CB Response: Can local sensor eventlogs, that can't be uploaded to the server, be decrypted on the sensor itself for investigation?
search cancel

CB Response: Can local sensor eventlogs, that can't be uploaded to the server, be decrypted on the sensor itself for investigation?

book

Article ID: 288258

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Can local sensor eventlogs, that can't be uploaded to the server, be decrypted on the sensor itself for investigation?

Environment

  • CB Response Server: All versions.
  • CB Response Sensor: All versions.

Resolution

No. The eventlogs need to be uploaded to the server to be processed.

Additional Information

This is by design, partially for security reasons.