CB Response: Logs Not Forwarding To SIEM

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Logs from CB Response Server not forwarding to SIEM.

Environment

• CB Response Server: 6.1.1 and Higher

Cause

Hung CB-Event-Forwarder service.

Resolution

Restart CB-Event-Forwarder service on CB Response server.

initctl stop cb-event-forwarder 
initctl start cb-event-forwarder