Summary

System Extension is a security feature that started in macOS Big Sur, which includes the following:

• com.trendmicro.icore.es.sa → Includes process executions, mounting file systems, forking processes, and raising signals.
  Reference: Apple Developer Documentation on Endpoint Security
• com.trendmicro.icore.netfilter.sa → Extends core networking features.
  Reference: Apple Developer Documentation on Network Extension

Full Disk Access is a security feature introduced in macOS Mojave that requires applications to be given full permission to access user-protected files. If not enabled, some data on the Mac will not be accessible. In previous macOS versions, this permission was automatically given during installation.

In order to enable Endpoint Sensor monitoring on your computer, you must allow System Extension and Full Disk Access.

There is a current issue where Endpoint Sensor loses System Extension and Full Disk Access after a macOS upgrade, even when both features have been granted appropriately. When encountering this issue, user would have to reacquire or allow lost System Extension / Full Disk Access again.

Consider the following scenarios:

• Scenario 1: macOS upgrade from old versions (10.14/10.15) to Ventura (13)

  In this scenario, "System Extension Blocked" is displayed. Permission had to be granted again. Same goes for Full Disk Access - permission had to be granted for Trend Micro Extension (XDR).

  

  

  

  

• Scenario 2: macOS upgrade from old versions(11/12) to Ventura(13).

  In this scenario, Full Disk Access permission guidance is shown as enabled, but actually is not. Permission had to be granted again, especially for Trend Micro Extension(XDR).

  

  

The root cause for this issue is a bug in macOS. In the beta release of macOS 13.1, Apple listed this as a known issue: macOS Ventura 13.1 Beta Release Notes .

As a result of this issue, user will be prompted to complete setup wizard (Full Disk Access part only).