Carbon Black Cloud: What frequency will the Data Forwarder write to S3 Buckets?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

What frequency will the Data Forwarder write to S3 Buckets?

Environment

• Carbon Black Cloud
• CB Cloud Data Forwarder
• Amazon Simple Storage Service (Amazon S3)

Resolution

• Alerts
  • 100 MB (uncompressed) or 30 seconds, whichever comes first (and it's almost always the 30 second timer)
• Events
  • 100 MB (uncompressed) or 5 minutes, whichever comes first

Additional Information

• The files are written in the following format, with the timestamp being when the files were written to the S3 Bucket:

org_key=ABCD1234/year=2019/month=8/day=27/hour=12/minute=36/second=53/ac203140-f0e2-48fe-90cf-05eb7289f628.jsonl.gz