EDR: What happens to the event collection once the 'Sensor-side Max Disk Usage' threshold is hit?
search cancel

EDR: What happens to the event collection once the 'Sensor-side Max Disk Usage' threshold is hit?

book

Article ID: 287416

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • What happens to the event collection once the 'Sensor-side Max Disk Usage' threshold is hit?

Environment

  • EDR Sensor: All supported versions

Resolution

  • Once theĀ 'Sensor-side Max Disk Usage' threshold is hit, the sensor will stop ingesting all new events, while preserving those that are already in the sensor's current backlog.