EDR: What Are The Windows Sensor Health Score Events?
search cancel

EDR: What Are The Windows Sensor Health Score Events?

book

Article ID: 286313

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response) Carbon Black Hosted EDR (formerly Cb Response Cloud)

Issue/Introduction

What are the Windows sensor health score events and what is the impact on sensor health?

Environment

  • EDR Server: All Versions
  • Microsoft Windows: All Supported Versions

Resolution

 

Event Load

Event Queue Depth

Health Score

Message

> 512

-5

Elevated event load

> 1024

-10

High event load

> 4096

-25

Excessive event load

 
 

Event Loss

Event Loss (%)

Health Score

Message

1

-5

Elevated event loss

2

-10

High event loss

5

-20

Very High event loss

10

-50

Excessive event loss

 
 

Disk Space

Disk Space (MB)

Health Score

Message

< 1024

-5

Low disk space

< 100

-25

Very Low disk space

< 10

-50

Excessively low disk space

 
 

Handle Count

Handles

Health Score

Message

> 500

-5

Elevated handle count

> 1000

-10

High handle count

> 2000

-25

Very high handle count

> 4000

-50

Excessive handle count

 
 

GDI Handle Count

GDI Handles

Health Scores

Message

> 100

-5

Excessive GDI HANDLE count

> 500

-10

Very High GDI HANDLE count

> 1000

-20

High GDI HANDLE count

 
 

Memory Usage

Memory (MB)
Health Score
Message
> 50
-5
Elevated memory usage
> 100
-10
Elevated memory usage
> 200
-20
High memory usage
> 512
-25
Very high memory usage
> 1024
-50
Excessive memory usage
 

Driver and Component Failures

Driver Failure

Health Score

Message

Svc Component

-25

Svc Component Failure

Netmon Driver

-25

NetMon Stream Driver Failure

Core Driver

-100

Core Driver Failure

Additional Information

Remediation options can be found in the User Guide.