Carbon Black Cloud: What are the scripts in the IR folder used for?

Products

• Carbon Black Cloud Audit and Remediation (formerly Cb Live Ops)
• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

What are the scripts PerfInfo.vbs, ProcInfo.vbs, and RttInfo.vbs in the IR folder used for?

Environment

• Endpoint Standard Sensor: 3.1.x - 3.5.x
• Enterprise EDR Sensor: 3.3.x - 3.5.x

Resolution

The scripts purpose in life was to collect additional system information during diagnostic collection during an IR event.  That said, the scripts have outlived their purpose as we now recommend leveraging LiveOps or other means of obtaining system information.

The scripts have been deprecated and removed starting with the 3.6.x sensor and higher.