Carbon Black Cloud: Does the Sensor Need the "Filtering Platform Connection" Events in the Windows Security Event Log?
search cancel

Carbon Black Cloud: Does the Sensor Need the "Filtering Platform Connection" Events in the Windows Security Event Log?

book

Article ID: 289391

calendar_today

Updated On:

Products

Carbon Black Cloud Endpoint Standard (formerly Cb Defense) Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Does disabling auditing for WFP affect the sensor?

Environment

  • Carbon Black Cloud Windows Sensor: All Supported Versions

Resolution

While the WFP Network Driver is needed the sensor doesn't require auditing for WFP to be enabled