Enterprise EDR: Are Auth Events in Investigate Page Supported for Linux and macOS Sensors?

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Are Auth Events in Investigate page supported for Linux and macOS sensors?

Environment

• Enterprise EDR: All Suppported Versions
• Linux: All Supported Versions
• macOS: All Supported Versions

Resolution

No, Carbon Black Cloud Enterprise EDR features Identity Intelligence which provides visibility into authentication events that occur on Windows sensor devices currently.

Additional Information

• This is supported by Carbon Black Cloud Windows Sensor 3.9.1+ running on Windows 10.0.15063+.
• The Auth Events tab is only available for Carbon Black Cloud Enterprise EDR customers.