Important: macOS Devices Running Capture Client 3.1 Should NOT be Upgraded to macOS Big Sur
BrookChelmo
SonicWall Employee
FROM OUR LATEST PRODUCT NOTICE
This is an important notice concerning Apple’s latest desktop operating system macOS Big Sur and Capture Client endpoint protection.
SonicWall highly recommends that macOS devices running Capture Client 3.1 not be upgraded to macOS Big Sur.
During WWDC 20 this summer, Apple confirmed that macOS Big Sur will strongly discourage support for Kernel Extension(“kext”) in favor of the newer System Extensions (“sysext”). This change greatly reduces the possibility of kernel panics on endpoints and reduce the attack surface.
To date, the SonicWall Capture Client and SentinelOne agents use kext. Agents using the newer sysext, also called “kextless,” are in development and will be made available via Capture Client 3.6, which is schedule for release in very early 2021.
Devices running Capture Client 3.1 and macOS Big Sur will not be protected.
• For more information on support of macOS Big Sur, please refer to the FAQs available here.
• For updates on Capture Client compatibility with macOS, please refer to this KB article.
• For any further questions, please contact SonicWall Support.
From the SonicWall Capture Client Product Team
Comments
Thank you @BrookChelmo !
I cant tell you how important this kind of information is to us. It saves a lot of people an enormous amount of time.
Stephan.
Over six months to have a working product is quite a long time. The fact of kexts being deprecated has been I think known even longer.
Hi @SonicAdmin80
AFAIK kext support in general got a grace period and is still working in macOS Big Sur, not sure how practible it'll be and definitly not the way to go.
But S1 is working on it, didn't gave the beta a try though, don't have enough machines to mess with.
Because other vendors reported missing macOS Big Sur support too, no blame from me. Either they are all lame ducks or it's pretty complicated, hope for the latter. 😉
--Michael@BWC
I'm a mac user and I had many problems with Capture Client. I hope that the new version using the newer System Extensions (“sysext”) be more stable!
Thanks,
Jorge Quintão
Hola @Jorge,
I hope for the best as well, but I'am trouble free at the moment with the latest 3.1.1 (3.5 is just an ongoing announcement for weeks).
I shared some information about the development from S1 itself, but this got dismissed here, keep my mouth shut on this though.
--Michael@BWC
Just saw this "holiday" news pop up on my new SentinelOne console:
Dec 24, 2020
New Agent Version Released
macOS Agent 4.6 GA (4.6.10.3673) was released!
Version Highlights:
Support for macOS Big Sur, Apple's new major OS release (11.0) and macOS Catalina (10.15)
The Agent uses user-space APIs instead of Kernel Extensions, which are deprecated in Big Sur.
Firewall Control, Device Control and Disconnect from Network are not supported in this release.
This version does not support Apple Silicon (ARM) platforms.
* Don’t forget to provide required permissions locally or through MDM.
See Agent release notes and installation guide for more details.
The Agent will be available on your Console shortly.
Here's hoping SonicWall makes the requisite changes quickly for those of you patiently waiting to get this...
Refer FAQ for BigSur Support on CC & S1: https://www.sonicwall.com/support/knowledge-base/capture-client-faqs-on-big-sur-support/200904070705957/