What Information Is needed for Performance Cases?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

What data is required to start an investigation into sensor performance issues?

Environment

• Carbon Black Cloud Sensor: All Supported Versions
• Microsoft Windows: All Supported Versions

Resolution

Please provide:

1. Background information:
   1. The Device ID or Name of the impacted device.
   2. When the issue started occurring and if there were any changes that led up to it
   3. Any Applicable application names and the paths/processes involved when the impact occurs.
   4. Are there other 3rd party security applications installed? Have exclusions been configured?
      • How to Set up Exclusions in the Carbon Black Cloud Console for AV Products
      • Recommended Third-Party Anti-virus Exclusions
   5. Is it reproducible? If yes, what are the steps?
      • Please attach any applicable screenshots to the case.
   6. Does placing the sensor into bypass mode resolve the issue?
2. Sensor Performance Logs:
   • How To Collect Sensor Performance Logs (Windows)
   • How to Collect Sensor logs locally (Linux)
   • How To Collect Sensor Logs Locally (Mac)

Additional Information

Collecting performance logs requires repcli authentication. Please see:

• How to Enable Authentication for RepCLI Utility During Sensor Install
• How to Enable RepCLI Authentication on Existing Sensors