EDR: What should we monitor to make sure the carbon black security agent is installed and is running?
book
Article ID: 289192
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
What should we monitor to make sure the carbon black security agent is installed and is running?
Environment
EDR Windows Sensor: 6.x and Higher
Resolution
- The process is called cb.exe
- The folder path to monitor is c:\windows\carbonblack\*
- The registry key is under HKLM/Software/CarbonBlack/config
Feedback
thumb_up
Yes
thumb_down
No