Carbon Black Cloud: Does the Sensor Need the "Filtering Platform Connection" Events in the Windows Security Event Log?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Does disabling auditing for WFP affect the sensor?

Environment

• Carbon Black Cloud Windows Sensor: All Supported Versions

Resolution

While the WFP Network Driver is needed the sensor doesn't require auditing for WFP to be enabled