Hosted EDR: Can events be resent through the Event Forwarder?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Can events that occurred when the Event Forwarder was not enabled, be resent via the Event Forwarder?

Environment

• Hosted EDR: All supported versions
• Event Forwader for Hosted EDR: All supported versions

Resolution

No. If the Event Forwarder is not enabled or running, there will be no writing events to JSON and there is not currently a way to regenerate those events.