EDR: What happens to the event collection once the 'Sensor-side Max Disk Usage' threshold is hit?
book
Article ID: 287416
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
What happens to the event collection once the 'Sensor-side Max Disk Usage' threshold is hit?
Environment
EDR Sensor: All supported versions
Resolution
Once theĀ 'Sensor-side Max Disk Usage' threshold is hit, the sensor will stop ingesting all new events, while preserving those that are already in the sensor's current backlog.