EDR: What Are The Windows Sensor Health Score Events?

Products

• Carbon Black EDR (formerly Cb Response)
• Carbon Black Hosted EDR (formerly Cb Response Cloud)

Issue/Introduction

What are the Windows sensor health score events and what is the impact on sensor health?

Environment

• EDR Server: All Versions
• Microsoft Windows: All Supported Versions

Resolution

 

Event Load

Event Queue Depth	Health Score	Message
> 512	-5	Elevated event load
> 1024	-10	High event load
> 4096	-25	Excessive event load

 

 

Event Loss

Event Loss (%)	Health Score	Message
1	-5	Elevated event loss
2	-10	High event loss
5	-20	Very High event loss
10	-50	Excessive event loss

 

 

Disk Space

Disk Space (MB)	Health Score	Message
< 1024	-5	Low disk space
< 100	-25	Very Low disk space
< 10	-50	Excessively low disk space

 

 

Handle Count

Handles	Health Score	Message
> 500	-5	Elevated handle count
> 1000	-10	High handle count
> 2000	-25	Very high handle count
> 4000	-50	Excessive handle count

 

 

GDI Handle Count

GDI Handles	Health Scores	Message
> 100	-5	Excessive GDI HANDLE count
> 500	-10	Very High GDI HANDLE count
> 1000	-20	High GDI HANDLE count

 

 

Memory Usage

Memory (MB)	Health Score	Message
> 50	-5	Elevated memory usage
> 100	-10	Elevated memory usage
> 200	-20	High memory usage
> 512	-25	Very high memory usage
> 1024	-50	Excessive memory usage

 

Driver and Component Failures

Driver Failure	Health Score	Message
Svc Component	-25	Svc Component Failure
Netmon Driver	-25	NetMon Stream Driver Failure
Core Driver	-100	Core Driver Failure

Additional Information

Remediation options can be found in the User Guide.