All Products: How To Check Filter Level Drivers and Elevation
search cancel

All Products: How To Check Filter Level Drivers and Elevation

book

Article ID: 289269

calendar_today

Updated On:

Products

Carbon Black App Control (formerly Cb Protection) Carbon Black Cloud Endpoint Standard (formerly Cb Defense) Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter) Carbon Black EDR (formerly Cb Response) Carbon Black Hosted EDR (formerly Cb Response Cloud)

Issue/Introduction

Check to see what drivers are installed and their elevations to determine if one security software is detecting an event before another

Environment

  • Microsoft Windows: All Supported Versions

Resolution

  1. Run CMD as Administrator
  2. FLTMC filters
    • Each filter level driver will be listed with its elevation
    • Lower elevations will see an event before higher elevations
    • If a file is deleted by a lower level elevation driver then a higher elevation driver may not see that file
Powered by Wolken Software