CB Response: Duplicate Events Being Sent from CB-Event-Forwarder
book
Article ID: 287936
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Duplicate events are being sent to the SIEM from the CB-Event-Forwarder
Environment
- Carbon Black Response Sensor: All Versions
- Carbon Black CB-Event-Forwarder: All Versions
- Microsoft Windows: All Versions
Cause
Sensor protobuff is sending duplicate events that are sent by the event forwarder
Resolution
CB-18338 has been open and expected in the 6.3.0 sensor release
Additional Information
- Please subscribe to this article for updates on the fix
Feedback
thumb_up
Yes
thumb_down
No