CB App Control: Are the App Control events forwarded to Splunk cached if the connection to Splunk is lost?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Are the App Control events forwarded to Splunk cached if the connection to Splunk is lost?

Environment

• App Control Server: All Supported Versions

Resolution

Yes.  App Control will cache the events locally until the connection to Splunk is restored, or until it runs out of disk space.