Carbon Black Cloud: What is the Limit for Concurrent Live Response Sessions?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

How many simultaneous Live Response (LR) sessions can be open or active at one time?

Environment

• CBC Console: All Versions
• CBC Sensor: 3.1.x.x and Higher
• Microsoft Windows: All Supported Versions
• Apple macOS: All Supported Versions

Resolution

100 LR sessions can be established at a single time.

Additional Information

• If multiple Live Response (LR) Admin users have an LR session with the same device, this will only count as one, as the Sensor only allows a single LR session to be opened at a time
  • All LR Admins connecting to the same machine during this time will be using the same session
• LR Sessions where commands have been sent will timeout after 15 minutes and close automatically
• LR Sessions where no commands have been sent will timeout after 30 minutes (DSER-14828)