CB Response: Duplicate Events Being Sent from CB-Event-Forwarder

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Duplicate events are being sent to the SIEM from the CB-Event-Forwarder

Environment

• Carbon Black Response Sensor: All Versions
• Carbon Black CB-Event-Forwarder: All Versions
• Microsoft Windows: All Versions

Cause

Sensor protobuff is sending duplicate events that are sent by the event forwarder

Resolution

CB-18338 has been open and expected in the 6.3.0 sensor release

Additional Information

• Please subscribe to this article for updates on the fix