Carbon Black Cloud: Why is There a Temporary Resource Increase After Upgrading the Sensor?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Why is there a spike in resource utilization after upgrading the sensor?

Environment

• Carbon Black Cloud Sensor: All Supported Versions

Resolution

After an upgrade the sensor is trying to:

• Re-establish communication with the console
• Checking for and applying policy updates
• Checking for and applying signature updates
• Downloading any new DRE rules
• Cleanup on old persisted signature information

The extra resource utilization is temporary and should subside shortly after the upgrade is complete.