Carbon Black Cloud Audit and Remediation (Audit and Remediation): Which Admin Role is Used in Live Response Session

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Which Admin Role is Used in Live Response Session?

Environment

• Carbon Black Cloud Backend: All supported versions
• Carbon Black Cloud Sensor: All supported versions
• Operating Systems: Windows, Mac, Linux

Resolution

• Windows: SYSTEM
• Mac: Root
• Linux: Root

Additional Information

The role used in Live Response sessions could cause the difference between the result got from local view and LR session.