EDR: Where are Memdumps Stored from a Live Response Session?
book
Article ID: 291082
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Where are memory dump files stored after being uploaded to the server via a Live Response session?
Environment
- EDR Sensor: 6.x and Higher
- Live Response: All Versions
Resolution
/var/cb/data/live-response/sessions
Additional Information
- This is the default directory.
- If the DatastoreRootDir directory is not set to "/var/cb/data" then check the location, "/live-response/sessions".
- The default format is .dmp
Feedback
thumb_up
Yes
thumb_down
No