High CPU Usage When AUTH Events is Enabled

Products

• Carbon Black Cloud Managed Detection and Response
• Carbon Black Cloud Enterprise EDR
• Carbon Black Cloud Endpoint Standard

Issue/Introduction

Sensor is exhibiting high CPU usage when AUTH events is enabled

Environment

Carbon Black Cloud Windows Sensor: All Supported Versions

Cause

An increased amount of AUTH events is causing more work for the sensor to compute 

Resolution

• Upgrade to the 4.0.2 sensor as there is an issue fixed with Unique Login Sessions and AUTH events
• Disable AUTH events in the policy

 

Additional Information

If this only happens when AUTH events and Windows Defender is enabled reach out to Carbon Black for further steps