EDR: Excessive Event loss when OS starts up

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Lower health score due to event loss.

Environment

• EDR: All versions

Cause

Our need to balance system performance with event collection, and the changes that occur between various versions of Windows itself.

Resolution

Please don't be alarmed by the lower health score due to event loss that may appear during the first fifteen minutes after startup. This is normal startup behavior.