CB Response: Does OSX sensor Collect Cross-processes?
Article ID: 289570
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Does OSX sensor collect cross-processes?
Environment
- CB Response sensor: OSX, all versions
- OSX: All versions
Resolution
The answer is no.
Per page 93 of the 6.5 user guide found here (https://community.carbonblack.com/t5/Documentation-Downloads/CB-Response-6-5-User-Guide/ta-p/79704?attachment-id=12582) regarding events collected by sensors:
"(Windows only) Cross-processes (an occurrence of a process that crosses the security boundary of another process)"
Per page 93 of the 6.5 user guide found here (https://community.carbonblack.com/t5/Documentation-Downloads/CB-Response-6-5-User-Guide/ta-p/79704?attachment-id=12582) regarding events collected by sensors:
"(Windows only) Cross-processes (an occurrence of a process that crosses the security boundary of another process)"
Feedback
Yes
No
Powered by
