EDR: Event Forwarder 3.8.0 is not forwarding sensor events.

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

1. Event Forwarder 3.7.x works until upgrading to Event Forwarder 3.8.0
2. Event Forwarder 3.8.0 forwards all data EXCEPT raw sensor events.
3. Only certain sites experience the issue (due to partially malformed protobuf messages)

Environment

• EDR Event Forwarder: 3.8.0
• EDR Server: All versions
• Linux: All versions

Cause

This is issue CB-38376.

Resolution

CB-38376 is fixed in the Event Forwarder 3.8.2 and above.