CB Response: Can local sensor eventlogs, that can't be uploaded to the server, be decrypted on the sensor itself for investigation?
book
Article ID: 288258
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Can local sensor eventlogs, that can't be uploaded to the server, be decrypted on the sensor itself for investigation?
Environment
- CB Response Server: All versions.
- CB Response Sensor: All versions.
Resolution
No. The eventlogs need to be uploaded to the server to be processed.
Additional Information
This is by design, partially for security reasons.
Feedback
thumb_up
Yes
thumb_down
No