EDR: Event Forwarder Not Forwarding Events From Sensors Located on Minion(s)

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Only certain events (typically Feed Hits) are being sent to the Event Forwarder from sensors reporting to a minion.

Environment

• EDR Server: All Supported Versions
• EDR Forwarder: All Supported Versions

Cause

• Misconfiguration of config files.

Resolution

• Confirm the appropriate Event Forwarder settings within the /etc/cb/cb.conf file on the master matches those expected on the minion .
• Ensure proper settings in /etc/cb/integrations/event-forwarder/cb-event-forwarder.conf on the master.