App Control: Receiving Health Check Events Related to the EDR Sensor

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Seeing Health Check Events in App Control Console related to EDR sensors not functioning

Carbon Black App Control Agent detected a problem: EDR healthcheck failed. Carbon Black Sensor (CarbonBlack) is not running.
Carbon Black App Control Agent detected a problem: Neither cbstream.sys or cbtdiflt.sys are loaded.

Environment

• App Control Server: All Supported Versions
• EDR Sensor: All Supported Versions

Cause

This happens when the agent detects an EDR sensor and the sensor isn't functioning normally

Resolution

• If the EDR sensor is supposed to be installed fix the issue stated in the event
• If the EDR sensor is not being used then it may need to be uninstalled via uninst.exe or have remnants of an old sensor removed

Additional Information

The health check can be configured to be ignored but fixing the actual cause of the event would be recommended