groups
- Configure device lifecycle management
- View a list of applications installed on CylancePROTECT Desktop devices
- Remove a registered FIDO device for a user account
- Discover unprotected devices
- Managing threats detected by CylancePROTECT Desktop
- Managing safe and unsafe lists for CylancePROTECT Desktop and CylancePROTECT Mobile
- Add a file to the CylancePROTECT Desktop global quarantine or global safe list
- Add a file to the CylancePROTECT Desktop local quarantine or local safe list
- Add a certificate to the CylancePROTECT Desktop global safe list
- Add an app, certificate, IP address, domain, or installer source to the CylancePROTECT Mobile safe or restricted list
- Analyzing data collected by CylanceOPTICS
- Using CylanceOPTICS to detect and respond to events
- Auditing administrator actions
- Managing logs
- Send events to a SIEM solution or syslog server
- Enable access to the Cylance User API
- Troubleshooting Cylance Endpoint Security
- Using the BlackBerry Support Collection Tool
- Using the Report a problem feature
- Removing the BlackBerry Connectivity Node software from Cylance Endpoint Security
- Troubleshooting CylancePROTECT Desktop
- Remove the CylancePROTECT Desktop agent from a device
- Re-register a Linux agent
- Troubleshoot update, status, and connectivity issues with CylancePROTECT Desktop
- A large number of DYLD Injection violations are reported by Linux devices
- Time zone variances for CylancePROTECT Desktop
- Folder exclusions when using CylancePROTECT Desktop with third-party security products
- Linux driver is not loaded. Upgrade the driver package.
- Troubleshooting CylanceOPTICS
- Managing threats detected by CylancePROTECT Mobile
- View mobile OS vulnerabilities
- Monitoring network connections with CylanceGATEWAY
- Monitoring sensitive files with CylanceAVERT
- BlackBerry Docs
- Cylance Endpoint Security
- Cylance Endpoint Security
- Cylance Endpoint Security Administration Guide
- Troubleshooting Cylance Endpoint Security
- Troubleshooting CylanceOPTICS
- Removing the CylanceOPTICS agent from a device
- Removing the CylanceOPTICS agent from a macOS device
Removing the CylanceOPTICS agent from a macOS device
CylanceOPTICS
agent from a macOS
deviceVerify that the CylanceOPTICS agent has been removed
CylanceOPTICS
agent has been removedRun the following command:
kextstat | grep -i cyoptic
For
macOS
Big Sur (11.x), run the following command as well:
systemextensionsctl list | grep -i cyoptics
The commands should return no output.
Confirm that the following paths and files are no longer present on the system:
- /Library/Application Support/Cylance/Optics
- /Library/Application Support/OpticsUninstall
- /Applications/Cylance/Optics
- /Library/LaunchDaemons/com.cylance.cyoptics_service.plist
- /Library/LaunchDaemons/com.cylance.optics.postuninstall.plist
- /Library/LaunchDaemons/com.cylance.cyopticsesfservice.plist
On a macOS Big Sur (11.x) device, after using an ssh session to silently uninstall the CylanceOPTICS agent, /Applications/Cylance/Optics/CyOpticsESFLoader.app remains and the system extension is still active
macOS
Big Sur (11.x) device, after using an ssh session to silently uninstall the CylanceOPTICS
agent, /Applications/Cylance/Optics/CyOpticsESFLoader.app remains and the system extension is still activeThis issue occurs because
Apple
has no mechanism to silently uninstall system extensions without explicit confirmation by the end user.To resolve, use the finder to locate CyOpticsESFLoader.app and drag it to the trashcan, then confirm the UI prompt to deactivate and remove the system extension.
If you get a permissions error when you drag the file to the trashcan, run the following command to temporarily disable
CylancePROTECT Desktop
:
sudo launchctl unload /Library/LaunchDaemons/com.cylance.agent_service.plist
After you run the command, you can drag the file to the trashcan and confirm the UI prompt. If you want
CylancePROTECT Desktop
to remain active, restart the device.You must remove CyOpticsESFLoader.app in this way before removing the
CylancePROTECT Desktop
agent from the device. If you remove the CylancePROTECT Desktop
agent before completing this task, /Applications/Cylance is removed from the device, including CyOpticsESFLoader.app, so you will not be able to manually delete it and deactivate the system extension.