Carbon Black Cloud: Why Do Events To S3 Bucket Decrease When Endpoint Standard Is Disabled In An Org?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Why Is There A Decrease In Events To S3 Bucket When Disabling Endpoint Standard In an Org?

Environment

• Endpoint Standard Sensor: All Supported Versions
• Carbon Black Cloud Console: All Versions
• Enterprise EDR Sensor: All Supported Versions

Resolution

This is normal to see drop in logging to S3 bucket when disabling a feature in the product. Endpoint Standard records a significant amount of data which explains the drop in events.