CB Response: How Are Sensor Health Scores Calculated?
book
Article ID: 287070
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
How are sensor health scores calculated?
Environment
CB Response: All Versions
Microsoft Windows: All Supported Versions
Apple Mac OS: All Supported Versions
Linux: All Supported Versions
Resolution
The default score for a sensor running without issue is 100, with unhealthy symptoms subtracting from this score for events that fall outside of “healthy range,” based on severity.
Example: A sensor experiencing high memory usage would be graded based on the below scale.
Memory (MB)
Health Score
Message
> 50
-5
Elevated memory usage
> 100
-10
Elevated memory usage
> 200
-20
High memory usage
> 512
-25
Very high memory usage
> 1024
-50
Excessive memory usage
Additional Information
Sensor health messages are not currently available in the console, but can be accessed via SQL queries (and API).
In CB Response server release 6.2.4, we will provide the sensor health message on the sensor page within the console UI.
Sensor health messages are provided when the sensor is in an unhealthy state.
Sensor health scores are generated using a variety of inputs, such as: