EDR: What do the tamper levels represent in the sensor registrations table?

Products

• Carbon Black EDR (formerly Cb Response)
• Carbon Black Hosted EDR (formerly Cb Response Cloud)

Issue/Introduction

In the sensor_registrations.csv file, what do the numbers in the tamper_level column represent?

Environment

• EDR Server: 7.4.0 and higher
• EDR Windows Sensor: All supported versions

Resolution

The tamper levels are as follows:

• tamper_level 0 = None
• tamper_level 1 = Detection
• tamper_level 2 = Protection

Additional Information

• Tamper protection has minimum requirements to be supported. See more in the Tamper Protection of Windows Sensors section of the User Guide.
• More details regarding the tamper levels can be found in the User Guide