Can events be resent through the Event Forwarder?

Products

• Carbon Black EDR (formerly Cb Response)
• Carbon Black Hosted EDR (formerly Cb Response Cloud)

Issue/Introduction

Can events that occurred when the Event Forwarder was not enabled, or off, be resent via the Event Forwarder?

Environment

• EDR Server: All supported versions
• Event Forwarder: All supported versions

Resolution

No. If the Event Forwarder is not enabled or running, there will be no writing events to JSON and there is no way to regenerate those events.

Additional Information

If the Event Forwarder was running but not sending the events then it could be writing the events but not deleting them because it deletes the events after successfully forwarding them. In this case the events written but not sent, could be resent after the Event Forwarder is working again.