Enterprise EDR: How do I enable Authentication Events Collection
search cancel

Enterprise EDR: How do I enable Authentication Events Collection

book

Article ID: 291159

calendar_today

Updated On:

Products

Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

How do I enable authentication event collection?

Environment

  • Carbon Black Cloud Console
    • Enterprise EDR
  • Microsoft Windows: All Supported Versions

Resolution

  1. Upgrade sensors to version 3.9.1+. 
  2. Enable "Auth Event Collection" under the Policy > Sensor tab

Additional Information

  • This requires the Enterprise EDR Sku
  • If Enterprise EDR is enabled and this option is not showing please contact support