Enterprise EDR: How do I enable Authentication Events Collection
book
Article ID: 291159
calendar_today
Updated On:
Products
Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
Issue/Introduction
How do I enable authentication event collection?
Environment
- Carbon Black Cloud Console
- Microsoft Windows: All Supported Versions
Resolution
- Upgrade sensors to version 3.9.1+.
- Enable "Auth Event Collection" under the Policy > Sensor tab
Additional Information
- This requires the Enterprise EDR Sku
- If Enterprise EDR is enabled and this option is not showing please contact support
Feedback
thumb_up
Yes
thumb_down
No