EDR: Sensors taking up too much bandwidth

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Sensors are utilizing available bandwidth, which is causing network bottlenecks.

Environment

• EDR Server: All Supported Versions
• EDR Sensor: All Supported Versions

Cause

Bandwidth limitations in the environment.

Resolution

There are several steps that will help resolve this issue:

1. Enable Site Throttling within the Response UI.
2. Increase available bandwidth for the impacted environment.
3. Reduce the total amount of local data collected by the Sensor.

Additional Information

• EDR Sensors are working as designed but may need to be tuned to match the network availability of the environment they are deployed to.
• This issue can also occur in environments where the sensor backlog has grown at a rapid pace, such as an EDR Server outage.