EDR: Sensor Health Score Message For "netmon stream driver failure".

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Run this command in an elevated cmd prompt:

sc query cbstream

• If it returns a state of "Stopped", then run this command:

net start cbstream

• and check for errors.

Environment

• EDR Sensor All Supported Versions
• Microsoft Windows: All Supported Versions

Cause

A required service "Base Filtering Engine" was disabled.

 

Resolution

• The Base Filtering Engine service is required to be running in order for the Carbon Black network filter to be loaded.
• Enable and start the "Baseline Filter" service. Once started, then run as administrator:

net start cbstream

• and confirm its running with:

sc query cbstream