EDR: What should we monitor to make sure the carbon black security agent is installed and is running?
search cancel

EDR: What should we monitor to make sure the carbon black security agent is installed and is running?

book

Article ID: 289192

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

What should we monitor to make sure the carbon black security agent is installed and is running?

Environment

EDR Windows Sensor: 6.x and Higher

Resolution

  • The process is called cb.exe
  • The folder path to monitor is c:\windows\carbonblack\*
  • The registry key is under HKLM/Software/CarbonBlack/config