Is there a minimum event collection and reporting in EDR sensors?
search cancel

Is there a minimum event collection and reporting in EDR sensors?

book

Article ID: 289229

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response) Carbon Black Hosted EDR (formerly Cb Response Cloud)

Issue/Introduction

If every type of Event Collection in the Sensor Group options is unchecked, should the console list any events from the sensors in that sensor group?

Environment

  • EDR Sensor: All versions
  • EDR Server: All versions

Resolution

There is a minimum baseline of event collection that gets reported in the console for main OS processes like svchost.exe in Windows or bash in Linux.