EDR Server: Why are Sensor Updates Creating Tamper Detection Alerts?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Why are Sensor Updates Creating Tamper Detection Alerts?

Environment

• EDR Server Console: All Versions
• EDR Sensor: 7.1.0 and Lower
• Microsoft Windows: All Supported Versions

Resolution

This is by design for earlier sensor version. The sensor will report any time the sensor service is shutdown. Uninstall.exe will show in the tamper detection alert and can be ignored.
Upgrade to sensor version 7.1.0 or higher to correct this. 

Additional Information

CB-30103