EDR Server: What are the cbevents directories in /var/cb/data/solr*/?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

What are the cbevents directories created under /var/cb/data/solr*/ and why do they take up so much disk space? 

Environment

• EDR Server: All versions

Resolution

• The cbevents folders contain all process and event information sent from endpoints. 
• It is expected that this location will take up a majority of disk space

Additional Information

If server is being pushed over disk limitations, retention settings can be adjusted via the MaxEventStore* variables. Further information on these variables can be found under the "Data Storage" section in the Server Config Guide.