Hosted EDR: How to Enable Audit Logging

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

To enable audit logging for a Hosted EDR instance

Environment

• Hosted EDR: All Versions
• CB Event Forwarder: All Versions

Resolution

1. Install CB Event Forwarder if not already installed.
2. Open a Carbon Black support case to enable audit logging.
3. Provide the hostname of the server on the case.
4. Confirm the audit logging feature is functioning correctly once a message is received that it is enabled.
5. Close the case.

Additional Information

• Outputting to multiple destinations is not supported at this time.