EDR: What should we monitor to make sure the carbon black security agent is installed and is running?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

What should we monitor to make sure the carbon black security agent is installed and is running?

Environment

EDR Windows Sensor: 6.x and Higher

Resolution

• The process is called cb.exe
• The folder path to monitor is c:\windows\carbonblack\*
• The registry key is under HKLM/Software/CarbonBlack/config