Is there a minimum event collection and reporting in EDR sensors?
book
Article ID: 289229
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Carbon Black Hosted EDR (formerly Cb Response Cloud)
Issue/Introduction
If every type of Event Collection in the Sensor Group options is unchecked, should the console list any events from the sensors in that sensor group?
Environment
- EDR Sensor: All versions
- EDR Server: All versions
Resolution
There is a minimum baseline of event collection that gets reported in the console for main OS processes like svchost.exe in Windows or bash in Linux.
Feedback
thumb_up
Yes
thumb_down
No