App Control: The EDR server (cluster) does not function when the App Ccontrol agent is placed in High Enforcement (HE).

Products

• Carbon Black App Control (formerly Cb Protection)
• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• EDR server will not install.
• If installed, and the App Control Agent is moved to High Enforcement (HE), the EDR server / cluster stops collecting events and generates a growing aggregate event and binary backlog.

Environment

• Carbon Black App Control Agent: All Linux versions
• Carbon Black EDR Server: All versions
• RHEL Linux: All versions

Cause

Currently the EDR server is not compatible with the App Control Agent when in HE.

Resolution

Feature Request FR-003241 has been created to allow for co-existence with the App Control Agent in HE and the EDR server/cluster.