Thanks to Clay Haynes for pointing out you can get the version more easily by running
/Applications/VMware\ Carbon\ Black\ EDR.app/Contents/MacOS/CbOsxSensorService -v
In Carbon Black 6.3.0 and 7.0.1, it isn’t super obvious how to check for the version installed.
For example, if you run
defaults read /Applications/VMware\ Carbon\ Black\ EDR.app/Contents/Info.plist, you’ll see
CFBundleInfoDictionaryVersion = "6.0"; (yes, even if you have version 7 installed), and you’ll also see
CFBundleShortVersionString = "1.0"; and
CFBundleVersion = 1;. Not terribly helpful.
Apparently, though, there is a hidden plist inside of the binary file, so if you run
plutil -p /Applications/VMware\ Carbon\ Black\ EDR.app/Contents/MacOS/CbOsxSensorService | grep "CFBundleShortVersionString", you’ll then see for 7.0.1, for example,
"CFBundleShortVersionString" => "184.108.40.20617"
FYI: It doesn’t seem you can get that same info using the plistlib Python library, because the binary isn’t a binary plist, it’s a giant binary file that happens to have plist info inside of it.