What Functionality Remains After the License Expires?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

What functionality remains after the EDR license expires?

Environment

• Carbon Black EDR Servers:  All versions

Resolution

After the license expires for Carbon Black EDR servers:

The following features remain working:

• The console is still accessible
• Events are still searchable 
• Sensors still communicate (check-in) with the Carbon Black EDR server.

The following features no longer work after the 30-day grace period:

• Sensors will continue to collect data.
  • Data will be cached based on per group configuration. "Sensor-side Max Disk Usage"
  • By default this configuration is 1GB or 2% of disk space, whichever is hit first, for each events and storefiles (physical binary zip). Totaling up to 2GB or 4% of disk.
  • Once the disk usage threshold has been hit, all new events and/or binary zips will be dropped. 
  • Upon uploading a valid license, the sensors will begin sending the cached events and binary zip files. 
• Threat intel no longer updates.
• All other functions like live response, banning (new hashes) will no longer work.
• Updates and new software packages are not available.