EDR: What happens to the event collection once the 'Sensor-side Max Disk Usage' threshold is hit?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• What happens to the event collection once the 'Sensor-side Max Disk Usage' threshold is hit?

Environment

• EDR Sensor: All supported versions

Resolution

• Once the 'Sensor-side Max Disk Usage' threshold is hit, the sensor will stop ingesting all new events, while preserving those that are already in the sensor's current backlog.