Cb Response: Events show up in console delayed from specific sensor groups

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Events show up in the console delayed (20 minutes or greater)
• Alerts are triggered for expected events that come into the console delayed
• Sites have throttle settings enabled

Environment

• Cb Response Server: 5.x and higher
• Cb Response Console: Multiple Sites created

Cause

• Sites are configured with excessive throttling, which is causing a backlog on the endpoints from any sensor group associated with the site.

Resolution

1. Click on the User profile name in the top-right corner
2. Click on 'Settings'
3. Choose the site you want to adjust/remove the throttling for from the drop-down list
   1. To remove throttles, hover over each throttle config on the calendar and click the 'x' in the top right corner to delete it individually 
   2. To adjust throttles, change the value in the calendar to reflect the throughput you want from the site.

Additional Information

• Throttles should be carefully monitored to make sure that bandwidth is not being abused at a particular site