No new clients are enrolled while running backups of event data on EDR

Products

• Endpoint Detection and Response

Issue/Introduction

When performing an event data backup on a large EDR Appliance, you notice that no new clients get enrolled and SEPM group changes are not reflected until the backup is finished, sometime hours or days later.

Cause

This is by design. While event data backups are running, the SEPM gatherer process is halted to prevent new data from extending the backup time.

Resolution

It is recommended that you use the configuration backup rather than the event data backup wherever possible. Capturing the event data is better served via SIEM integration.