Cb Response: Events show up in console delayed from specific sensor groups
book
Article ID: 289134
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
- Events show up in the console delayed (20 minutes or greater)
- Alerts are triggered for expected events that come into the console delayed
- Sites have throttle settings enabled
Environment
- Cb Response Server: 5.x and higher
- Cb Response Console: Multiple Sites created
Cause
- Sites are configured with excessive throttling, which is causing a backlog on the endpoints from any sensor group associated with the site.
Resolution
- Click on the User profile name in the top-right corner
- Click on 'Settings'
- Choose the site you want to adjust/remove the throttling for from the drop-down list
- To remove throttles, hover over each throttle config on the calendar and click the 'x' in the top right corner to delete it individually
- To adjust throttles, change the value in the calendar to reflect the throughput you want from the site.
Additional Information
- Throttles should be carefully monitored to make sure that bandwidth is not being abused at a particular site
Feedback
thumb_up
Yes
thumb_down
No