macOS Sensor Processes and Paths
Here is the complete list of macOS Sensor processes and paths that you should exclude from your EDR tools and other security applications.
Sensor Processes
The following processes are located under /Applications/Cyberhaven.app/Contents/.
| Process Name | Description |
|---|---|
| MacOS/Cyberhaven | Cyberhaven top-level application. |
| MacOS/CyberhavenSessionMonitor | Monitors user-session-specific events and listens for browser extension updates on https://localhost:10584/api/update |
| CyberhavenSystemMonitor.app/Contents/MacOS/CyberhavenSystemMonitor | Monitors filesystem activity and applications file accesses |
| MacOS/CyberhavenHealthMonitor | Watchdog process for other Cyberhaven processes |
| MacOS/CyberhavenAutoUpdater | Sensor self--update service |
| MacOS/CyberhavenCtl | Configuration service, monitors MDM profile configuration |
Sensor Paths
A macOS device that is running Cyberhaven will have application and log files stored in the following folders.
Directory
/Applications/Cyberhaven.app/
/Library/Application\ Support/io.cyberhaven.lightbeam/
/var/log/io.cyberhaven.lightbeam/
/Users/Shared/io.cyberhaven.lightbeam/
Change Log
- Updated on 04/21/2025: Removed
MacOS/CyberhavenChromeExtensionHostprocess since the Chrome extension is now self-hosted.