Enterprise EDR: How do I enable Authentication Events Collection

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

How do I enable authentication event collection?

Environment

• Carbon Black Cloud Console
  • Enterprise EDR
• Microsoft Windows: All Supported Versions

Resolution

1. Upgrade sensors to version 3.9.1+. 
2. Enable "Auth Event Collection" under the Policy > Sensor tab

Additional Information

• This requires the Enterprise EDR Sku
• If Enterprise EDR is enabled and this option is not showing please contact support