EDR: Will Multiple Sensors Upload Same Binary
search cancel

EDR: Will Multiple Sensors Upload Same Binary


Article ID: 290086


Updated On:


Carbon Black EDR (formerly Cb Response)


Is there a situation where multiple Sensors will upload the same binary, e.g, patching ?


  • EDR Server: All Versions
  • EDR Sensor: All Versions
  • CB Cluster


Yes. In a CB Cluster environment this issue may occur when Sensors are uploading to different Secondary servers. This is due to a timing/race condition when the CB Cluster is aware of the binary to upload.  

Additional Information

  • The first client to report the binary will get a request to upload the file
  • Other endpoints will also receive requests to upload the binary until the binary is received from one
  • There have been no issues raised related to this. Essentially this is a race to upload the binary as soon as the update occurs