CB Response: Duplicate Events Being Sent from CB-Event-Forwarder
search cancel

CB Response: Duplicate Events Being Sent from CB-Event-Forwarder

book

Article ID: 287936

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Duplicate events are being sent to the SIEM from the CB-Event-Forwarder

Environment

  • Carbon Black Response Sensor: All Versions
  • Carbon Black CB-Event-Forwarder: All Versions
  • Microsoft Windows: All Versions

Cause

Sensor protobuff is sending duplicate events that are sent by the event forwarder

Resolution

CB-18338 has been open and expected in the 6.3.0 sensor release

Additional Information

  • Please subscribe to this article for updates on the fix