App Control : Does the agent use its own time source for reporting events?

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Does the agent keep its own time, or does it use the time of the endpoint its installed on?

Environment

• App Control  Server: All Versions
• App Control agent: All Versions
• Microsoft Windows OS: All Supported Versions

Resolution

No, the agent does not keep its own time. All events reported by the agent are stamped with the time reported by the endpoint OS.

Additional Information

Agents reporting "agent notification (time change)" events are having the time changed on the Windows OS. This could be done manually, or it could be drifting if the endpoint is not connected to an NTP source for time.