Confirm that port 5004 is open for communication to the EDR server
Start the cb-event-forwarder service
intictl start cb-event-forwarder
Additional Information
The feature to configure the event forwarder via the console is not available to remote event forwarder installations.
Audit logging is not available to remove event forwarders, on a direct installed event forwarder it pull the audit logs directly from /var/log/cb/audit, in which a remote event forwarder does not have access to get. If possible, setup a local event forwarder that is set to only forward audit logs if the remote forwarder is to reduce load on the EDR server.