Cb Defense: What is the Performance Impact for Running Background Scan?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

What is the expected performance impact for running background scan?

Environment

• Cb Defense PSC Console: All Versions
• Cb Defense Sensor: All Versions
• Microsoft Windows: All Supported Versions
• Apple macOS: All Supported Versions

Resolution

On an individual device, the overhead to run a Standard Background Scan (the default scan type) is minimal.  The process is performed at a very slow pace to minimize the impact.  However, in a large deployment when many endpoints install the Cb Defense Sensor Service at approximately the same time, the accumulation of all these devices contacting the backend system for reputation lookups can sum up to a substantial workload for any firewall/gateway employed on the customer side. With that use case - it would be better to spread out the deployment in groups. The Expedited Background Scan (only for 3.3.x.x Sensors and Higher for Windows) consumes considerably more resources and will have a significant performance impact on devices where it is used.