Carbon Black Cloud: Does the Sensor Need the "Filtering Platform Connection" Events in the Windows Security Event Log?
book
Article ID: 289391
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
Issue/Introduction
Does disabling auditing for WFP affect the sensor?
Environment
- Carbon Black Cloud Windows Sensor: All Supported Versions
Resolution
While the WFP Network Driver is needed the sensor doesn't require auditing for WFP to be enabled
Feedback
thumb_up
Yes
thumb_down
No