Enterprise EDR: How much data will be cached on the endpoint?
book
Article ID: 285835
calendar_today
Updated On:
Products
Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
Issue/Introduction
How much event and binary data will the sensor cache (or backlog) if it cannot transfer it to the backend servers?
Environment
- Enterprise EDR Sensor: 3.4.0 and Higher
- Microsoft Windows: All supported versions
- Apple macOS: All supported versions
- Linux: All Supported Versions
Resolution
- Windows Sensor: 1GB
- macOS Sensor: 500 MB
- Linux Sensor: 1 GB
Additional Information
- Event data is stored in a .db file.
- If the file sizes above are exceeded, the oldest events are dropped in order to make room for newer, incoming events.
- The Windows Sensor limit is configurable via ConfigProp using RMS.
Feedback
thumb_up
Yes
thumb_down
No