Does anyone have a current list of components and where to find them that need to be granted full disk access on Catalina? They used to be present in the known issues document, but when Sophos added the pop-up interface, they seem to have pulled it from documentation. Unfortunately, this system refused to play nice and give me Full Disk Access notification with the easily draggable UI bit.
https://support.sophos.com/support/s/article/KB-000039014?language=en_US does have some info on processes, but it doesn't detail where to find the files.
In comparing the files I manually whitelisted on Catalina to the files that were added by the popup on Big Sur, I was missing and unable to locate "SophosMDR" and "com.sophos.en....systemextension". From poking about, it appears that MDR is an optional component, if it turns out we're utilizing that, where do I find that file? From other poking about, it appears that the com might be com.sophos.endpoint.scanextension.systemextension and limited to Big Sur. Can anyone confirm? If not, any ideas where that bugger is hiding?
Hi Nathan Paquette,
I am using macOS Catalina, and I was able to locate the Sophos MDR file here- Finder > Go > Computer > Macintosh HD > Library > Sophos Managed Detection and Response …
Thank you for reaching is, let us check with this and get back to you.
I am using macOS Catalina, and I was able to locate the Sophos MDR file here- Finder > Go > Computer > Macintosh HD > Library > Sophos Managed Detection and Response > Sophos MDR. Can you please check if you see the file there and proceed to give it full access?
Yashraj Singha | Team Lead, Global Community SupportSupport Videos | Product Documentation | @SophosSupport | Sign up for SMS Alerts If a post solves your question use the 'Verify Answer' button.
Thanks Yashraj, I've discovered that we don't use MDR, which explains why I didn't find it in /Library. And I found the com in /library/system extensions on one of my Big Sur machines; though I'll have to check for it on the Catalina machine.
Thank you for clarifying that. Please message me/open a new thread if you need any further help.