EDR: How To Check Suppression Level Of Sensor

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to determine the Data Suppression Level of a Sensor

Environment

• EDR Server: All Supported Versions
• EDR Sensor: All Supported Versions

Resolution

1. Open Console > Click on Sensors
2. In the Configuration box, click the Sensor Group listed for 'Group:'
3. Under Groups, click the gear icon of the appropriate Sensor Group
4. Expand the Advanced screen to view the current Retention Maximization Level

Additional Information

Data Suppression for each Retention Maximization Level

• None: No data is suppressed. All process documents are recorded.
• Medium: Some data is suppressed. Process documents that contain only modload events are not recorded.
• High: More data is suppressed. Process documents that contain only modloads and/or crossproc events are not recorded.