EDR: What do the different values for "Power State" mean in the Sensor Details page on the WebUI?
book
Article ID: 289141
calendar_today
Updated On:
Products
Carbon Black Hosted EDR (formerly Cb Response Cloud)
Issue/Introduction
What do the different values for "Power State" mean in the Sensor Details page on the WebUI?
Environment
- EDR Server: All Versions
- EDR Windows Sensor: All Supported Version
- Windows OS: All Supported Versions
Resolution
There are three possible values (2, 1, and 0) for the "Power State" in the Sensor Details page:
- SERVICE_CONTROL_SHUTDOWN which is when the os is being shutdown we set that value to
2 = powerstate::shutdown_state
- SERVICE_CONTROL_POWEREVENT:PBT_APMRESUMEAUTOMATIC (resuming) we set to
0 - powerstate::running_state
- SERVICE_CONTROL_POWEREVENT:PBT_APMSUSPEND (suspending) we set to
1 - powerstate::suspended_state
Feedback
thumb_up
Yes
thumb_down
No